Legislation – The Health Protection (Coronavirus Restrictions) (No. 4) (Wales) Regulations 2020

A contact tracer may disclose only such relevant information to a person (“the information holder”) as is necessary for the information holder to have—

(a)

for the purposes of—

(i)

carrying out a function under these Regulations,

(ii)

preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii)

monitoring the spread of infection or contamination with coronavirus, or

(b)

for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(2)

Relevant information is—

(a)

where a person is required to isolate in accordance with regulation 11(2), 12(2), 13(2) or 14(2)—

(i)

the person’s contact information and date of birth;

(ii)

the date the person received a notification under regulation 11(1), 12(1), 13(1) or 14(1), or, where the person is a child, the adult with responsibility for the child;

(iii)

the particular period in respect of which the person is required to not leave or be outside of the place where the person is living calculated in accordance with regulation 11, 12, 13 or 14;

(iv)

details of any fixed penalty notices issued, or proceedings brought, in relation to an offence of contravening regulation 11, 12, 13 or 14 alleged to have been committed by the person;

(b)

confirmation a person did not receive a positive coronavirus test (including the person’s name, contact information and date of birth).

(3)

The information holder may use relevant information disclosed under paragraph (1) only to the extent that it is necessary—

(a)

for the purposes of—

(i)

carrying out a function under these Regulations,

(ii)

preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii)

monitoring the spread of infection or contamination with coronavirus, or

(b)

for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(4)

Subject to paragraph (6), the information holder may disclose only such relevant information to another person (the “recipient”) as is necessary for the recipient to have—

(a)

for the purposes of—

(i)

carrying out a function of the recipient under these Regulations,

(ii)

preventing danger to the health of the public as a result of the spread of infection or contamination with coronavirus, or

(iii)

monitoring the spread of infection or contamination with coronavirus, or

(b)

for a purpose connected with, or otherwise incidental to, a purpose described in sub-paragraph (a).

(5)

Subject to paragraph (7), disclosure which is authorised by this regulation does not breach—

(a)

an obligation of confidence owed by the person making the disclosure, or

(b)

any other restriction on the disclosure of information (however imposed).

(6)

This regulation does not limit the circumstances in which information may otherwise lawfully be disclosed under any other enactment or rule of law.

(7)

Nothing in this regulation authorises the use or disclosure of personal data where doing so contravenes the data protection legislation.

(8)

For the purposes of this regulation, “data protection legislation” and “personal data” have the same meanings as in section 3 of the Data Protection Act 20184.