How we may use your personal data during the COVID-19 crisis

This notice describes how Devon County Council (DCC) may use your personal data during the COVID-19 outbreak. It supplements our existing privacy notices which are published on the Council’s website.

If we process your personal data during the COVID-19 crisis to enable us to deliver essential services to you or to help keep you or the public safe, we will be doing so as a Data Controller under data protection laws. Should you wish to find out more about DCC’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated on 17 April 2020. If we use your personal data for any new purposes, this notice will be updated and any changes will be communicated to you, where necessary, in accordance with current data protection laws. Any queries relating to this privacy notice should be addressed to DCC’s Data Protection Officer.

What information might we collect

During the COVID-19 pandemic, it may be necessary for DCC to process the following information about you:

Your name
Your address
Your contact details such as telephone number, email address etc.
Your NHS Number and or any other form of unique identification number
Information concerning your health
Information about any risks that may have been identified by us or by our partners that concerns you and your family
Information regarding your vulnerability to COVID-19 and whether you are self-isolating
Information regarding the support and care that you need to address any risks posed to you from COVID-19

How we may use your personal data during the COVID-19 pandemic

Health and social care organisations are facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak and the risks associated with it.

In the current emergency, it has become even more important to record and share health and care information across the health and social care system to enable health and care risks to be identified quickly, so that timely interventions can be prioritized and targeted to those in most need.

For the duration of the COVID-19 pandemic, DCC intends to record the NHS Number for all children on our Education and Social Care Systems, in order to allow us to match essential data that is shared by the NHS with us for safeguarding purposes.

This is considered essential to ensure that risks associated with children and their families are identified and mitigated quickly, whilst children are not in school. The NHS Number will be stored separately to our Education and Social Care data in a secure database, with access strictly controlled.

During this period of emergency, opt-outs will not generally apply to the data used to support actions to respond to the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. Where data is used and shared under these laws your right to have personal data erased will also not apply.

DCC may also process your personal data if you are the next of kin for somebody who has died of COVID-19. If we need to process your personal data for this purpose, we will handle your data in accordance with our COVID-19 Deceased Booklet privacy notice.

The legal basis for us collecting your personal data

Laws such as the Heath Services (Control of Patient Information) Regulations 2000 are being used by Health and Social Care bodies to enable the recording and sharing of confidential patient information that is necessary to identify risks and control the outbreak of COVID-19.

If DCC needs to process your personal data during the COVID-19 pandemic to enable us to discharge our obligations to keep you and or the public safe, we will rely upon the lawful conditions for processing provided under the following articles of the General Data Protection Regulation:

Article 6(1)(e) – Performance of a public task that is carried out in the public interest
Article 9(2)(h) – Processing that is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis that enables us to use this data. Further information is available on GOV.UK and some FAQs on this law are available.

We will also be required to share personal/confidential patient information with health and care organisations, and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

Ther is more information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response.

In such circumstances where you tell us you’re experiencing COVID-19 symptoms we may need to collect specific health data about you. If we need to do so, we will not collect more information than we require, and we will ensure that any information collected is treated with the appropriate safeguards.

Who might we share your information with?

In order to look after your health and care needs, we may need to share your confidential patient information including health and care records with clinical and non-clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111.

We may also use your contact details to send public health messages to you or to contact you about whether you require urgent care or support during the pandemic. This contact may be by phone, text or email.

How we will keep your information secure

During this period of emergency, we may offer you a consultation via telephone or video- conferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.

NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

How long will we hold your personal data?

If we need to process your personal data for any of the purposes outlined in this privacy notices, we will retain this information for no longer than is necessary. Any personal data will be retained in line with our record retention schedule.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them.

Automated decisions

DCC does not intend to take any automated decisions in respect of any personal data that is processed for the purposes stated in this notice.

International transfers

DCC does not intend to transfer your personal data to any countries outside of the territorial scope of UK data protection laws unless the transfer is required for the purposes of protecting your vital interests or is necessary for the purposes of protecting public health. If we are required to transfer your personal data to such countries, we will ensure that appropriate safeguards are in place to ensure compliance with data protection laws.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the data protection laws in the UK. Their contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Online: ico.org.uk/make-a-complaint