Use of your data for Contact Tracing

Along with Testing, TTIs (Track, Trace, Isolate) are actions within the Test and Protect Strategy.

Our approach is guided by the Chief Medical Officer, and we continue to monitor the situation closely and to work with the WHO and international community.

We are working with the Welsh Government, Northern Ireland Executive, and the UK Government to respond to the ongoing outbreak.

This page sets out the Scottish approach to “test, trace, isolate and support“, and the extensive work that is now underway to prepare for its implementation.  

Lead organisation(s)

  • Scottish Government
  • NHS National Services Scotland (NHS NSS)
  • Public Health Scotland (PHS)
  • Territorial Health Boards

Local Authorities and others will also be involved in the provision of support.

What is being done and why?

  • Until now, if you had been tested positive for COVID, contact tracers across the NHS Scotland would have used the Simple Tracing Tools (SST) as a temporary measure, in order to conduct contact tracing. SST is a secure system built by NSS, StormID and the Digital Health and Care Institute.  
  • This system has now been phased out and all Health Boards are using the Case Management System (CMS) is adopted by all Health Boards in Scotland. CMS has enhanced functionality that helps to manage  contact tracing in a more holistic and efficient manner.

  • The Case Management System, will hold the contact details of every person who has tested positively for COVID-19.

  • Contact handlers from the National Contact Tracing Centre will call the person who has tested positive and ask them to provide information on who they have been in contact with and where they have been for the period 48 hours prior to symptoms starting (or from the date the test was taken if no symptoms are displayed).

  • On receiving their text notification of their test result, those who test positive will now also be provided with a link to enter their initial contact tracing information into a secure webform.  The use of this webform is optional and those who test positive who chose to use the form will still be contacted by a contact tracer in due course.  All information submitted via the webform will be transferred safely and securely to NHS National Services Scotland and integrated into the Case Management System.

  • They will also ask for contact details of anyone that the person who has tested positive may have been in contact with while displaying symptoms. The telephone call will be made to you using a telephony system built into the Case Management System. This telephony system can make and receive calls.

 

The number of the telephony system used by the National Contact Tracing Centre is 0800 030 8012.

 

  • This information provided by those who have tested positive for COVID-19 will then be used to contact those that could be affected, without revealing the source of the possible infection, unless consent has been received to share that information.  For people who have tested positive who choose to use the webform to submit contact tracing information, their confidentiality is protected as the webform does not seek consent to share the identity of the positive case.
  • The person who has tested positive for COVID-19 will be required to isolate for 14 days and will receive support in doing so.
  • NSS and the local Health Boards will have access to patient identifiable information on those who have tested positive for COVID-19. This information is held securely and safely and will only be accessed by those who require to see it to undertake contact tracing or to provide support to the person who has tested positive.
  • Public Health Scotland will use anonymised data to help them identify trends and hot spots. Such information will help health boards in the deployment of staff to assist those who are unwell.
  • Local Health Boards and Scottish Government will be provided with management information as to how contact tracing is progressing. This information will include the number of calls made, the number of people traced and areas where tracing has shown there to be a cluster of cases. 

Support for Self Isolation Periods

If you are contacted as a positive case or as a traced contact we will ask you for information as detailed below.  We will also ask you for your consent for your contact information (including any language or other accessibility support you need) and vaccination status to be passed to your Local Authority to provide you with self-isolation support and/or help to access funding during self-isolation.  We will not pass this information to your Local Authority without your consent.  The information that will be shared is:-

  • Name
  • Date of birth
  • Address, including postcode
  • Contact telephone number
  • CHI
  • Isolation start and end dates
  • Confirmation of consent for contact
  • your Covid vaccination status (including date of 2nd dose where applicable)
  • Language or accessibility requirements in relation to being able to contact the individual (where known)

Local Authorities will use this information to identify you on their systems and then provide you with support and/or help to access funding during periods of self-isolation. For more information, please visit your Local Authorities webpage.

What data is used and who is the data controller?

  • The data that will be collected for contact tracing is as follows:
      • Personal email
      • Phone numbers
      • Contact details including home address
      • Full name
      • Gender
      • Date of Birth
      • Ethnicity
      • Age
      • Diagnostic Information
      • GP/Medical Practice details
      • Additional medical history e.g. if you are shielding
      • CHI (Community Health Index) number
  • The person who has tested positive for COVID-19 will be asked to provide names and contact details for those they have been in contact with. 
  • In the online contact tracing webform, the person who has tested positive will be asked for their date of birth and the unique reference code they were sent to confirm their identity.  The information collected by the webform will include contact details for the person who has tested positive, information on venues and places they have visited and contact information on those they have met while infectious.  The person who has tested positive will be asked be asked for information relating to the dates of onset of symptoms or the date of their test so that the infectious period can be calculated.  This calculation is provided to the person who tested positive within the webform to help them identify those they have been in contact with and where they have been in the infectious period.
  • The primary recipients of this data will be the health board local to the infected person and the National Contact Tracing Centre run by NHS NSS.
  • NHS NSS, the Health Boards, Public Health Scotland and Scottish Government are data controllers for this information.
  • Data that is collected in this manner will be used to implement Scotland’s COVID tracing system. It will not be shared with other organisations unless they have a legitimate reason to ask for it. For example, it would not be shared with Police Scotland to implement fines unless Police Scotland had demonstrated their legal basis to have the data.
  • The National Contact Tracing Centre is a new service hosted within NHS NSS which will support the contact tracing function. As NHS NSS on-board new employees to deliver the tracing function, these new employees will undergo Information Governance, Information Security and Confidentiality training to ensure that they are equipped to look after your data properly.
  • NHS NES (NHS Education for Scotland) supported NHS NSS is collating information from those who were interested in working in the new Contact Centre. NHS NSS and NHS NES are both data controllers of this information and will use and retain it in line with good employment data principles and GDPR/Data Protection Act 2018 requirements.

