Privacy Notice Covid-19 testing

This Privacy Notice only covers COVID-19 testing carried out on a MidKent College Campus. MidKent College has additional Privacy Notices that cover all other aspects of COVID-19 data processing. These privacy notices can be found on the College website. 


This section tells you the key facts you need to know before you give consent and take your first asymptomatic test.    

  • Asymptomatic means someone who has no symptoms of a disease, in this case coronavirus. Evidence has shown that people infected with COVID-19 can have no symptoms and still transmit the virus to others without being aware. 
  • You can only have an asymptomatic test at the College if you give consent. To give consent you need to complete our online form. Our consent form is located on MyDay.  
  • The results from asymptomatic testing will be either positive, negative or void. Void means the test did not work and you will be asked to take a new test.  
  • The results of your asymptomatic test will be shared with the College, Department of Health and Social Care (DHSC), NHS, Public Health England (PHE), your GP and Local Government. 


This section tells you the reasons why we are collecting data. It also tells you who we are collecting data about.   

The purpose for which we will be processing your personal data is to enable COVID-19 testing to be carried out onsite. MidKent College needs to process personal data for staff, contractors and students (including partnership students). As part of this processing, MidKent College will share personal data with third parties under the College’s under our statutory duties.  

The College will offer three types of testing:  

  • Mass testing - Test as many staff, contractors and students on their return to College as possible. 
  • Weekly testing – Staff, contractors and students will be offered tests on a weekly basis. 
  • Daily contact testing* - Carry out daily contact testing of staff, contractors and students who are close contacts of a positive case. 

* Daily contact testing will only be offered as per the latest guidance.  

Prior to any of the above tests being carried out, you (or a parent/career/guardian) must have provided consent via our consent form. Our consent form can be completed electronically via MyDay or on paper. Paper copies are available from Reception. You can give and withdraw consent at time using our consent form. This means that if you give us consent and change your mind you can adjust your consent at any time.   

This privacy notice does not apply to visitors or parents/carers/guardians attending MidKent College.  


This section tells you what data will be collected and what happens with it. Different actions will be taken depending on the result of the COVID-19 tests.   


The College will process the following personal data to enable COVID-19 testing: 

  • Name 
  • ID Number 
  • A record of whether consent has/has not been given for testing  
  • Date of birth (and year group) 
  • Gender 
  • Home postcode 
  • Email address 
  • Mobile number 
  • Unique barcode assigned to each individual test and which will become the primary reference number for the tests 
  • Date and time of test 
  • Campus test was carried out on 
  • Parent/guardians contact details (if required) 

The College will process the following special categories of data: 

  • Ethnicity (Ethnicity) 
  • Test result (Medical/Health) 

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information. 


The following actions will be taken for tests that return a positive result:  

  • The member of staff, student or parent (depending on contact details provided on your consent form) will be informed of the result by the NHS Test and Track.  
  • The College will also contact the member of staff, student or parent (depending on contact details provided on your consent form) to advise how to book a confirmatory test.  
  • The College also uses this information to enact our COVID-19 isolation processes. This means that will ask you to self-isolate until you get the result of the confirmatory test. This data will be shared with staff in the College to ensure that we continue accurately record your attendance, offer you support and provide you with access to lessons.  
  • The College will transfer this information to DHSC. DHSC will share this with the NHS, GPs, PHE and the Local Government for wider test and trace activities as well as statistical and research purposes. 


The following actions will be taken for tests that return a negative result:  

  • The member of staff, student or parent (depending on contact details provided on your consent form) will be informed of the result by the NHS Test and Track.  
  • The College will record a negative result internally.   
  • The College will transfer this information to DHSC. DHSC will share this with the NHS, GPs, PHE and the Local Government for wider test and trace activities as well as statistical and research purposes. 


The following actions will be taken for tests that return a void result:  

  • The member of staff, student will be informed of the result by the College and asked to re-take the test.   
  • The College will record the void result internally.   


The following actions will be taken for those who decline a test or do not give consent:  

  • Where a member of staff, student or parent (depending on contact details provided on your consent form) does not give consent the College will keep a record of your decision and use this to reduce unnecessary contact with you regarding testing. 
  • If you have previously given consent and then refuse a test, we will ask you to update your consent form to withdraw consent.    


This section tells you how long your personal data will be kept for. The length of time your data is kept for will depend on the outcome of your COVID-19 test.  

MidKent College will retain personally identifiable results from negative and void tests for 14 days from the day was taken. This data is not stored in College backups.  

