5. How the Data will be Used
Information will principally be shared with NHS Scotland to carry out contact tracing as part of the Test and Protect service and for epidemiological purposes linked to infectious disease control, and will not be available to the Scottish Government. In certain circumstances, NHS Scotland may share the data with key delivery partners.
The contact tracing service would use the information provided by a business or organisation, relevant to a positive case's whereabouts during the infectious period, to inform the process of identifying close contacts where this is a risk of infection. There is no circumstance in which establishments should use the data to directly contact visitors, customers or staff, even in the event of a known outbreak within premises. Health protection teams will decide on a case-by-case basis on what follow-up action to take. Depending on the circumstances and the length of time that has elapsed, this could include arranging for people to be tested, asking them to take extra care with social distancing and/or - in some circumstances - asking them to self-isolate. In doing so, the intention is that the risk of onward spread of the virus will be greatly reduced, enabling as many people and businesses as possible to continue operating safely. However, the option to close the premises temporarily remains for the Health Protection Team to determine, depending on the risk assessment of the situation.
When information should be shared
If cases of COVID-19 are detected that have a link to specific premises, NHS Scotland may contact the establishment by phone to request staff and customers' details to allow contact tracing to take place. The NHS Test and Protect service has a number of mechanisms in place to reassure people contact tracers are legitimate, including call back options, visible numbers, and specific location and date information. Test and Protect delivery partners, such as local authority Environmental Health Officers, may also contact the establishment to request the data when undertaking their statutory duties, e.g. investigating a localised outbreak.
Establishments should share the information of staff/customers/visitors with NHS Scotland as soon as possible, if asked to do so.
Contact tracers will never:
- Ask you to dial a premium rate number to speak to them.
- Ask you to make any form of payment, including a charitable donation.
- Ask for any details about your medical history that are unrelated to COVID-19
- Ask for any details about your bank account.
- Ask for your social media identities or login details, or those of your contacts.
- Ask you for passwords or PINs, or ask you to set up any passwords or PINs on the phone.
- Ask you to purchase a product or attempt to sell you anything.
- Ask you to download any software to your device or ask you to hand over control of your PC, smartphone or tablet.
NHS Scotland will ask for contact detail data only where it is necessary, either because someone who has tested positive for COVID-19 has listed a premises as a place they visited during the infectious period of the illness, or because a premises has been identified as the location of a potential local outbreak of COVID-19. Establishments should not share this information with anyone else.