Privacy notice - Attendance and Visitors

Middlesbrough Council provides a wide variety of face-to-face public services from our buildings and other locations. We now need to provide these in a different way to meet the Government’s guidance on how to stop the spread of coronavirus (COVID-19).

We will collect data in person from you such as your name, contact details, the locations you attend, visit, or otherwise access, dates and times of visits, and who you interacted with. Sometimes we receive some of this information in advance from a third party such as the agency that referred you to us or other employers of visitors to our premises. We also collect data from our building access control systems and where necessary from our CCTV systems.

We use personal data to help us meet our legal obligations or where there is a clear public interest in public health matters such as serious threats to health.

Some of the laws that require or permit us to use data for these purposes include the Health and Safety at Work Act 1974, Crime and Disorder Act 1998, Data Protection Act 2018, and the Health Protection (Coronavirus, Collection of Contact Details etc. and Related Requirements) Regulations 2020.

We use your personal data to record who attends or visits our premises to allow us to investigate any incident with health and safety issues, to prevent or detect a crime or assist in the apprehension of offenders. At this present time, we also use the information gathered to help stop the spread of COVID-19.

We share attendance and visitor logging information with other organisations such as emergency services including police or fire brigade, certain organisations that assist us to prevent or detect fraud or other serious misconduct, and in the current COVID-19 situation, we might share information with the NHS Test and Trace Service. We only share information where it is necessary for the investigation of a health, safety or security incident, to prevent or detect a crime or assist in the apprehension of offenders, or where any other law requires or permits us to do so.

We are required law to provide NHS QR codes, at applicable council venues, to use with your NHS COVID-19 app. We may receive information from the NHS Test and Trace Service, but the council does not receive any information directly via the NHS COVID-19 app.

We transfer records of attendance and logs to secure electronic systems that are accessed only by those who are authorised. Our staff are required to complete mandatory data protection and security training. Our computer networks are regularly and robustly tested to make sure they are secure and data is encrypted both during transfer and when it is stored.

We only keep attendance and visitor logs as long as is necessary. Not all of the data we collect is held solely for potential tracking and tracing purposes. However, where we only need specific parts of this data for tracking and tracing, we only hold it for 21 days from your visit. For more information, please see the Records Retention Schedule on our website.

The data gathered for attendance and visitor logging is not transferred overseas.

We will never use the data gathered for attendance and visitor logging for direct marketing unless we have your consent or you are attending an event and have received similar services from us in the past but you would always be given an option to opt-out.

Your Information Rights are set out in law and, subject to some exceptions, you have the:

• Right to rectification - to ask for information to be corrected
• Right to erasure - to have your personal data deleted
• Right to object - to how your data is used
• Right to restriction - to request limits on how your data is used
• Right to portability - to request that we move your data to another organisation
• Right of subject access - to request a copy of data the Council holds about you

If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.

If you would like to discuss anything in this privacy notice or your information rights, please contact:

The Data Protection Officer
Middlesbrough Council
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Email: dataprotection@middlesbrough.gov.uk