A pilot initiative in Motherwell

There is a significant amount of research around trying to contact trace from the earliest opportunity to try and stop the spread of the virus. 

A new approach is being trialled in Motherwell from 20 November for a week, where those a the Motherwell test centre will be asked to complete a form with necessary basic information. 

The form is a web form, and a QR code will access it.

If you visit the site in that timeframe, you will be asked for your details (such as your name, address and telephone number) and to answer two simple contact tracing questions: 

1: In the last 14 days, have you been in close contact (less than 2metres) of someone confirmed or suspected to have COVID-19? 

2: Have you travelled outside of the UK in the last 14 days? 

This information will be held securely by NHS National Services Scotland and only accessed if matched to a positive test result.

If the contact tracing information is needed, it will be used to identify those who may need to be called quickly to help stop the disease spreading. 

The remaining information collected which does not match to a positive case will be deleted a week after it was collected without being viewed. 

Should you wish to know more about this pilot, please contact Public Health Scotland (link) or NHS National Services Scotland (Link).  Taking part is entirely voluntary. 

New Health Measures for Travellers to Scotland

In order to ensure that the terms of the Scottish Government’s Regulation concerning international travellers entering Scotland are followed, Scottish Government has tasked Public Health Scotland with ensuring that arrangements are in place for those international travellers from at-risk countries arriving into Scotland to be contacted during their period of self-isolation for the provision of public health advice and information. 

Public Health Scotland (PHS) will receive information from the Home Office on people arriving in Scotland who come under the terms of The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020.  All new arrivals subject to this legislation are expected, under Regulations 5(1) and 5(2), to provide accurate contact information to the Home Office. The data received by PHS from the Home Office will be held by PHS as a Controller for 42 days before destruction. The data will contain contact details only and will not include any health data.

Public Health Scotland is obliged to email all arrivals from at-risk countries to inform them of its supporting role, which it will do upon receipt of passenger contact details from the Home Office. The purpose of contacting passengers in self-isolation is not for PHS to enforce quarantine but to support those who have been asked to go into self-isolation.

Public Health Scotland (PHS) will then provide NHS National Services Scotland’s National Contact Tracing Centre (NCTC), which is run on behalf of Public Health Scotland, with passenger contact information to communicate with those who arrive in the country and are required to self-isolate.  NHS NSS will be processors of this information on behalf of PHS.  This information provided to the NCTC is a random sample of around 20% of new arrivals from at-risk countries each day.

The NCTC will attempt to telephone the passengers and, if unsuccessful, email them. Should the NHS NSS contact tracing staff not be able to contact those who have been selected to be contacted, their details will be passed on to Public Health Scotland, who will pass on their contact details to Police Scotland following The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020.

Upon receipt of the data, Police Scotland becomes a controller of the data. Police Scotland will check the accuracy of the contact information that the passengers provided to the Home Office on arrival in Scotland, and use its engagement processes to understand why the passenger could not be contacted. However, Police Scotland is obliged under Regulation 9 of The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020  to use its enforcement powers, if necessary. Police Scotland retains the data for 30 days but, where it exercises its enforcement powers, it is obliged to retain the data for up to 7 years.

The appropriate legal and data protection measures required for this sharing of information between Public Health Scotland and Police Scotland have been considered and put in place.

Use of a Proximity Tracing App

Please refer to the Protect.Scot website for further details on how the Protect Scotland app uses your data: Your Data | Protect Scotland.

The Check In Scotland App

To support NHS Scotland’s Test & Protect service, and for the health and safety of customers and staff, Check In Scotland must collect the name and contact details of visitors to venues around Scotland.

If you were at a venue at the same time as someone who’s tested positive for COVID-19, the data we collect will be used by NHS Scotland to:

  • contact you
  • give you advice about what to do next

This is an important step in stopping the spread of COVID-19.

Further privacy information about the Check In App is available here.

Your rights

There are no fundamental changes to your data protection rights.

We have explained more about your rights in the main page of this COVID-19 Privacy Statement.

Data retention

There are no fundamental changes to the data retentions principles.

We have explained more about data retention in the main page of this COVID-19 Privacy Statement.

Return to the COVID-19 Privacy Statement main page.