I think I might be getting there:
“What personal data we collect
...
Each test option will require slightly different details. The details we may need from you’re:
first and last name
date of birth
gender
ethnicity
email address
address including postcode
vehicle registration number, if booking a test at a regional test site
National Insurance number, if you’re a key worker
NHS number (for English residents and if you know it. Wales, Scotland and Northern Ireland residents may need to provide a different local identifier, which will be specified upon registering for a test)
employer details, if you’re employed or work for the NHS or in social care”
“What purposes your data will be used for
DHSC is the data controller for the following purposes:
confirming the appointment to the regional test site
performing a security and ID verification at the regional test site
receiving and processing your test
returning your results to you
contacting you (if you test positive) as part of the government contact tracing programme
linking your test result to your GP record (if you are resident in England)
sharing your results with Welsh, Scottish and Northern Irish health bodies (if you live in that country) to inform local planning and responses to COVID-19
sharing results with Public Health England (if you live in England) to help plan and respond to COVID-19
for residents in England, sharing your results with NHS Digital to analyse data in relation to COVID-19
undertaking quality assurance of the testing process (for example, clinical process assurance)
analysis to support operational decisions to improve the full end-to-end testing process such as:
day-to-day use (for example, whether someone attended their appointment)
to inform regional test sites of improvements to the testing process (for example, to manage capacity or throughput)
support end-to-end logistics planning”
“For English residents, we will link your test result to your GP record, so you do not need to inform your GP of your result.”
www.gov.uk/government/publications/coronavirus-covid-19-testing-privacy-information/testing-for-coronavirus-privacy-information-quick-read
So they apparently are linking test results to GP records- I’m shocked! And still don’t see how this can be done for those (the probably large proportion of the population) who don’t know or enter their NHS number.
Although it still leaves the question about which postcode they use when “allocating” positives to an area. It can’t be GP postcode for all results as otherwise there would be no cases in areas without a GP (as is the case in my village). So I would still think that student from Richmond and registered only at Richmond GP who enters Leeds Uni accommodation postcode when booking a test would have their test positive linked to Leeds and not Richmond. If they enter this NHS number (unlikely!) it might link to their Richmond GP who is then informing the council of the data on their patients. Wouldn’t GP sharing medical records with the council be a massive breach of GDPR though. Or Test and Trace is using the GP address dataset to inform the councils. Scarily, that does seem possible... Although you’d think that someone would have noticed the case numbers were significantly less than on the dashboard!