Events Research Programme Privacy Notice
WHO IS COLLECTING MY PERSONAL DATA?
The Department for Digital, Culture, Media & Sport (DCMS) is facilitating the collection of your personal data as part of the UK Government’s Events Research Programme (“ERP”). We are a controller of this personal data for the purposes of data protection laws.
When you participate in the ERP, there are a number of other organisations who will be controllers of your personal data. Set out below is a summary of the organisations involved in the ERP and their roles in collecting your personal data. Where an organisation processes your personal data as a controller, they will provide you with a separate privacy notice setting out how they use your data.
| Event organiser(s) or ticketing agent(s) | When you purchase tickets for the event, the event organiser or the ticketing agent will be a controller of your personal data |
| Department for Health and Social Care (DHSC) | If you request a PCR test or subsequently test positive for Covid-19, your data will be a part of NHS Test and Trace. The DHSC is the controller responsible for NHS Test and Trace. |
| Public Health England (PHE) | PHE is an executive branch of DHSC. PHE will have access to the data available through NHS Test and Trace. |
Anonymous data will be used by other university research programmes (please see the Information Sheet for the Events Research Programme for more information).
In relation to group bookings, please ensure that all individuals in your booking party have been made aware of the contents of this privacy notice.
WHY ARE WE COLLECTING YOUR DATA?
We are organising the collection of your personal data in order to assess and monitor the risks associated with COVID-19 transmission for participants attending mass events, and to understand the extent to which mitigation measures can effectively address these risks.
The event organiser or ticket agent will initially collect your personal data to allow them to permit you entry to the event. We organise the sharing of this personal data by the event organiser or ticket agent directly to the DHSC and PHE in our capacity as the facilitator of the ERP.
DHSC will collect your personal data via NHS Test and Trace when you complete COVID-19 Tests and when you use the NHS App or the NHS Covid-19 app. When you take a lateral flow test or test positive for COVID-19, the data will remain with DHSC (as the controller for NHS Test and Trace). This personal data includes health data. DHSC will use the personal data shared by the event organiser or ticket agent to cross-reference personal data in NHS Test and Trace to identify any transmission links between attending an ERP event and contracting Covid-19. You can find out more about the personal data collected by NHS Test and Trace and how it is used by viewing their privacy notice at: Test and Trace: overarching privacy notice - GOV.UK (www.gov.uk)
PHE will analyse the records of attendees who subsequently request a test from Test and Trace, and identify those attendees who tested positive for COVID-19 following an ERP event. In relation to these attendees, PHE will share an anonymised version of this data with the London School of Hygiene & Tropical Medicine for the purposes of the self-controlled case series study (please see information sheet for more detail on this study).
We may also use your data to send you surveys following your attendance at an event to ask about your experiences of using the NHSx app. The data generated from the survey will be anonymous and will be used to help inform our understanding of the use of the NHSx app.
DCMS may collect your personal data if you contact us directly (for example, if you have any concerns or queries regarding the study, or if you wish to withdraw your participation at any time). DCMS will only use your personal data to respond to your query or to action your request.
WHAT IS THE LAWFUL BASIS FOR PROCESSING MY PERSONAL DATA?
As the organiser of the collection of personal data for the ERP, we are the controller because we exercise overall control over the personal data being processed.
When we process your personal data (for example, directing the event organiser or ticket agent to share your name, date of birth or address with DHSC or to send you surveys about your experience of the NHSx app), the following lawful basis will apply:
- Article 6(1)(e): the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
To secure admission to the event, you will need to demonstrate via the NHS App that either you have had a negative lateral flow test result or proof of full COVID-19 vaccination or natural immunity. This is classed as health data and categorised as special category data under data protection laws. Although we do not collect this data directly, the fact that you have attended an ERP event may infer that you have had a negative lateral flow test result, full vaccination or natural immunity. When processing special category data, we need an additional lawful basis and have determined that the following legal basis may apply:
Article 9 (2)(g): processing is necessary for reasons of substantial public interest (with a basis in law)
- When processing special category data for reasons of substantial public interest, we also need a condition for processing under the Data Protection Act 2018 and the following condition applies:
- Schedule 1, Part 2, Section 6 – statutory and government purposes relating to public health and in particular the management of the COVID-19 public health emergency.
The lawful basis that we rely on to process your personal data will determine which of the rights are available to you (please see section “What are your data protection rights?”). If we hold personal data about you in different parts of DCMS for different purposes, then the lawful basis we rely on in each case may not be the same
WHAT PERSONAL DATA DO WE COLLECT?
