Contact Tracing at Ghent University

Nederlandse versie

If one suspects an outbreak of the COVID-19 virus within UGent context (> 30% of a group of students or staff within 1 week) this should be reported via arbeidsarts@ugent.be with the subject: outbreak Covid-19.

Contact tracing means that after receiving a report that a student or staff member has tested positive, either from the government contact tracers, our Ghent University team will track any high-risk contacts which that student or member of staff had during any official Ghent University activities, and will contact the people involved. This process relates only to contact which happened during Ghent University activities and not to contact during private activities.

The aim of the internal contact tracing within Ghent University is to help slow down any exponential outbreak of the virus. Internal contact tracing increases the chance that people within Ghent University who are potentially infected can be identified quicker and more adequately. In this way, these individuals can be asked to go into quarantine and – if necessary – get tested. The ultimate aim is therefore to help combat the COVID-19 pandemic. Ghent University is taking on this additional task in the interests of society at large, and at the request of the Flemish government.

In so doing, Ghent University is assuming its responsibility as a university – not only in relation to our students and staff, but to society as a whole.

The Ghent University contact tracing team will only request and record data which is strictly necessary for the purpose at hand, namely for contact tracing. (For more information, see the privacy statement below). The data requested and registered in this way will not be used for any other purpose.

Privacy Statement

This privacy statement explains how personal data will be collected and processed for the purpose of internal contact tracing within Ghent University in the broader context of measures in the fight against the COVID-19 pandemic.

Purpose and legal basis for processing your personal data

As part of the fight against the COVID-19 pandemic, Ghent University is organising internal contact tracing. The purpose of processing data in this way is to is to help identify high-risk contacts that happen in the context of formal Ghent University-related activities. This means that after receiving a report that a student or staff member has tested positive, either from the government contact tracers or via the internal email address (contacttracing@ugent.be), our Ghent University contact tracing team will track any high-risk contacts of that student or member of staff that occurred during official Ghent University activities, and will contact the people involved. This relates solely to contact which happened during Ghent University activities and not during private activities. Low-risk contacts will not be contacted.

The aim of the internal contact tracing within Ghent University is to help slow down any potential exponential outbreak of the virus. Internal contact tracing increases the chance that people within Ghent University who are potentially infected can be identified quicker and more adequately. In this way, these individuals can be asked to go into quarantine and – if necessary – get tested. The ultimate aim is therefore to help combat the COVID-19 pandemic. Ghent University is taking on this additional task in the interests of wider society, and at the request of the Flemish government.

In the context of this contact tracing, Ghent University will process personal data, working under the supervision of the occupational physician, in the legitimate interest of Ghent University and of the competent federated entities or the contact centres designated by the authorised agencies (pursuant to Article 6.1.f GDPR, Article 9.2.b GDPR and Article 9.2.i GDPR).

See here also, specifically, the Cooperation Agreement of 25 August 2020 between the Federal State, the Flemish Community, the Walloon Region, the German-speaking Community and the Common Community Commission on joint data processing by Sciensano and the contact centres, health inspections and mobile teams as designated by the competent federated entities or the authorised agencies, in the context of contact investigation of persons (presumed to be) infected with the COVID-19 coronavirus on the basis of a database at Sciensano, as ratified by the Law of 9 October 2020 and the Law of 4 August 1996 relating to the protection of workers from the risks of exposure to biological agents at work.

We will process the personal data you provide with the utmost attention and care with a view to conducting contact tracing within Ghent University.

Who is responsible for the analysis and how can you contact us?

The contact tracing described above is carried out by staff members who are given this mandate and are affiliated with Ghent University.

Ghent University acts as controller.

If you have any questions, comments or suggestions, please contact the organizers of the Ghent University contact tracing team by emailing actueel@ugent.be.

For further questions about the various rights and obligations in relation to privacy, or if you believe that your personal data is being processed improperly and/or incorrectly by the Ghent University contact tracing team, you can contact the Data Protection Officer of Ghent University via privacy@ugent.be.

Which personal data are processed?

"Personal data" are data related to information about an identified or identifiable natural person.

The answers you provide during a telephone survey with a contact tracer are briefly logged in a survey form with the aim of assessing risk.

From the survey form, the following data are entered into a register: your first name and surname, your email address, your telephone number, date of notification, date of test, date of positive test result, date of first symptoms, your student number or personnel number, name of course and/or work unit, where applicable the internal index number of a student/staff member who tested positive and with whom you previously had high-risk contact, start- and end-date of risky contacts, indicative number of low-risk contacts within Ghent University, number of high-risk contacts within Ghent University, number of high-risk contacts who subsequently tested positive for COVID-19.

The above data will be retained in the event that you are a student or staff member who has tested positive, whose contacts within Ghent University need to be tracked. In the event that you yourself are the high-risk contact (based on a risk analysis), the following data will be recorded: your name, your address, your telephone number, your student number or personnel number, date of contact with the student/staff member who tested positive, date when Ghent University contacted you, and the internal index number of the student/staff member with whom you had a high risk contact.

For definitions of 'high-risk contact' and 'low-risk contact' see the Sciensano website (link in Dutch).

