Informed consent and GDPR for LFTs

[lftc]

Has anyone's DC's school provided proper informed consent forms for the LFTs and explained what happens to the test results - how they are processed, how the results are stored and the legal basis for processing this data under the data protection law/GDPR?

A medical test can only take place after informed consent has been given (with information in writing), after you have had the chance to ask questions and these questions have been satisfactorily answered.

Medical test results will be subject to data protection law. Schools must explain the legal basis for processing the data. They must state who has access to this data and who processes it, the fact that unauthorised people cannot access this data.

The legal/ethical/professional medical issues surrounding these LFTs have not been handled correctly.

At our school the process is similar to private company lft ing. Child will get a couple of barcodes one of which is then stuck on to the sample. The other is then either taken home and the number uploaded to the testing website or older kids can upload the details straight away. Someone at the school will note the result. Someone at the school will take the samples and attached barcodes and upload the rests into the testing website. Best practice at the site will be that the person accepting the sample from the child will be different to the person noting the test result and different to the person uploading the details on to the test of results site.

GDPR secure unless there's a tiny amount being tested.

I think our school are testing in year groups/tutor groups. So that if a positive does come up (false or not) it's only a group of 30 affected.

Consent has been sought from parents/carers at our school.

Not sure for schools but as a grown up you can waive your right to anonymity and your results sent to your employer as well as yourself.

School won't automatically know the test results for individuals. In theory a positive could be recorded but if the individual hasn't uploaded the barcode, or chosen to ignore the instruction to isolate then the school will only know that there is a positive recorded and not who it is.

@Forestdweller11

That is very interesting, thanks,

At DC school I know they have to wait on site until the result is known, so I assume the process there is different and the school does find out the result straight away?

Idk, that is why the government should have planned and prepared properly so all schools follow same procedure with same information sheets for parents and pupils etc. But I guess that is this government's failing throughout the pandemic.

Problem is different schools have different spaces, capacity, travel arrangements, student numbers, availability of testing booths, availability of test staff. It's not a one size fits all process. Plus the government updates information and doesn't delete the old stuff so it's easy to read/download out of date guidance.

I honestly couldn't care less. DD has consented herself. It is a Covid test, the results are held by the NHS. End of.

Results are known by the school within 30 minutes. But they don't have names attached, just a barcode . So they can't identify individuals. The school upload the test results and the individual logs in to testing site and indicates they had a test with barcode number X. Individual then gets notified of the result. So potentially there might be a lag between test result being known and individual logging on potentially the whole school day. Which means that there could be someone positive wandering about. Our school are doing it in years/tutor groups so although they won't know who has test positive they will know that it is one of the 150 kids they tested that day, and even drill down further by tutor group as they are being tested by group, rather than when they turn up for school. So they will be able to say it's one of you 30. Not quite sure what's going to happen then!

In some businesses the individuals being tested have to do the test, log in and then wait either in their car or in a waiting room until they have the confirmation that they are negative or positive and they they can start work/ go home, so they aren't mingling. That if course depends on size if workforce, testing capacity, queuing, shift patterns etc. .

Here you go:

Ownership of the Personal Data
To enable the Covid-19 testing to be completed at [school], we need to process personal data, including the sharing of personal data where this is allowed under data protection legislation. [School] is the Data Controller for the data required for the management of tests and implementing local arrangements in the event of a positive test.
We will process personal data relating to staff under article 6.1(f) of the UK GDPR – it is necessary in the legitimate interest of the data controller. We will process special category personal data under the provisions of article 9.2(i) of the UK GDPR, and Part 1 of Schedule 1(3) of DPA 2018 where it is in the public interest on Public Health Grounds to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services as safely and securely as possible. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by a health care professional OR someone who owes an equivalent duty of confidentiality to that data.

Ownership of the Personal Data you share with DHSC
Every time you use a lateral flow test you must report the results. More details can be found here - Report a COVID-19 test result - GOV.UK (www.gov.uk). The Department for Health and Social Care (DHSC) is the data controller for the information that you transfer to them about you and your test results. For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice
[School] remains the Data Controller for the data we retain about you for the management of tests and implementing local arrangements in the event of a positive test.
You should read both this Privacy Notice and the DHSC COVID-19 Privacy Notice to understand how your personal data is used prior to taking a test.

Personal Data involved
The following personal data is processed by [school] in relation to your test:
Name
Unique code assigned to each individual test and which will become the primary reference number for the tests.
Test result
For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

How we store your personal information
[School] will maintain a test kit log which will record against your name details of the testing kit which has been provided to you. [School] may also record Personal Data about you in its internal COVID-19 test register (the school/college’s COVID-19 test register will not be shared with DHSC). This information will only be stored securely on locally managed systems with appropriate access controls in [school] and will only be accessible to personnel involved in the management of tests and implementing local arrangements in the event of a positive test.
[School] will retain its test kit log and COVID-19 test register for a period of twelve (12) months from the date of the last entries made by the [school] into them.
For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

Processing of Personal Data Relating to Positive test results
We will use this information to enact our own COVID isolation and control processes without telling anyone who it is that has received the positive test.
For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice
This information will be kept by [school] for a period of twelve (12) months and by the NHS for eight (8) years.

Processing of Personal Data Relating to Negative and Void test results
We will record a negative and void result for the purpose of stock controls of tests and general performance of the testing process.

Data Sharing Partners
The personal data associated with test results will be shared with
DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistical information about Coronavirus.
Your GP – the NHS may share the information you provide with your GP to maintain your medical records and to offer support and guidance as necessary. Any data you provide to [school] will not be shared with your GP.
Local Government to undertake local public health duties and to record and analyse local spreads.
Personal Data in the [school] test kit log will be shared with DHSC to identify which test kit has been given to which individual in the event of a product recall. [School] will not share its internal COVID-19 results register with DHSC.

Your Rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at [email address] if you wish to make a request.

How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at [email address].
You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Online version is here www.gov.uk/government/publications/coronavirus-covid-19-testing-privacy-information