Unless you contact us directly (for example, because you want to exercise your data subject rights or you have queries regarding the study) we will not directly collect or see any of your personal data.
Your personal data is collected directly by the event organisers or ticketing agents. This personal data includes first name, last name, address, postcode, date of birth, ticket order number, phone number, email addresses and whether your ticket was scanned.
At our request, the event organiser or ticketing agent will then share that personal data directly with the Department for Health and Social Care, NHS Test and Trace and Public Health England.
If, following your attendance at an ERP event, you request a PCR test kit, you will be asked to confirm if you have recently attended an ERP event. If you check this box and subsequently test positive, this data will remain with DHSC (as the controller for NHS Test and Trace) who will then match your data against the event attendee data that has been provided to them by the event organiser. Please see the section ‘Why are we collecting your data?’ for more information.
The personal data DHSC collects as a controller includes health data. You can find out more about what data is collected by NHS Test and Test by viewing their Privacy Notice at: Test and Trace: overarching privacy notice - GOV.UK (www.gov.uk)
When you attend an event, a visual check will be carried out by one of the event stewards to verify the evidence you provide to enter the event. We will not collect or process your personal data and no record will be retained of the evidence provided to enter the event.
WHAT IS PERSONAL DATA?
Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject’. A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use, and storage.
Once an event has completed, PHE will analyse the records of attendees who subsequently request a test from Test and Trace. For those who test positive for COVID-19 following the event, PHE will share this data in an anonymised form with the London School of Hygiene & Tropical Medicine for research purposes only. Once the data is anonymised, it will no longer be personal data.
HOW LONG IS YOUR PERSONAL DATA RETAINED FOR?
Where DHSC and PHE process your personal data as a controller, they will retain your data in accordance with their own retention policies. Please refer to the links below to the respective privacy notices of DHSC (in relation to NHS Test and Trace) and PHE for information on how long your data is retained for by DHSC and PHE:
https://www.gov.uk/government/publications/nhs-test-and-trace-privacy-information/test-and-trace-overarching-privacy-notice#how-long-we-keep-your-personal-data
https://www.gov.uk/government/publications/phe-privacy-information/privacy-information
Where DCMS is the controller of your personal data as set out in this privacy notice, personal data will be retained for as long as needed to fulfil the purposes outlined above, in line with our public task or for a period specifically required by applicable regulations or laws.
When determining the relevant retention periods, the following factors may be taken into account:
- our public task;
- legal obligation(s) under applicable law to retain data for a certain period of time;
- statute of limitations under applicable law(s);
- (potential) disputes; and
- guidelines issued by relevant data protection authorities.
Anonymous data may be retained for longer periods (personal data which has been anonymised will no longer be personal data).
WHAT WILL HAPPEN IF I DO NOT PROVIDE THIS DATA?
If you are aged 11 and over and you cannot present with proof of a negative LFD test or proof of full COVID-19 vaccination, or proof of natural immunity, you will not be permitted entry to the event.
AUTOMATED DECISION MAKING
We will not use your data for any automated decision making.
DATA TRANSFERS OUTSIDE OF THE UK
We will not send your personal data outside the U.K.
WHAT ARE YOUR DATA PROTECTION RIGHTS?
You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). These include:
- Your right to get access to your information – you have the right to ask for a copy of any information about you that is held or controlled by DCMS.
- Your right to update or correct your information – you have the right to ask for any information held about you that you think is inaccurate, to be corrected.
- Your right to restrict how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used. However, this is not an absolute right and we may need to continue to use your information and we will tell you if this is the case.
- Your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case.
- Your right to get your information deleted – this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case.
- Your right to request that information is provided to you in a structured, commonly used and machine-readable format (data portability).
OUR CONTACT DETAILS FOR QUESTIONS. COMPLAINTS OR IF YOU'D LIKE TO EXERCISE YOUR DATA PROTECTION RIGHTS
If you wish to exercise any of the above rights, you can do so by contacting our Data Protection Officer (DPO) using the details below:
Data Protection Officer
The Department for Digital, Culture, Media & Sport
100 Parliament Street
London
SW1A 2BQ
Email: [email protected]
If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the DCMS Data Protection Officer or the Data Protection Manager at the relevant agency in the first instance. You can contact the DCMS Data Protection Officer using the details above.
Contact details for the UK’s Information Commissioner’s Office
If you are not satisfied or your complaint is unresolved, you can contact the Information Commissioner's Office (ICO). The ICO is the supervisory authority for data protection legislation and maintains a full explanation of these rights on their website using the details below:t
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
More information can be found at https://ico.org.uk/
