Privacy notice for COVID-19 response

What do we use the information for?

This privacy notice applies to the support and services the council and its partners will be providing in response to COVID-19.

We have sought to be as transparent as possible and fully explain how your personal data is held and processed in response to COVID-19, however, the council is making decisions day-by-day in order to balance the need to maintain essential services and the need to support those who need our help the most, while at the same time following public health guidance for the protection of the public and staff against infection from COVID-19.

Examples of the reasons why we may use new or existing information are as follows:

• Manage risks to public health
• Control of infection
• Provide support and health protection
• Arrange priority shopping
• Preventing illness
• Monitoring safety
• Research and emergency planning
• Analyse patterns and trends to help us create strategies and decision-making
• Future epidemiological analysis.

This privacy notice will continue to be monitored and updated so you are advised to check this page from time-to-time.

What information do we hold and use?

When you contact us we may need to collect personal information about you and/or your family so that the appropriate support and services can be provided. The information we require from you may include personal data and special categories of personal data, such as the following:

• Contact details – name, address, email address, telephone number, etc
• Date of Birth
• Next of kin details
• NHS number or other identification numbers
• Date of travel/last visit to high-risk countries
• Health details relating to your physical and/or mental health
• Financial details for purposes of receiving and/or making payments
• Housing Information relating to your council tenancy
• Details of whether you hold a drivers’ licence
• Details of whether you have a current Disclosure and Barring Service (DBS) check.

It will only be necessary to collect this type of information where it is of relevance to the support and services you require. Any information we collect about you will be strictly in accordance with the Data Protection law. 

On what grounds do we use the information?

Our lawful basis under GDPR when using your information in response to COVID-19 are as follows:

• Processing is necessary for compliance with a legal obligation
• Processing is necessary in order to protect the vital interests of you or of another person
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority
• Processing is necessary for reasons of public interest in the area of public health.

If there is a significant threat to the health of the public, for instance, an outbreak of infectious disease, the council has the legal right to use identifiable data under Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

The council also has a statutory requirement to process confidential patient information which is contained in the NHS List Local Authority Data Flow for purposes set out in Regulation 3(1) of the Health Service Control of Patient Information Regulations 2002 (COPI) under the notice dated 20th March 2020 issued to them by the Secretary of State for Health and Social Care under Regulation 3(4) of COPI (the COPI Notice) until 20th September 2020.

Volunteers are being managed by the SMILE Foundation.  With your consent we will pass your details to SMILE if you contact us so they can make arrangements for you to volunteer.  More information about SMILE can be found on their website - http://heysmilefoundation.org

You can revoke your consent at any time by contacting the council.

How do we collect this information?

The information we receive about you can be given to us directly by you, a family member or in some cases can be shared with us by another organisation due to the council having a role in a service they are providing. This includes organisations such as:

• East Riding Community Hub
• National and local NHS bodies
• The Office for National Statistics
• NHS Digital
• Ministry of Housing, Communities and Local Government
• Utility companies
• Humberside Fire and Rescue Service
• Humberside Police
• Local Voluntary Partners
• Other local authorities
• Schools.

Who we share your information with?

If we are required to, we will share your information with internal departments and other service providers, contractors and/or partner bodies, but only where it is necessary and for the purposes outlined above.  These bodies include, but are not limited to:

• Public Health England
• NHS
• GP practices
• Other Local Authorities
• Local Voluntary Sector Partners
• Emergency Services
• Care providers
• Contracted suppliers who have been procured to provide support and services to our residents.
• DEFRA

We will strive to ensure that any personal data in our care will be kept safe and that where your information is disclosed to a third party that they ensure to do the same.

How long do we store it and is it secure?

We will only retain your data for no longer than necessary for the purposes outlined above. This means that in many cases we will destroy the data securely once the COVID-19 pandemic has been dealt with.

The council’s IT security and confidentiality policies ensure that your information is protected, and available only to staff directly involved in your care.  

Details of how we keep your information secure are available on the general privacy information page. 

What rights do you have?

The rights that you have depend upon the grounds upon which we collected your information. All of the rights you could have are outlined on the data protection rights page. In most cases information processed in relation to COVID-19 will be covered by the following rights:

• The right of access - You are entitled to see the information the service holds about you and can request a copy by emailing: data.protection@eastriding.gcsx.gov.uk 
  
• The right to rectification - If you believe any information the service holds about you to be incorrect please email:  covid@eastriding.gov.uk and we will amend the information accordingly.
• The right to object - In addition to the right to limit the use of your data, you also have a right to object to the use of your data for certain actions, please email covid@eastriding.gov.uk.

Where can I find out more?

If you want to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Contact details are available on the general privacy information page. 

Alternatively, you can contact the Information Commissioner’s Office.