The Health Protection (Coronavirus Restrictions) (No. 5) (Wales) Regulations 2020

Power to use and disclose information

14.—(1) A contact tracer may disclose only such relevant information to a person (“the information holder”) as is necessary for the information holder to have—

(a) for the purposes of—

(i) carrying out a function under these Regulations,

(ii) preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii) monitoring the spread of infection or contamination with coronavirus, or

(b) for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(2) Relevant information is—

(a) where a person is required to isolate in accordance with regulation 6(2), 7(2), 8(2) or 9(2)—

(i) the person’s contact information and date of birth, or, where the person is a child, the contact details of the adult who is notified that the child is required to isolate and the child’s date of birth;

(ii) the date the notification was given under regulation 6(1), 7(1), 8(1) or 9(1);

(iii) the particular period in respect of which the person is required to not leave or be outside of the place where the person is living calculated in accordance with regulation 6, 7, 8 or 9;

(b) confirmation a person did not receive a positive coronavirus test and the person’s name, contact information and date of birth, or, where the person is a child, the name and contact details of an adult with responsibility for the child in addition to the child’s name and date of birth.

(3) The information holder may use relevant information disclosed under paragraph (1) only to the extent that it is necessary—

(a) for the purposes of—

(i) carrying out a function under these Regulations,

(ii) preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii) monitoring the spread of infection or contamination with coronavirus, or

(b) for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(4) Subject to paragraph (6), the information holder may disclose only such relevant information to another person (the “recipient”) as is necessary for the recipient to have—

(a) for the purposes of—

(i) carrying out a function of the recipient under these Regulations,

(ii) preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii) monitoring the spread of infection or contamination with coronavirus, or

(b) for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(5) Subject to paragraph (7), disclosure which is authorised by this regulation does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(6) This regulation does not limit the circumstances in which information may otherwise be disclosed under any other enactment or rule of law.

(7) Nothing in this regulation authorises the use or disclosure of personal data where doing so contravenes the data protection legislation.

(8) In this regulation, “data protection legislation” and “personal data” have the same meanings as in section 3 of the Data Protection Act 2018(1).

(1)

2018 c. 12.