Skip to main content

Privacy notice

Below you can read the Privacy notice for the COVID-19 111 and Contact Tracing as well as the Privacy notice for the Information Centre.

Privacy notice for the COVID-19 111 and Contact Tracing Service 

This privacy notice explains what information the COVID-19 111 and Contact Tracing Service collects and what that information is used for.

Cabinet Office is a data controller for the purposes of the Data Protection Act 2018 and the Data Protection (Application of GDPR) Order 2018 and the Data Protection (Application of LED) Order 2018, together with any regulations made under them (Manx Data Protection Legislation).

This Privacy Notice applies to the Isle of Man Government COVID-19 111 and Contact Tracing Service

When you use the Isle of Man Government COVID-19 111 and Contact Tracing service we may ask you to share personal information with us.

When we collect your personal information we will:

  • Only collect what we need and no more
  • Keep your information secure
  • Tell you how we will use your information
  • Delete your information when it is no longer needed
  • Only process your information in line with rules set out in Manx Data Protection legislation.

This Privacy Notice defines what happens when you give personal information to the COVID-19 111 and Contact Tracing service and will explain:

  • What information is collected and why
  • Who is collecting it
  • How it is collected
  • Why it is being collected
  • How it will be used
  • How long it will be kept
  • Who it will be shared with
  • How your information will be kept secure

If you have any questions or comments on this Privacy Notice please email the Cabinet Office Data Protection Officer.

Contact the Data Protection Officer for the Cabinet Office:

Email: DPO-CabOff@gov.im

Phone: +44 1624 686779

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
IM1 3PN
Isle of Man

How and why we ask you to share your personal information

We collect and process information, including personal information, to enable contacts of known COVID-19 sufferers to be identified, contacted and an assessment of their risk of catching COVID-19 be made and advice provided to those at high risk..

We use your personal data in line with the rules set out in the Manx Data Protection Legislation for the following reasons:

COVID-19 111 and Contact Tracing Service

The COVID-19 111 and Contact Tracing service collects and processes data for the following purposes, some of which is collected manually, either by you providing it, or by people you have been in contact with. Some of it is collected automatically as part of using the IT facilities.

Our legal basis for processing your information

The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows us to use the personal information collected by the COVID-19 111 and Contact Tracing Service.

The section of the GDPR that applies is:

Article 6(1)(e) of the applied GDPR (lawfulness of processing), ‘the processing of personal data is processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

As information about health is a special category of personal information, a further section of the GDPR applies:

Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’

The COVID-19 111 and Contact Tracing Service can also process personal data under a Direction issued by The Council of Ministers pursuant to Regulation 5(1) of The Emergency Powers (Coronovirus) (Information Sharing) Regulations 2020.

Type of personal information we collect about you

Below you will find an overview of the categories of information that we may collect.

Information you provide to us directly

Category of information

Examples of that type of information

Personal details

Name, email address, telephone number, address

Personal identification information

Title, date of birth, nationality, gender

Family, lifestyle and social circumstances

Dependents, marital status, next of kin and contact details

Individuals you have been in contact with

Name, email address, telephone number, address, title, date of birth, nationality, gender

Travel Details

Date, Port/Airport, length of stay, location

Health Information

Test date, test results, symptoms, health problems

Employer Details

Occupation, employer details

Information next of kin, patient, contact or health professional may provide to us

Category of information

Examples of that type of information

Personal details

Name, email address, telephone number, address

Personal identification information

Title, date of birth, nationality, gender

Family, lifestyle and social circumstances

Dependents, marital status, next of kin and contact details

Travel Details

Date, Port/Airport, length of stay, location

Health Information

Test date, test results, symptoms, health problems

Employer Details

Occupation, employer details

Information we collect automatically

When you visit or use our website we may collect information sent to us by your computer, mobile phone, or other device. For example we may collect:

Category of information

Examples of that type of information

Device information

Hardware model, operating system version, IP address

Log information

Time and duration of visit

Other information

Links you click, location

Tracking information

When you visit this site we use cookies that do not collect any personal information.

Read more about how we use Cookies

How long do we keep your personal information

We will only keep your information for the minimum time necessary.

This may be to:

  • Respond to an enquiry from you
  • Confirm the transfer of information to the Department, Office or Board providing a service you have requested
  • Meet statutory requirements

Records are only retained for longer term periods if their retention can be justified for statutory, regulatory, legal or security reasons or for their historic value.

How we keep your personal information secure

The security and confidentiality of your information is very important to us.

