Coronavirus (COVID-19) Privacy Notice

Local authorities and mayoral and combined local authorities have responsibilities for protecting the health of their residents.

This privacy notice is to explain and provide you with information on how we continue to collect and hold information about you as a result of the Coronavirus pandemic (COVID-19).

You can view the general Bradford Council Privacy Notice which contains more information on how we collect, use and protect personal data generally, as well as your rights as a data subject.

What information do we collect and how will we use it?

We only collect and share the minimum amount of personal information required when providing you with assistance and support. This includes but is not limited to the following:

• information about you - this could include your name, address, date of birth
• national identifiers - such as NHS number, National Insurance number
• financial information - such as your benefit entitlement
• information about your family and social circumstances
• physical or mental health details (where appropriate)
• social care support/involvement

We get most of this information from you, but we may also get some of this data from:

• central government agencies
• other local authorities
• health and social care providers
• police and probation services
• members of the public (referrer)
• commissioned partners
• family members
• local charities and other community support groups

The data shall be processed for the following purposes:

• To deliver appropriate services to ensure the health and well-being of the public and to plan and improve future services.
• To identify and safeguard individuals who are high risk and vulnerable.
• To provide information to the public, partner agencies and central Government about COVID-19.
• For research and planning in relation to COVID-19.
• To understand the risks to public health, monitor trends and to control and prevent the spread of COVID-19 and such risks.

What is the lawful basis for processing personal data?

The legal basis for processing your data is that it is in the public interest for us to deal with the outbreak of COVID-19.

The UK General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are:

Article 6(1)(d) GDPR - processing is necessary in order to protect the vital interests of the data subject or another natural person.

Recital 46 adds that "some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread".

Article 6(1)(e) GDPR – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met as follows:

Article 9(2)(i) GDPR – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Schedule 1, Part 1(3) Data Protection Act 2018 – processing is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Article 9(2)(g) GDPR - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The legislations, policies and guidance that relate to this service include, but are not limited to:

The Civil Contingencies Act 2004 and (contingency planning) Regulations 2005 Allows the local authorities continue to exercise its functions in the event of a emergency

The Local Government Act 2000 - Give powers to local authorities to promote economic, social and environmental well-being within District

Care Act 2014 - legal framework for local authorities support the individual’s ‘wellbeing’

Who are we likely to share this information with?

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. Your information may be shared with other public authorities, NHS organisations, emergency services and other relevant stakeholders.

Storing your information

We will only keep your information for as long as it necessary to do so.  As a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response. This is in line with Appendix 3 of the Records Management Code of Practice for Health and Social Care 2016.

Where possible we will anonymise your personal data so that you cannot be identified.

When the information is no longer needed for this purpose, it will be securely deleted.

What are your rights?

Please contact the Corporate Information Governance Team at dpo@bradford.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer at dpo@bradford.gov.uk  or write to: Data Protection Officer, City Hall, Centenary Square, Bradford, BD1 1HY.

The UK GDPR also gives you the right to lodge a complaint with the Information Commissioner's Office who are the supervisory authority responsible to regulate and monitor the legislative obligations within the UK and can be contacted on 03031 231113.