The contact tracing team of Ghent University will only request and register data that are strictly necessary to meet the purposes as stated in this privacy statement. The data thus requested and registered will not be used for any other purpose.

Who has access to your personal data?

The people working in the contact tracing team of Ghent University have access to your personal data on a strictly "need-to-know" basis. That is, solely in order to identify and contact high-risk contacts, sources of risk and possible clusters. This access is therefore only valid for the purposes specified in this privacy statement. In addition, this relates to differentiated access, depending on the role taken on by each member of the team. As such, only the occupational physician and the coordinators have full access to the registration system, and they are the only ones who can see the full register; employees who work as dispatchers can see only part of the register; employees who work as tracers see an even smaller section of the register, namely the data that are recorded and collected in the survey form which they complete.

The contact tracing team of Ghent University, under the supervision of the occupational physician, will ensure that your data are not passed on to third parties, except in the event that you have given prior consent for this, or where the access, use, retention or disclosure of your personal data is reasonably considered to be necessary (e.g. to comply with applicable regulations, in order to detect technical or security problems, in order to protect the rights, property or safety of the organization of contact tracing within Ghent University).

At present, registered data are not shared with, or passed on to third parties, including the (local) government. If this were to change, for example because the (local) government obliged us to do so, this information will be communicated and thus adapted on the web page of Ghent University.

For how long will your personal data be processed?

Your personal data will not be retained for any longer than necessary to achieve the purposes for which they are being processed. In the present case there is only one purpose, namely to detect and inform high-risk contacts who, during Ghent University-affiliated activities, have had close contact with a student or staff member who has tested positive.

The survey form (i.e. the individual tracing file) will be deleted two weeks after the file is closed. At the end of this same two-week period, your data in the register will be pseudonymised with a view to archiving in the public interest, scientific or historical research or for statistical purposes. Anonymised data can also be used for research or reporting purposes; in this case you are in no way identifiable.

Finally, the register will stop operating, and be deleted by Ghent University, at the latest within 5 days following the date when the royal decree is published declaring the end of the state of the COVID-19 pandemic.

Security of your personal data

Your personal data is used solely in the context of contact tracing. All processing of your personal data is carried out in accordance with the information security policy that applies at Ghent University. This means that appropriate technical and organizational measures are taken to protect your personal data from any form of loss or unlawful processing. As described above, access to your data is limited and the data are stored in a secure environment within Ghent University.

What rights do you have related to the processing of your personal data?

When we collect and use your personal data, there are a number of rights that you can exercise as described below. Please note that if you wish to exercise a right, we will ask you for proof of your identity. We do this in order to prevent any breach related to your personal data, for example if an unauthorised person comes forward on your behalf and exercises a right in your name.

1. You have the right to access your personal data, meaning that you can ask us to provide information about the personal data that we hold about you.

2. You have the right to request that we correct your personal data if you can prove that the personal data we are processing about you are incorrect, incomplete or out of date.

3. You may request that we delete your personal data if they are no longer necessary for the purposes for which we collected them, if it was unlawful to collect them, or if you successfully exercised your right to object to your personal data being processed. If any of these conditions apply, we will immediately delete your personal data, unless we are prohibited from doing so due to legal obligations or administrative or court orders.

4. In the following circumstances, you may ask us to restrict the processing of your personal data:

• while we review your request to correct your personal data;
• if such processing was unlawful, but you prefer your data to be restricted rather than removed;
• if we no longer need your personal data, but you need it to bring, pursue or defend legal actions.

5. If we process your personal data for the purposes of our own legitimate interests or those of third parties, you have the right to object to our processing your personal data. We ask you to describe the specific circumstances that give rise to the request. In that case, we will weigh up your circumstances against our interests and/or those of the above-mentioned third parties. If this consideration suggests that your circumstances outweigh our interests and/or those of the above-mentioned third parties, your personal data will not be processed any further.

You can make your request by sending an email to the organizers of the contact tracing team of Ghent University (actueel@ugent.be) or by post to UGent Contact Tracing, Campus UFO, Rectoraat, Sint-Pietersnieuwstraat 25, 9000 Gent.

If you make a request, please always include information about the context in which we obtained your personal data, so that we can process your request quickly and carefully. Your request must also be dated and accompanied by a copy of valid ID. We will notify you immediately upon receiving your request. If your request turns out to be valid, we will inform you as soon as possible, no later than 30 days after receiving the request.

If you repeatedly submit the same request and clearly cause inconvenience, we may reject these successive attempts or charge you an administration fee. We can also deny you the right to access your personal data, or grant only partial access, if such access might disproportionately harm the rights and freedoms of others, including those of Ghent University.

If you have a complaint about the processing of your personal data, you can contact the Data Protection Officer of Ghent University via privacy@ugent.be.  If you are not satisfied with our reply, you can file a complaint with the competent data protection authority, namely the Belgian Data Protection Authority and/or the “Vlaamse Toezichtcommissie” (Flemish Supervisory Committee).

Changes to the privacy statement

This privacy statement may be updated so that it continues to comply with applicable regulations.

If the privacy statement is amended, you will be informed of this via the website of Ghent University.