We will ensure that:

  • Safeguards are in place to make sure personal information is kept securely
  • Only authorised staff are able to view your information
  • Maintain security of the systems which hold personal information in line with ISO27001 standard

We may share your information:

  • With or between other Government Departments, Boards and Offices to provide a service or information you have requested, where there are arrangements in place to do so
  • The police or law enforcement agencies where there is a legal requirement to do so
  • The courts on production of a valid court order

We will not sell to, or share, your personal information with other companies, organisations or individuals.

Individual Departments may share your personal information with other companies, organisations or individuals where there is a legal requirement to do so.

Your personal information will not be disclosed to any third party without your prior consent or where required to do so by law.

Your rights

To ask if we hold personal information about you

You can ask to see what information we hold about you by submitting a ‘Subject Access Request’ to the Cabinet Office Data Protection Officer.

You can review your personal information and ensure it is accurate

Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.

Alternatively you can ask for the information we hold about you to be changed by making a request to the Cabinet Office Data Protection Officer.

To remove your personal information

In certain circumstances you can ask for your information to be deleted. Please note that as part of the Isle of Man Government statutory functions some information may need to be retained.

You can request this by contacting the Cabinet Office Data Protection Officer.

To make a complaint

If you are unhappy with the way we deal with your personal information you can submit a complaint to the Cabinet Office Data Protection Officer who will work with you to resolve any issues.

Email address: DPO-CabOff@gov.im

Telephone: +44 1624 686779

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
Isle of Man
IM1 3PN

The Isle of Man’s Information Commissioner is the independent supervisory body responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Manx Data Protection Legislation.

Will this privacy notice change

This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent. If any significant change is made to this Privacy Notice we will provide a prominent notice on this website so that you can review the updated Privacy Notice. 

This Privacy Notice may be replaced, or more information added, when you send feedback, ask to use a service online or make a payment for a service through our website.

This privacy notice was last updated in June 2020.

How to request access to your personal information

Due to the unprecedented circumstances of COVID-19 we are working hard to prioritise the delivery of essential front-line services to our most vulnerable people and communities. 

Public authorities, especially those providing frontline and critical services, may need to divert resources to priority work areas with consequential impacts on other areas such as the handling of Subject Access Requests. Your statutory rights are important to us and remain unchanged. Please note however that you may experience delays in our response to your request. We will inform you of any extension to the period for responding and the reasons for the delay.

If you are able to narrow the scope of your request that would be very helpful and may mean we can respond to you more quickly. In addition you may want to reconsider whether your request can be resubmitted at a later date once the impact of COVID-19 has eased.

We will be alert to any guidance from the regulator, the Information Commissioner, as the situation changes, to ensure that we comply with any guidance or changes to information rights.

For more information on Coronavirus (COVID-19), see gov.im/coronavirus.

Under the Data Protection Act 2018 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.

A subject access request is made by contacting the Data Protection Officer (DPO) of the Department, Office or Board that collects the information.

To make a request of the DPO for the Cabinet Office contact:

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
Isle of Man
IM1 3PN

Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. Further information can be found on the Information Commissioner's website.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Act 2018.

 

Privacy Notice for the Information Centre

This privacy notice explains what information the Cabinet Offices’ Information Centre (part of Government Technology Services) collects and what that information is used for.

Cabinet Office is a data controller for the purposes of the Data Protection Act 2018 and the Data Protection (Application of GDPR) Order 2018 and the Data Protection (Application of LED) Order 2018, together with any regulations made under them (Manx Data Protection Legislation). However, in this particular instance the Information Centre is a data processor only.

The Information Centre does not collect any data from data subjects directly as it sources data from other Government Departments and systems and all information provided contains no personal identifiable information. This means the data the Information Centre has access to and uses to produce reporting and analysis services does not identify any individual person.

Background

As a key enabler to the Isle of Man Governments response to the COVID-19 pandemic, good quality, timely and accurate information reporting is critically important.

The data and associated modelling are the tools by which decision making is informed across the spectrum of the pandemic, including health, social and economic factors. It is also critical that the public are well informed to understand and comply with Government directives.

To bring the data and data modelling into a single service, the Information Centre has been formed which will result in a single repository of data for use across Isle of Man Government, the public and other parties (e.g. open data), and disseminated as appropriate.

In order to achieve this, data needs to align to some key principles, namely:

  • A single source of the truth should be identified to ensure consistent accurate data
  • Data will be automatically extracted from the source wherever possible to reduce errors in translation and transcription
  • Data protection principles apply and best practice methods will be used
  • No personally identifiable data will be provided to the Information Centre from source systems

An example of how Information Centre data can be used is the mathematical modelling that determines the curve of infection that we have all become familiar with. This modelling is based on the source data collected and made available by the Information Centre.

