Collecting Visitor Records
The NHS Test and Trace Service has been established to help identify, contain and control coronavirus.
Schools should assist the NHS Test and Trace Service by keeping a temporary record of visitors to the setting for a period of 21 days.
Background
Many schools will already have a system in place to log details of visitors to the school premises for health and safety purposes. However, as a result of the coronavirus pandemic, schools are now required to follow advice from Public Health England (PHE) to minimise the risks of coronavirus transmission by introducing control measures.
The DfE Guidance dated 28 August 2020 for the full opening of schools states in relation to visitors:
“Supply teachers, peripatetic teachers and other temporary staff can move between schools. They should ensure they minimise contact and maintain as much distance as possible from other staff. Specialists, therapists, clinicians and other support staff for pupils with SEND should provide interventions as usual. Schools should consider how to manage other visitors to the site, such as contractors, and ensure that the risks associated with managing contractors, visitors, catering staff and deliveries, as well as cleaning staff on site who may be working throughout the school and across different groups, are addressed. This will require close cooperation between both schools and the other relevant employers. Schools should have discussions with key contractors about the school’s control measures and ways of working as part of planning for the autumn term. Schools should ensure site guidance on physical distancing and hygiene is explained to visitors on or before arrival. Where visits can happen outside of school hours, they should. A record should be kept of all visitors”
What visitor information should be collected?
The UK Government’s guidance on the NHS Test and Trace Service states the following information should be collected where possible;
- The visitor’s name,
- Contact phone number,
- Date and time of visit,
- Departure time; and
- The name(s) of any staff member, pupil or other person within the school setting with whom the visitor has direct or proximity contact with during the duration of the visit.
Direct contact means:
i) Face to face contact with a confirmed positive case for any length of time, within 1m, including: being coughed on, a face to face conversation, unprotected physical contact (skin to skin) or shared travel in a small vehicle.
ii) Any exposure within 1 metre for 1 minute or longer
Proximity contact means: Extended close contact (between 1 and 2 metres) for more than 15 minutes, with a confirmed positive case.
It may be that you ask the visitor to enter the details on the way into school and also to review when leaving school to check whether all names of anyone they have had direct contact and/or proximity contact with have been recorded.
The guidance is not prescriptive about how this information is collected, it states that the information should be collected in a way that is manageable.
The guidance also states that information can be collected in advance or at the point that visitors enter the premises.
If possible, the information should be recorded digitally but a paper record is acceptable too.
It is not mandatory for visitors to supply the information. Although the UK Government does ask organisations to encourage visitors to share their details in order to support NHS Test and Trace and advise them that this information will only be used where necessary to help stop the spread of coronavirus.
It is important to recognise that if a visitor states that they do not want their details shared for the purposes of NHS Test and Trace, they can choose to opt out.
The accuracy of the information provided will be the responsibility of the individual who provides it. School does not have to verify an individual’s identity for NHS Test and Trace purposes.
School should hold records of visitors created solely for the purpose of NHS Test and Trace for 21 days. (To reflect the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing).
After 21 days, this information should be securely disposed of or deleted. However, it is recognised that records which are made and kept for other business purposes do not need to be disposed of after 21 days.
GDPR Implications
It is important to remember that the visitor information collected for this purpose will be “personal data” as identified in the General Data Protection Regulation (GDPR) and must be handled in accordance with the GDPR.
The GDPR allows schools to lawfully request contact information from visitors and share it with NHS Test and Trace to help minimise the transmission of COVID-19 and support public health and safety. Maintained schools can rely on the lawful basis of “public task”, non maintained schools will be able to rely on the lawful basis of “legitimate interest”. Overall, it will be recognised that collecting the data is likely to be in the interests of the individual, the school and the public health efforts to tackle coronavirus as long as individuals’ rights are protected and data protection principles are followed.
Therefore, it is not necessary to seek consent from each person, but schools should make clear why the information is being collected and who it will be shared with.
Schools do not have to inform every visitor individually. It would be sufficient for example, to display a notice at Reception or on the school website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace.
How to Share the Visitor Information
Schools should simply collect and store the information, they do not actively have to do anything with the information.
The NHS Test and Trace Service will contact school and ask for records only where it is necessary. (For example, if the school has been identified as the location of a potential COVID-19 outbreak).
The NHS Test and Trace service will then work with school, to ensure that information is shared in a safe and secure way.
Next Steps
- If your school already has a system in place to collect visitor details, it is worth checking whether all the details required by NHS Test and Trace are already included (for example, visitor phone numbers). If not, see whether you can adapt your existing system to include all the requisite details rather than setting up a parallel system just for NHS Test and Trace purposes.
- Ensure the visitor records who they have had direct and proximity contact with during the duration of the visit at the school.
- Ensure your staff are aware of the definition of direct and proximity contact.
- Consider whether you need to set up a system for staff recording any direct and proximity contact with visitors.
- Ensure any information collected solely for the NHS Test and Trace Service is securely disposed of after 21 days.
- Ensure you communicate clearly with visitors the reasons why you are collecting the information and what you are going to do with it.
- Check whether your school’s Privacy Notice needs to be updated to include this information.
