A policy of maximum transparency should be adopted and the provisions of data protection legislation be understood and used in such a way as to enable the sharing of necessary information with parents and staff.
What does Government guidance say?
Government guidance is not explicit. NHS guidance, however, says: “You may want to tell people you've been in close contact with in the past 48 hours that you might have COVID-19.”
The NHS is not encouraging individuals to disclose symptoms to others such as schools so that they may keep that information secret. Although schools and colleges no longer have responsibility for contact tracing (this has been taken over by NHS Test and Trace), there are still circumstances where a school would need to have information about particular cases, either to assist NHS Test and Trace or to manage groupings within schools, increase mitigations appropriately or increase levels of ventilation/cleaning in affected areas. The DfE says ‘settings will continue to have a role in working with health protection teams in the case of a local outbreak.’
The NHS defines close contact as follows:
- close face to face contact (under 1 metre) for any length of time – including talking to them or coughing on them
- being within 1 to 2 metres of each other for more than 15 minutes – including travelling in a small vehicle
- spending lots of time in your home, such as cleaning it
What does data protection legislation require?
It is not the case, as some reps have been told, that data protection legislation prevents schools from disclosing the name, class and/or year group of a pupil or staff member with Covid-19 or symptoms of the virus.
Although there is an automatic prohibition against the sharing of health data under the GDPR, the legislation also provides for circumstances in which that prohibition may be overridden. One of these is where a school directly or indirectly identifies an individual under the direction of a health authority, such as the local health protection team (if supervised by a medical professional), or the NHS Test and Trace team. Health data may also be shared if the data subject, or in the case of pupils under 13 years of age, the data subject’s legal guardian, has explicitly consented to such sharing. Explicit consent should not be relied on as the basis for sharing information, however, particularly about staff, because the imbalance of power between the data controller and the data subject (for example, employer and employee) will always give rise to the issue of whether consent has been freely given.
Furthermore, data controllers, i.e., head teachers on behalf of school governing bodies, are obliged to weigh the privacy rights of the person whose data is to be disclosed against the interests of the school community in knowing of the potential risk to their health and the health of those with whom they may have been in close contact.
What information should schools/colleges therefore disclose?
Head teachers/principals must do what data protection legislation requires before deciding whether or not to inform the school/college community, or pockets of it, of an infected or potentially infected individual’s identity, whether directly by naming them, or indirectly by mentioning their class or year group. As noted above, the NEU recommends that in order to ensure maximum adherence to safety precautions, maintain confidence and encourage calmness, a policy of maximum transparency should be adopted wherever possible. The NEU recommends the following steps:
1: Decide on the lawful basis for disclosing the information
If you do not intend to rely on explicit consent as your lawful basis for disclosure – and we would encourage you not to – you should ask the local health protection team or the NHS Test and Trace team for their advice about how much information you should disclose in the circumstances. Make sure that any advice you receive is confirmed in writing.
School leaders are also encouraged to seek advice from their legal representatives if they are unsure of the lawful basis for disclosing information.
2: Disclose only what is necessary
Just because data may be lawfully disclosed does not always mean that it should be. Can you provide the school community with sufficient notification of risks to staff and students without directly or indirectly identifying the individual concerned? Only disclose the minimum amount of information required to address the issue at hand. Furthermore, only identify the person exhibiting symptoms or tested positive if the school community, or cohorts within it, need to know that information. Furthermore, do not undertake to keep the person’s identity confidential unless the health authorities confirm that it is fine to do so in the circumstances.
3: Consider the data subject’s rights and freedoms
Consider what might happen to the individual, both mentally and physically, if you were to disclose their identity. Would disclosing the person’s year and/or class reveal their identity? Is disclosure likely to deter others from notifying the school/college of symptoms? Is there a history of mental illness which might be exacerbated by disclosure? Is there a risk of harassment, bullying and/or ostracisation and, if so, could the risk be mitigated? If the answer is yes to any of these questions, set out the steps you intend to take to mitigate the risk, for example, frequent talks with students and staff about treating each other with compassion and respect, or limiting disclosure to staff pending the outcome of a Covid-19 test by the individual concerned. You should also consider whether it is possible for people who have been in close contact with the individual(s) concerned to realise that they may have been infected without knowing their year, class or name, for example, in the event of a whole school shutdown.
4: Consider the interests of those who have been in close contact with the individual concerned
Consider what might happen to them, both mentally and physically, if you do not disclose the identity of the individual concerned. Is the lack of disclosure likely to fuel insecurity, mistrust, fear and a lack of trust in the school/college? Conversely, will notifying parents and students create a climate of fear? Do any of those concerned have a history of mental illness which might be exacerbated if you do not engage in open and transparent dialogue? Taking into account the individual health and safety risk assessments of staff, are they or members of their household likely to be seriously injured (for example, because they are higher risk) if you do not disclose the identity of the individual concerned and they are unable to discern (from the information that you do disclose) that they should be taking additional protective measures?
5: Have a discussion with the data subject and/or their legal guardian
Although consent is not a prerequisite to disclosure (unless it’s the lawful basis for processing you intend to rely on), it is considered good practice to inform data subjects of your intention to disclose their personal data and your reasons for doing so, and to take any objections they may have into account when weighing their interests against those of others. Keep a record of any objections made, but don’t automatically give an individual’s objections greater weight than may be warranted in the circumstances.
6: Make a decision
Remember that this is a difficult time for everyone, particularly for staff who are very stressed and anxious for their safety and the safety of their loved ones. There are no hard and fast rules about the right thing to do, particularly in the absence of national guidance. As long as you can demonstrate that the decision you’ve made is a considered one, the Information Commissioner’s Office is likely to take a sympathetic view in the event of a complaint against you and/or the school/college.
For further guidance on how to make a sound decision, read the ICO’s ‘Data Sharing Code of Practice’.