As no data that personally identifies an individual is being collected by the Information Centre and nor is the Information Centre technology extracting any data that personally identifies an individual, it has been assessed there is no requirement to perform a Data Processing Impact Assessment (DPIA) for the Information Centre.

If you have any questions or comments on this Privacy Notice please email the Cabinet Office Data Protection Officer.

Contact the Data Protection Officer for the Cabinet Office:

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
IM1 3PN
Isle of Man

Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

Information we collect automatically

When you visit or use our website we may collect information sent to us by your computer, mobile phone, or other device. For example we may collect:

Category of information

Examples of that type of information

Device information

Hardware model, operating system version, IP address

Log information

Time and duration of visit

Other information

Links you click, location

Tracking information

When you visit this site we use cookies that do not collect any personal information.

Read more about how we use Cookies

Your rights

To ask if we hold personal information about you

You can ask to see what information we hold about you by submitting a ‘Subject Access Request’ to the Cabinet Office Data Protection Officer.

You can review your personal information and ensure it is accurate

Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.

Alternatively you can ask for the information we hold about you to be changed by making a request to the Cabinet Office Data Protection Officer.

To remove your personal information

In certain circumstances you can ask for your information to be deleted. Please note that as part of the Isle of Man Government statutory functions some information may need to be retained.

You can request this by contacting the Cabinet Office Data Protection Officer.

To make a complaint

If you are unhappy with the way we deal with your personal information you can submit a complaint to the Cabinet Office Data Protection Officer who will work with you to resolve any issues.

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
Isle of Man
IM1 3PN

Email address: DPO-CabOff@gov.im
Telephone: +44 1624 686779

The Isle of Man’s Information Commissioner is the independent supervisory body responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Manx Data Protection Legislation.

Will this privacy notice change

This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent. If any significant change is made to this Privacy Notice we will provide a prominent notice on this website so that you can review the updated Privacy Notice. 

This Privacy Notice may be replaced, or more information added, when you send feedback, ask to use a service online or make a payment for a service through our website.

This privacy notice was last updated in June 2020.

How to request access to your personal information

Due to the unprecedented circumstances of COVID-19 we are working hard to prioritise the delivery of essential front-line services to our most vulnerable people and communities. 

Public authorities, especially those providing frontline and critical services, may need to divert resources to priority work areas with consequential impacts on other areas such as the handling of Subject Access Requests. Your statutory rights are important to us and remain unchanged. Please note however that you may experience delays in our response to your request. We will inform you of any extension to the period for responding and the reasons for the delay.

If you are able to narrow the scope of your request that would be very helpful and may mean we can respond to you more quickly. In addition you may want to reconsider whether your request can be resubmitted at a later date once the impact of COVID-19 has eased.

We will be alert to any guidance from the regulator, the Information Commissioner, as the situation changes, to ensure that we comply with any guidance or changes to information rights.

For more information on Coronavirus (COVID-19), see gov.im/coronavirus.

Under the Data Protection Act 2018 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.

A subject access request is made by contacting the Data Protection Officer (DPO) of the Department, Office or Board that collects the information.

To make a request of the DPO for the Cabinet Office contact:

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
Isle of Man
IM1 3PN

Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. Further information can be found on the Information Commissioner's website.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Act 2018.

COVID-19 Private COVID Test 

The DHSC are able to provide under the National Health Service Act 2001 private services, which are chargeable.  Access to a COVID-19 PCR private chargeable test (£50.00 per test, per person) can be provided by the DHSC for the following individuals.

  • individuals intending to receive private health and care treatment either on or off-island and who require a COVID-19 test prior to treatment

and

  • pre travel (international) where passengers require a COVID-19 PCR test as part of the county border entry conditions

Access to the test require validation to ensure appropriate use of this service. 

The DHSC have delegated the administration of this service (booking of appointments, reporting of results and validation of travel ) to the COVID-19 111 Response and Contact Tracing Team (“COVID 111 Team”).

The Cabinet Office processes personal data provided by an individual on a consent basis to access a private chargeable COVID -19 test.

The DHSC will validate persons wishing to access a test in respect of private health and care treatment as this special category data will require a greater degree of confidentiality and will not therefore be disclosed further.

Data you provide to either the DHSC or COVID 11 Team will include: name, date of birth, email and for validation purposes confirmation of health or care treatment and international travel arrangements.

The information you provide will be processed to assess validation and retained for a period of 4 weeks in all circumstances.  Thereafter your name, date of birth and contact details will only be retained by the CABO as a record of your validation of eligibility for a test.  These details will be retained for a period of 2 months.  Thereafter re-validation of your request for a test is required.

Updated 24 November 2020