Historical data collection for contact tracing (FOI)

Request

This FOI relates to Contact tracing measures FOI (gov.je)

Please confirm the data retention policies regarding current and historical data collection for the Covid-19 contact tracing program. Specifically, I want to know

A

Where is/was data relating to contact tracing stored (country, hosting providers)?

B

Who is/was the data protection officer specifically assigned to the Contact Tracing initiative?

C

From the date of a contact being identified (for any purpose), how long is / was the individual's personal data retained?

D

Who (companies) was the data shared with and for what purposes?

E

What procedures (automated or manual) are in place for data destruction?

F

How many data destruction activities have taken place (when and by whom) and are these audited / verified?

G

For any individual where data is/was retained, what is the procedure for data deletion under their rights provided by the Data Protection (Jersey) Law?

H

If any personal data is retained, what is the legal justification for retention considering Contact tracing measures FOI (gov.je) clearly states there is no contact tracing occurring?

I

In Contact tracing measures FOI (gov.je) your response states "The Government of Jersey previously recorded the telephone number of someone who received an exposure notification, but only if that person voluntarily chose to send this to us. However, we no longer have this functionality and therefore this information is no longer collected." - please outline what has happened with historical data - has it been destroyed or has it been retained. If it has been retained, what is the justification for retention.

Response

A

Contact tracing data is held as part of the Government of Jersey’s Microsoft Azure environment location 4 EUR (with data centres in Amsterdam and London). 

Datacenter regions 

B

The Government of Jersey has contracted for Data Protection Officer as a service with two suppliers whilst contact tracing was taking place:

• Prior to 5 June 2020 Prosperity 24/7
• 5 June 2020 to-date Calligo
  

No individual Data Protection Officer was assigned specifically to contact tracing. Collection of personal data in relation to contact tracing was managed by several different departments within the Government of Jersey, each of which had a Data Governance Officer responsible for their department’s handling of the data. 

C

Personal data is retained for as long as it is required for the purposes for which it was originally processed, in this instance for the purposes of protecting public health as part of the response to the Covid-19 pandemic. The retention of personal data held for these purposes will be reviewed regularly as the response changes. 

D

Personal data was not shared by the contact tracing team with any companies.

Between 28 March 2020 and 7 February 2022 personal data of arriving passengers was shared with the contract tracing team by travel operators, including airlines and ferry companies, for the purpose of tracing passengers who may not have completed a predeparture form after having travelled to the Island; and / or who may have been exposed to Covid-19 following a positive diagnosis affecting one or more passengers on the same flight / ferry. 

Prosperity 24/7 have access to the case management system where contact tracing data is held for the purposes of IT support and system development.  

E

Any systems data is deleted manually rather than automated. For mass deletions of a given dataset the third-party provider Prosperity 24/7 can delete, or archive, based on a specific period or data set. 

F

None to-date for contact tracing. 

G

People can access their rights under the Data Protection (Jersey) Law 2018 via the Data Protection 2018 page on www.gov.je in the following section: 

Your personal data rights (how to delete, correct, restrict and move). 

There are a number of exceptions to the right of erasure and some of these may apply in relation to contact tracing data, such as that the processing is necessary for reasons of public interest in the area of public health (Art 32(3)(c) of the Data Protection (Jersey) Law.

H

Personal data is retained for as long as it is required for the purposes for which it was originally processed, in this instance for the purposes of protecting public health as part of the response to the Covid-19 pandemic. The retention of personal data held for these purposes will be reviewed regularly as the response changes. 

The legal basis is that the processing is necessary for reasons of public interest in the area of public health on the grounds of the Loi (1934) sur la santé publique, and the Covid-19 (Screening, Assessment and Isolation) (Jersey) Regulations 2020. 

J

Covid App Alert data is stored in the form of call back requests which are held (both anonymised and / or provided with contact details) within the contact tracing systems main database.

Personal data is retained for as long as it is required for the purposes for which it was originally processed, in this instance for the purposes of protecting public health as part of the response to the Covid-19 pandemic. The retention of personal data held for these purposes will be reviewed regularly as the response changes. 

The legal basis is that the processing is necessary for reasons of public interest in the area of public health on the grounds of the Loi (1934) sur la santé publique, and the Covid-19 (Screening, Assessment and Isolation) (Jersey) Regulations 2020.