This privacy notice is to provide you with information about how Surrey Heath Borough Council may seek to collect and use information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19), which is above and beyond what would ordinarily be collected in order to ensure your safety and well-being.
Who is the Data Controller for this processing?
What personal information do we hold?
- Information about you, this could include your name, address, date of birth, mobile telephone number and email address.
- National identifiers such as NHS number, National Insurance number etc.
- Information about your family and your next of kin
- Details about your lifestyle and social circumstances
- Physical or mental health details
- Social Care support outcomes
- Central Government Agencies including Public Health England, Department of Health and Social Care
- NHS Digital
- Other Local Authorities
- Health and social care providers
- Police and probation services
- Members of the public (referrer)
- Commissioned partners
- Family members and your next of kin
How do we use your personal information?
- Deliver the service, or handle your query
- Connect you to support in the community as part of the COVID-19 response.
- To plan and improve the services we offer
To process business grants to sole traders, individual trustees, partners or other named persons
Self-Isolation Payments, from 12th October, a one-off payment of £500 or access to a discretionary fund will be available for eligible individuals. If you apply, we will need to process your personal data to assess whether you are eligible to receive financial support, and if so, to provide a payment to you, more information about this sharing can be viewed in the Test and Trace Self Isolation Privacy Notice.
Contacting local residents who are clinically extremely vulnerable in order to facilitate the provision of emergency aid (eg, food and medicines), or other appropriate assistance (eg, social contact).
Enforcement action, this can be taken against someone where they either (i) test positive for Coronavirus, or (ii) have been identified by NHS Test and Trace as having been in close contact with someone who has tested positive for Coronavirus, and, in either case, where that person is not self isolating as required by law. Any enforcement action that results, - pursuant to the Health Protection (Coronavirus, Restrictions) (England) No 3 Regulations 2020, will be taken for and on behalf of Surrey County Council, who will be the data controller. Please refer to Surrey County Council’s Privacy Notice for further information.
To help control local outbreaks of coronavirus infection - To ensure that individuals that have tested positive for COVID 19 are contacted to provide them with advice and to gather intelligence on others with whom they may have been in contact in order to help stop the spread of the virus, your contact information may be shared between Surrey County Council and the national Contact Tracing Service commissioned by Department of Health and Social Care (DHSC) more information about this sharing of your data can be found on the DHSC privacy notice here
Who else might we share your personal information with?
- Health service providers including NHS Agencies (GPs, Hospitals, Ambulance, Health Visitor, Mental Health Services)
- Care providers, e.g. day care, domiciliary, residential
- Government Agencies (e.g. Department of Health, Department of Work and Pensions)
- Support groups for people with disabilities
- Local Government
- Surrey Heath Prepared
- Local Charities
Landlords where households have been placed in emergency accommodation
What is the legal basis for our use of your personal information?
- Article 6(1)(c) – Legal obligation to receive and process shielded patient from NHS Digital for the agreed purpose under the COPI Notice
- Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
- Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
- Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:
- Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
- Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England
How long will we keep your personal information?
How we handle data security
How we handle data breaches
How to complain if you are unhappy about how your data is used
- By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113
- Further advice and guidance from the ICO on this issue can be found on the ICO website.