Close of of a student holding a pen in their hand while studying at a PC

LJMU Track and Trace COVID19 Privacy Notice

Information you need to know:

The Track and Trace team is part of Liverpool John Moores University. Further information on the institution can be found here:

Liverpool John Moores University is the Data Controller.

Our Data Protection Officer can be contacted at

LJMU takes your privacy very seriously.  This privacy notice explains how we use your personal information and your rights regarding that information. We will always use your data as set out in the principles of the General Data Protection Regulation (GDPR).  We are committed to being transparent about how we collect and use your data and to meeting our data protection obligations.

What information are we collecting?

In order to assist with Public Health requirements over community transmission of the COVID19 virus the University is offering a Test service for all staff and students.  Tests are booked online on the Cheshire and Merseyside Health Care Partnership booking system which is hosted on the University of Liverpool website.

All personal information that you give to the Cheshire and Merseyside Health Care Partnership as part of the booking process will be shared with LJMU.

LJMU will collect the personal identifiable information to ensure that test results are allocated to the right person and to enable effective research of the spread of the virus (by Public Health and the NHS) and your test results.

LJMU currently collects data from a range of staff and student systems including absence reporting related to COVID symptoms and self isolation, swipe card access data, attendance monitoring data from fixed devices or paper registers, timetable data to determine attendance on campus to enable any clusters or outbreaks to be actively monitored and necessary mitigation measure to be put in place.

Why are we collecting your data and what is the legal basis for this?

The UK is currently experiencing a public health emergency as a result of the Covid-19 pandemic.  It is critical that organisations take a range of measures to keep everyone safe.  In accordance with guidance from the Department of Education, the university is working with local and regional public health teams and the local authority to help minimise the spread of the disease and to help keep our staff and students safe.

We are collecting your data in order that we can offer you advice and support, to manage our cleaning regimes, to inform our Incident Management and Executive Leadership Teams and so that they can better manage our response to the pandemic and comply with our public health obligations.

LJMU will collect personal data from you for several reasons, and will at all times do so in compliance with the principles of the GDPR, and for one of the legal basis set out in Articles 6 and 9 of the Regulation:

Article 6 (e) –processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Article 6 (c) – processing is necessary for compliance with a legal obligation to which the controller is subject

Article 9 (i) – processing is necessary for reasons of public interest in the area of public health

Who has access to this data?

Your personal data will be used only by relevant LJMU staff where the data is necessary for them to undertake their designated role. In this instance, staff within the Track and Trace team will process data.  Statistical data will also be available to senior members of the University’s leadership team to enable appropriate management of the current situation.

Third parties that we may lawfully share information with include:

  • Liverpool City Council Public Health team
  • Public Health England

How does the University protect your data?

The University takes Data Protection very seriously and at all times your personal data will be handled in line with the University’s Information Security Policy. Your data will be held securely on LJMU systems.

For how long does the University keep your data?

Your data will be kept for 6 years in accordance with our Records Retention Schedule.

Your rights

As a data subject, you have a number of rights. You can:

  • Access and obtain a copy of your data on request, this could be in a portable electronic format;
  • Require the University to change incorrect or incomplete data if you think that it is inaccurate or out of date
  • Require the University to delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If you would like to exercise any of these rights, please contact the Data Protection Officer

What if you do not provide data?

If you do not provide the data, it will not be possible for a COVID19 test to be carried out and processed using this service.  You would need to contact an alternative NHS testing site

Transfers of data outside the EAA

We do not send your personal data outside the European Economic Area.

Automated decision making

We will not make any decisions about you automatically using a computer, based on your personal data. All decisions affecting you will be taken by a human.

How to complain to the Information Commissioner’s Office?

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations.  The Information Commissioner can be contacted:

By post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.

By phone:  0303 123 1113.

By email: contact can be made by accessing