We're supporting also action to manage and mitigate the spread and impact of the current outbreak of COVID-19. This privacy notice is to make it easier to understand and provide you with more information about how our public health team may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the coronavirus pandemic (COVID-19).
At this time, we may seek to collect and process your personal data in response to the recent outbreak of coronavirus, which is beyond what would ordinarily be collected in order to ensure your safety and wellbeing. This includes the processing of personal data for COVID-19 purposes as per the notice issued by the Secretary of State.
It will enable us to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.
There are several key groups or purposes we will gather data and information for.
COVID-19 high risk groups
Personal data is being collected to assess and provide support to adults, children and young people who are in high-risk categories and would be considered vulnerable, if infected with coronavirus.
Basic details about you including your name, address, telephone number and email address. We will also need to collect details about your health to identify if you (or those closely linked to you) are in any of the high-risk categories and would be considered vulnerable, if infected with coronavirus.
Community Response Unit and volunteers
Personal data is being collected in order to co-ordinate the community response to COVID-19.
Basic details about you including your name, address, telephone number and email address. We will also need to collect details about your health to identify if you (or those closely linked to you) are in any of the high-risk categories and would be considered vulnerable, if infected with coronavirus.
We will use the information you provide to:
- connect you to support in the community as part of the COVID-19 response
- to analyse your information in order to improve the services we offer
Derbyshire Discretionary Fund and welfare rights
Personal data is being collected in order to assess an application for funding from the Derbyshire Discretionary Fund. The focus of the fund is to offer individuals access to emergency funding as a result of coronavirus.
Local contact tracing partnership for Test and Trace
We are working with Public Health England, other local authorities and third-party organisations to deliver the Local Contact Tracing Partnership.
We are working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic and this information needs to be read alongside Public Health England's privacy notice on how they are handling your information for Test and Trace.
Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected with COVID-19. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.
We will receive personal information from Public Health England and NHS Test and Trace for the following reasons:
- enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
- enable contact tracers to manage the process of tracing these contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
- enable the necessary sharing of personal information to third party organisations using minimum data
- enable the planning, management and containment of local outbreaks
Your information may also be used for different purposes that are not directly related to your health and care. These include:
- research into COVID-19
- planning of services or actions in response to COVID-19
- monitoring the progress and development of COVID-19
Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.
Your information will be treated with strict confidence and only disclosed where it is necessary to prevent a COVID-19 outbreak by investigating an establishment for potential contacts, the minimum amount of personal information will be shared if necessary, with:
- other local authorities to enable officers to assist the establishment and provide advice to contacts
- sub-contractors to deliver support and advice in key sectors (for example, care homes, education, prisons, housing)
- we may need to disclose your name and the fact that you have tested positive to your employer or the operator of an institution where you have spent significant time if this is necessary to avoid or limit a COVID-19 outbreak in the workplace
Your personal information is protected and is held on computer systems that have been tested to make sure they are secure, and which are kept up-to-date to protect them from viruses and hacking.
Your information can only be seen by our local contact tracing services who have been specially trained to protect your privacy. Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.
Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.
How long we will keep your personal information
The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC). Read GOV.UK's coronavirus COVID-19 notice for more information.
If we need to use your information for research or reports, your information will be anonymised. The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely.
Purpose of processing
Public health has a legal duty to protect and improve the health and wellbeing of people in Derbyshire. The processing is necessary for the performance of this task carried out in the public interest and for compliance with a legal obligation as set out in the Health and Social Care Act 2012. To support this, we use health and social care data from a range of sources. We use this data to:
- provide services to meet your needs
- provide you with signposting, relevant advice and information and onward referral
- monitor, plan, and evaluate our services
- measure the health, mortality and care needs of specific geographical areas and population groups
- understand more about the nature, causes and outcomes of disease
Information we process
To support local contact tracing, for an individual who has tested positive for COVID-19 (case):
- unique record ID
- full name
- date of birth
- gender
- ethnicity
- NHS number
- home postcode and house number
- telephone number and email address
- occupation and key worker type
- COVID-19 symptoms, including when they started and their nature
- vulnerability group
- shielded status
For those who have been in close contact with someone who tests positive (contact):
- full name
- date of birth
- contact details
- ethnicity
- NHS number
- home postcode and house number
- telephone number and email address
- occupation and key worker type
- details of any COVID-19 symptoms they may have had
- vulnerability group
- clinically extremely vulnerable status
Your information is used to provide advice on self-isolation and how to protect yourself and others from COVID-19. It will also help identify outbreaks which require support.
Information we receive
To help us fulfil our legal obligations, we receive information from NHS Digital and Public Health England. Civil Registrations (Births and Deaths) data includes:
- postcode of usual residence
- place of birth text and postcode, postcode of place of death
- NHS number
- date of birth, date of death, date of registration
- maiden name, name of certifier, name of coroner
- birth weight, cause of death
National Child Measurement Programme (NCMP) data includes name, address, NHS number, date of birth, ethnicity and body mass index (BMI).
In relation to contact tracing to support the local response to the coronavirus response. Personal information will come from different sources:
- Public Health England
- the individual cases and contacts
- third party organisations and settings (for example, workplaces, schools, care homes, other local authorities)
Sharing your information
The information you provide to access our services may be shared with other relevant organisations and agencies for the purposes of onward referral but in this case we will ask for your explicit consent and tell you with whom it will be shared. Information will not be shared with any other third parties unless required by law. You can refuse permission for us to share your information, however, this may limit how much we may be able to support you.
Information we receive from other agencies to fulfil our legal obligations is not shared with any other organisations and we do not publish information that is identifiable.
In relation to the coronavirus response, we may sometimes need to share some of your information with:
- health service providers including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
- education providers
- care providers, for example day care, domiciliary, residential
- government agencies (for example Department of Health, Department of Work and Pensions)
- district and borough councils
Amount of time we will hold your information
The information provided will be kept in accordance with our records retention schedules.
We will only keep your information for as long as necessary, taking into account government advice and the ongoing risk presented by coronavirus. At a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.
Keeping your information secure
We are committed to protecting personal data and have data policies and proceduresin place to ensure that it is safeguarded.
Legal basis for our use of your personal information
The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows us to use the personal information collected for the purpose of Test and Trace (COVID-19).
The section of the GDPR that applies is:
- Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’
As information about health is a special category of personal information, a further section of the GDPR applies:
- Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’
- Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Data Protection Act 2018 Schedule 1 Part 1 (4) - research
Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.
This is known as 'section 251' approval and includes using your test results if you test positive for coronavirus to start the contact-tracing process.
The part of the law that applies here is section 251 of the National Health Service Act 2006 and regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.
Your rights
Should you wish to raise any concerns about how we have processed your personal data you can contact the data protection officer, email: access2info@derbyshire.gov.uk
You also have the right to contact the Information Commissioner.
If you would like a copy of this information in a different format, please email: kit@derbyshire.gov.uk