Home > My Council > Data Protection > COVID-19 data protection advice and guidance

COVID-19 data protection advice and guidance


COVID-19 Advice and Guidance

Due to new COVID-19 restrictions, the Council will be focusing its resources on priority services, dealing with the Covid-19 pandemic and supporting our residents and businesses. In light of this, we are extending the time taken to provide a response to your Freedom of Information Request (FOI), Subject Access Request (SAR) and Complaints by 20 working days respectively. For SAR's and FOI's we will respond within 40 days and for complaints it’s 30 working days.

The Council will keep this under review.

If for any reason we are unable to provide the information you have requested, we will advise you why.

Self-Isolation Payments and how we will process your information

On 28 September 2020, the Government passed into law a national Test and Trace Support scheme. From 12 October, a one-off payment of £500 or access to a discretionary fund will be available for eligible individuals. More information about this scheme can be found here.

If you apply, we will need to process your personal data to assess whether you are eligible to receive financial support, and if so, to provide a payment to you.  This Privacy Notice sets out what personal data we will use, how we will use it, and why we need to, when an applicant applies for this support.

A copy of the full Privacy Notice for Self-Isolation Payment can be found here

How we will process your information

 

Advice from the Information Commissioner’s Office: 

Your personal information may not be your first thought when it comes to coronavirus, but if you’re worried, we’ve put together some information to help.

Government, the NHS and other organisations will make sure you get vital public health messages via phone, email or text. You don’t need to give them your consent. 

You might be asked to give details about sensitive health conditions and recent travel that you think are excessive. Employers and organisations do have an obligation to protect their staff, so in some cases it can be reasonable for them to ask you if you’ve visited a particular country or if you have experienced COVID-19 symptoms. But they shouldn’t be asking for more information than is necessary, and if you are concerned speak to the organisation involved.

If you become ill with COVID-19, your employer might need to tell your colleagues. But that doesn’t mean they need to give out your name.   

If you’ve made a Freedom of Information request from a public body or made a subject access request (SAR) for your own information, you should expect delays in response. That’s because organisations are diverting their resources to help with other challenges.

Our COVID-19 Privacy Statement

The Secretary of State for Health & Social Care has given notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 that the Council is required to process and share necessary health and social care data for the following purposes:

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks;
  • identifying and understanding information about patients or potential patients with or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19;
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.
  • monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services;
  •  delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
  • research and planning in relation to COVID-19

The council has a duty to ensure that we provide public services to all our most vulnerable residents, therefore, proactively engage with those residents who are being shielded to support them in accessing these services. We may contact them from time to time to proactively engage with those residents who are vulnerable and/or shielded to support them in accessing these services to ensure their health and safety is not compromised in any way.

Additional information - updated 23 May 2020

This notice describes how we may use your information to protect you and others during the COVID-19 outbreak. It supplements our main Privacy Notice which is available here.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations.

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak.

Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; Arm’s Length Bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on gov.uk here and some FAQs on this law are available here.

During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak. 

In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non-clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111.

We may also use the details we have to send public health messages to you, either by phone, text or email.

During this period of emergency we may offer you a consultation via telephone or video-conferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.

We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. 

Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response is here

NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

In such circumstances where you tell us you’re experiencing COVID-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

We may amend this privacy notice at any time so please review it frequently.

Test and Trace for Coronavirus

Keeping you safe from coronavirus – privacy notice

July 2020 (updated September 2020)

This privacy notice explains how Rutland County Council (as Data Controllers) will collect, use and protect personal data specifically with regards to the coronavirus pandemic.

Personal information is shared across organisations for the purpose of responding to the critical public health crisis in respect of the COVID-19 pandemic. The personal data in respect of this service is processed for three purposes, these are to:

  • Test – the testing of key health and social care workers, other critical workers, members of their household and citizens at Community Testing Units, Mobile Testing Units and/or at home.
  • Trace – using results of confirmed cases to make contact with individuals and identify details.
  • Protect – enhancing the public health surveillance and response system to enable the prevention of infection and the tracking of the virus as restrictions are eased. 

What is the legal basis for our use of your personal information?

Most of the personal information we process is provided to us directly by you, under the General Data Protection Regulation (GDPR), the lawful bases we rely on for using your personal information are:

  • GDPR Article 6 (e) we need it to perform a public task. When we collect data about your health, we also rely on the following lawful basis:
  • GDPR Article 9 (2) (h) Provision of preventative or occupational medicine, health or social care or treatment, or the management of health or social care systems.
  • GDPR Article 9 (2) (i) Public Health.
  • Data Protection Act 2018 – Schedule 1, Part 1, (2) (2) (f) – Health and social care purposes.
  • Data Protection Act 2018 – Schedule 1, Part 1, (3) (a) – necessary for reasons of public interest in the area of public health.

Information collected:

  • Name
  • Address
  • Email address
  • Telephone number

Agencies we might share the information with:

  • National Health Service (NHS)
  • Public Health England (PHE)
  • Other Council Services
  • Leicester City Clinical Commissioning Group
  • West Leicestershire Clinical Commissioning Group
  • East Leicestershire and Rutland Clinical Commissioning Group

How long will your information be kept:

  • Information will be stored securely for 21 days and then destroyed securely.

September 2020 - update - NHS Codiv-19 app

The launch of the new NHS Covid-19 app on September 24 2020 will allow customers to scan a QR code with their smart-phone to register their attendance at venues. The Council is required to make the QR code available to you to register with the National NHS Test and Trace Scheme.  

Your rights:

Under data protection law, you have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information.
  • Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
  • Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
  • You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

How to complain if you are unhappy about how your data is used:

You can complain directly to the Council directly to: Data Protection Officer – dataprotection@rutland.gov.uk

You also have the right to complain to the Information Commissioner’s

Office using the following details:

Information Commissioner's Office (ICO), The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Further advice and guidance from the ICO on this issue can be found here.


Was this information helpful?
Was this information helpful?
Was this information helpful?