The College will store positive test results in accordance with our other COVID-19 Privacy Notices.  

The College will store anonymised results from all tests results for 2 years from month the test was taken. This is to enable statistical analysis to be produced to aid the accuracy of results and to compare cases in the College to trends in the local community.  

The DHSC will retain data in accordance with their Privacy Notice. The NHS will retain your test result data for 8 years. 


This section tells you the reason we are using to make the processing of your personal data valid. This is known as a lawful basis.     

The College’s legal basis for the processing personal data relating to the COVID-19 testing under the General Data Protection Act 2016/679 (EU) (GDPR) is: Article 6 (1)(e) processing is necessary for the performance of a task carried out in the public interest.  

For the purposes of the above, the College’s public tasks are the following the statutory functions:  

  • for providing an education as per Part 1, Chapter 2, Section 18 of the Further and Higher Education Act 1992; and 
  • safeguarding powers in Section 175 of the Education Act 2002  

The College’s legal basis for the processing of special category personal data relating to the COVID-19 testing under the General Data Protection Act 2016/679 (EU) (GDPR) is: Article 9 (2)(i) processing is necessary for reasons of public interest in the area of public health.  

For the purposes of the above, the College’s public health interest is the following:   

  • the sharing of data for COVID related purposes and where it is carried out by a health care professional or someone who owes an equivalent duty of confidentiality to that data as per Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI).  

In the event of a life and death emergency, the legal basis for processing your personal data, including special categories are: 

  • General Data Protection Act 2016/679 (EU) (GDPR) Article 6 (1)(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person. 
  • General Data Protection Act 2016/679 (EU) (GDPR) Article 9 (2)(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. 


This section tells you who your personal data will be shared with and the reasons why.  

Staff responsible for managing and processing COVID-19 testing will have access to your personal data. Staff will only have access to the data necessary for the purposes of their role.  

The College will share your test result and related personal data with the DHSC. The DHSC will share this information with:  

  • NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistic about Coronavirus. 
  • Your GP – to maintain your medical records and to offer support and guidance as necessary 
  • Local Government to undertake local public health duties and to record and analyse local spreads. 

Only when necessary, and in a proportionate and secure manner, will the College share your personal data with other public bodies, emergency services, and other stakeholders. We will only share your personal information where the law allows, and we always aim to share the minimum data necessary to achieve the purpose required. Your personal information will only be used for the purposes listed and retained for limited specific times. Please be assured that protection of personal data remains a priority at this time after the health and safety of everyone. 

Data sharing based on positive test results will be done in accordance with our other COVID-19 Privacy Notices.  


This section tells you what rights you have over your personal data.   

You have several rights with respect to your personal data and these remain all intact, in accordance with the conditions set out in law) during the current coronavirus pandemic. You have the right: 

  • to request information about how your personal data are processed 
  • to request a copy of personal data held about you 
  • to request that any inaccuracies in your personal data are rectified without delay 
  • to request that your personal data are erased if there is no longer a justification for them to be processed 
  • in certain circumstances (for example, where accuracy is contested), to request that the processing of your personal data is restricted 
  • to obtain and reuse your personal data for your own purposes across different services. 
  • to object to the processing of your personal data 

Any requests regarding your rights should be submitted to the Data Protection Officer (contact details provided below).  


This section tells you where your personal data will be saved and in which countries.  

Personal data processed by MidKent College under this Privacy Notice is stored in the following locations; on College Campuses, on the College’s IT infrastructure, and on Microsoft’s servers. The College will store all data within the European Union. 

Your personal data will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes. The Colleges does not have access to the information on the digital service once it has been entered. 


This section tells what you can do if you are unhappy about how your personal data has been processed.   

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: 

  • Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or 0303 123 1113, or 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 


This section tells you who is responsible for managing your personal data covered by this privacy notice and their contact details. 

MidKent College is the Data Controller for personal data processed in relation to COVID-19 testing, and for undertaking any resulting actions which are needed to ensure that the College fulfils its obligations in respect of public health and safeguarding.  

Personal data processed in relation to COVID-19 testing is also passed to the Department for Health and Social Care (DHSC). For more information about what they do with your data please see the Test and Trace Privacy Notice. The establishment remains the Data Controller for the data we retain about you. 

If you have any questions about this notice or the ways in which MidKent College use your personal information, please contact the College’s Data Protection Officer on:   

Post: Data Protection Officer, MidKent College, Medway Campus, Medway Road, Gillingham, Kent, ME7 1FN 

Click to send an email

Telephone: 01634 383525 

Version 1 

Last Updated 21/01/2021