COVID-19 Privacy Notice supplement

Public Health Scotland is supporting the Scottish Government, NHS National Services Scotland (NSS) and NHSScotland Health Boards in the response to COVID-19. To find out how data is being used during the COVID-19 response, please read the following:

Information for the public on COVID-19 can be found on NHS Inform. NHS Inform includes a link to enable people to obtain a self-isolation note for employment and statutory sick pay purposes.

In collaborating with our partners to deliver an effective COVID-19 response, we recognise that the duty to share information can be as important as the duty to protect confidentiality. Therefore, data controllers within NHSScotland have agreed on an intra-NHS Scotland Information Sharing Accord.

Our processing of personal data in relation to COVID-19 is lawful because:

Your data protection and rights in relation to COVID-19 personal data held by Public Health Scotland remain unaffected and may be exercised through the process detailed in our Privacy Notice at However, due to the efforts by our staff in responding to the COVID-19 effort, we kindly ask for your understanding if our response times are slower than normal.

Our COVID-19 activities

Together with NHS National Services Scotland (NSS), we are controllers of the list of shielded individuals in Scotland. We work with NHS Boards to identify shielded individuals in accordance with the specification of clinically at-risk groups as defined by the Chief Medical Officer and then supply the necessary information to NSS who are responsible for sending letters to identified individuals requiring shielding, as well as supply NHS Education for Scotland with necessary contact information as they are responsible for providing the opt-in text messaging service to support shielded individuals. We also share data outputs with health and social care partnerships who provide additional support for shielded individuals in their local communities. We produce statistics on shielding activity. The data we collect are: name, address, GP name and practice, Health Board, your shielding category where applicable, Community Health Index (CHI) number.

We support the Scottish Government’s Test and Protect programme which is Scotland’s approach is Scotland’s approach to implementing the test, trace, isolate, support strategy. We do this by using testing data to produce statistics and inform the COVID-19 response and research in areas such as enhanced surveillance, wider impact on health and care as a result of the lockdown, and testing and treatment activities. We produce and publish a wide range of COVID-19 related guidance documents and resources. NSS has set up, and runs, the NSS National Contact Tracing Centre on our behalf and, together with local Health Boards, we support the contact tracing response.   

To support the test and protect programme, we access the following personal data: name, address, CHI number, date of birth, where and when you were tested, your result, mobile number or email address.  Where it was a drive through test, we also hold the time and date of the test, and details of the laboratory that processed the test. Where you are a passenger who has just arrived from a country that does not qualify for exemption from passenger self-isolation in accordance with The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020 (and subsequent amendments) and therefore, as a newly arrived passenger, you are required under law to disclose accurate contact information on arrival which is collected by the Home Office, the Home Office shares an extract from their passenger locator database for us to follow up for guidance and support through the National Contact Tracing Centre. This additional data contains: traveller name, traveller date of birth, date of UK entry, date of UK exit, port of departure, port of arrival, staying or transiting through UK, permanent address, specified isolation address, and contact phone number and email address. All passenger arrivals and contact details data we obtain from the Home Office are destroyed within 42 days of the date of arrival of the passenger into Scotland, as specified by the Home Office.

When processing passenger personal data obtained from the Home Office, the National Contact Tracing Centre (NCTC) attempts to make contact with the passengers in quarantine who have been selected to be contacted by phone and/or email. Should the contact tracing staff at the NCTC not be able to contact those who have been selected to be contacted, their contact details will be passed on to Public Health Scotland, who will pass on their contact details to Police Scotland in accordance with The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020.

Upon receipt of the data, Police Scotland becomes a controller of the data. Police Scotland will check the accuracy of the contact information that the passengers provided to the Home Office on arrival in Scotland, and use its engagement processes to understand why the passenger could not be contacted. However, Police Scotland is obliged under Regulation 9 of The Health Protection (Coronavirus) (International Travel) (Scotland) Regulations 2020  to use its enforcement powers, if necessary. Police Scotland retains the data for 30 days but, where it exercises its enforcement powers, it is obliged to retain the data for up to 7 years.

In our general COVID-19 response effort, we support researchers who have sought permission from the Public Benefit & Privacy Panel for health and social care (PBPP) to proceed with their studies following a proportionate governance scrutiny process which involves patient representatives (e.g. EAVE II study which includes understanding important risk factors for COVID-19 and how well prescribed treatments, such as existing therapies, vaccines and antimicrobials work). We also use the data to support our various enhanced surveillance programmes and statistical releases within Public Health Scotland (e.g. seroprevalence, mortality, intensive care unit activity, impact of COVID-19 on ethnic groups, hospital onset COVID-19 cases, excess deaths, outcomes for renal patients). Public Health Scotland upholds the highest standards of confidentiality and all published outputs are subject to statistical disclosure assessment.

We will update this information periodically as our response to COVID-19 progresses.

Last updated: 06 October 2022