Privacy notice - Test and Trace Support Payments

Middlesbrough Council provides a Revenues and Benefits Service that offers financial support to residents where they or their children may be self-isolating and they are eligible for help from various national and local schemes including the Test and Trace Support Payment Scheme.

We use online and telephone applications to collect the information directly from you that we need to process your claim. This includes:

• Names of applicant and children (if self-isolating)
• Dates of birth
• Postal and Email Addresses
• Name of child’s education or care setting and year group
• Telephone and email contact details for the setting
• Whether the child has an Education, Health and Care Plan.
• Contact telephone number
• NHS Test and Trace Account ID
• Start and end dates of isolation period
• Proof of employment or evidence of self-employment
• Employer’s name, address, and contact number
• Nature of your job
• Ability to work from home during isolation
• Information about other benefits you receive
• National Insurance Number
• Income levels and bank account statement
• Bank account details for payment

We also store information about the reasons for rejection of any applications.

We receive information from the NHS Test and Trace about whether you have been told to self-isolate. We also receive information from the Department of Work and Pensions and Her Majesty’s Revenue and Customs about benefits or tax credits that you may be receiving.

When we capture and use personal data, we rely on ‘public task’ as our legal basis where we have a legal power that allows us to provide financial assistance under the Coronavirus Act 2020.

The personal data that we gather will be used to validate your children’s self-isolation status with their setting and check your eligibility for a Test and Trace Support Payment and the Discretionary Payment, process your application, make payments to you, and to provide you with advice about any other local support that may be available to you. We may also use your personal data for benefit accuracy checks, and when making a payment under the scheme, we will validate bank account details to ensure they align with the applicant, for anti-fraud purposes.

We share personal data with the NHS Test and Trace Service and the Department of Work and Pensions in order to process your application and to report on delivery of the Test and Trace Support Payment Scheme. We share your information with Her Majesty’s Revenue and Customs so that income tax requirements are met.

To validate your bank account details, we need to share relevant information you have given us with TransUnion. This will be used to ensure your Test and Trace Support Payment is paid to the correct bank account and to help prevent fraudulent use of the Test and Trace Support Payment scheme

Where we suspect that fraud has taken place or where any person is breaching the regulations about self-isolation, we may share their information with Cleveland Police or the relevant law enforcement agency.

We use the following measures to ensure that your personal data is secure: data protection and security policies, information security incident reporting, data and device encryption, system and data access controls, user accounts and passwords, physical and environmental security, staff vetting practices, staff training and awareness, data back-ups, ICT network penetration testing, and business continuity and disaster recovery plans. Any data that we send or receive to other organisations is encrypted and protected.

We keep personal data only for as long as is necessary. For more information about how long we keep data, please search for our Records Retention and Disposal Schedule on our website.

We do not send any data for the Test and Trace Support Payment Scheme overseas.

We will never use the data provided for the Scheme for marketing.

Your Information Rights are set out in law and, subject to some exceptions, you have the:

• Right to rectification - to ask for information to be corrected
• Right to erasure - to have your personal data deleted
• Right to object - to how your data is used
• Right to restriction - to request limits on how your data is used
• Right to portability - to request that we move your data to another organisation
• Right of subject access - to request a copy of data the Council holds about you

If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.

If you would like to discuss anything in this privacy notice or your information rights, please contact:

The Data Protection Officer
Middlesbrough Council
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Email: dataprotection@middlesbrough.gov.uk