Coronavirus – Supplementary Privacy Notice for our service users

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

This notice describes how we may use your information to protect you and others during the Covid-19 outbreak. This supplements our main Privacy Notice.

In these difficult times, we are working very closely with our partners with central government, health and care providers and other partner organisations who are helping to deliver the vital care and support to our local communities. This means that we will need to receive and share personal information about our residents.

This notice provides information about what kind of personal information that may be, what we may do with it and who may have access to it.

We will use the information we collect to deliver a number of services, which may include:

  • Identifying those in higher risk groups to offer them support such as food collection, medical collection and deliveries
  • The provision of social care and support
  • The provision of health and/or mental health support
  • Awareness and advice
  • Enabling plans to be made to support children returning to school
  • Facilitating safe and controlled access to Lancashire County Council premises both for service users and our employees.
  • Working with the NHS and other system partners to complete recovery work following the restart of the Continuing Health Care Framework, from 1st September 2020.

This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.

Purposes for processing – Interaction with Lancashire County Council services and premises

When visiting Lancashire County Council premises, we may ask that you provide us with personal data prior to your visit and at the point at which you visit our buildings.

This is to ensure the safety and security of visitors and our employees. We will always ensure the safety and security of any personal data we process for these purposes.

During this period of emergency, services may be provided or offered to you via video conferencing in an effort to reduce the risks associated with face-to-face contact. Where such services are offered, Lancashire County Council will ensure that your personal data is processed lawfully and your personal data is handled securely.

Purposes for processing - Test and Trace personal data processing

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, some Lancashire County Council premises have been mandated by law to collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing.

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the coronavirus.

As a customer/visitor to Lancashire County Council premises where this is a requirement, you will be asked to provide some basic information and contact details. The following information will be collected:

  • the names of all customers or visitors
  • a contact phone number for each customer or visitor
  • date of visit and arrival time and departure time

Lancashire County Council as the data controller for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information. When that information is requested by the NHS Test and Trace service, the service would at this point be responsible for compliance with data protection legislation for that period of time.

The NHS Test and Trace service as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the venue/establishment, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.

In addition, if you only interact with one member of staff during your visit, the name of the assigned staff member will be recorded alongside your information.

NHS Test and Trace have asked us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them.

For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of customer details for a particular time period (for example, this may be all customers who visited on a particular day or time-band, or over a 2-day period).

We may require you to pre-book appointments for visits or to complete a form on arrival.

Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing, it will be destroyed by us 21 days after the date of your visit.

However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name, date of birth and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.

LAMP Covid-19 Testing

The Department of Health and Social Care has appointed Lancashire Teaching Hospitals NHS Foundation Trust as hosts of the Lancashire and South Cumbria Pathology Collaborative, to establish a regional COVID-19 LAMP saliva testing hub to enable the carrying out of LAMP saliva testing for staff in participating NHS and non-NHS organisations across Lancashire and South Cumbria.

Lancashire County Council is supporting these efforts and is acting as a provider of this kind of testing. Lancashire County Council staff will be involved in the testing process and in collecting personal data from you as part of this process. We will always process the minimum personal data required for this purpose and will ensure the security and confidentiality of your personal data at all times. Further information regarding this programme and the processing of your personal data .

Covid Winter Grant Scheme

Lancashire County Council may process your personal data for the purposes of administering the Covid Winter Grant Scheme. Where we have a requirement to do so we will maintain the security and confidentiality of your personal data at all times and adhere to Data Protection legislation.

Lancashire County Council from May 2021 is utilising an external partner organisation to facilitate the distribution of vouchers for the purposes of provisioning the Covid Winter Grant Scheme. Where this takes place, your personal data will be handled in a way that ensures its security and confidentiality at all times.

Purposes for processing – Planning mental health support to young people

The County Council is working with the University of Bristol to better understand the impact of the Covid-19 pandemic on the mental health of children and young people in the care of the local authority, and to inform the development of support and services needed by young people.

During this period, a survey will be sent to a sample of young people in care so that, if they chose to do so, they can share some of their experiences.  The survey will be issued by Lancashire County Council but minimal information such as a unique identifier will be shared with the University of Bristol so that analysis can be undertaken of the responses

Participation in the survey is entirely voluntary and individual-level data from the surveys will not be shared with the county council except in any instances where any serious safeguarding concerns are raised in the children’s survey responses; the research team will then notify the local authority of the ID number of the child or young person concerned.

Young people participating in the research will be anonymous to the research team and no child in care in any local authority will be identifiable to the research team with this information.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(d) Vital Interests: the processing is necessary to protect someone's life.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

(f) Legitimate Interests: pursued by the controller or by a third party.

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(a) The data subject has given explicit consent to the processing of this personal data.

(c) Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

(g) Processing is necessary for reasons of substantial public interest.

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

(i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.

When relying on the above Article 6 and Article 9 lawful basis for processing personal data, we do so by virtue of the following legislation where applicable:

We have a duty to protect and improve the well-being of our residents under laws like the Local Government Act 1972, the Public Health Act 1984, the Children Act 1989 and the Care Act 2014.

There may also be circumstances where we rely on the Health Protection (Coronavirus) Regulations 2020 and the Inquiries Act (2005) for the processing of personal data where it is necessary to do so. This may be linked to Lancashire County Council's response to the Covid-19 public inquiry.

We also have powers under the Civil Contingencies Act 2004, which allows personal/sensitive information to be used where it is necessary to protect the vital interests of individuals, where either consent cannot be given or cannot reasonably be expected to be obtained. Vital interests do not just mean ‘life or death’ but also situations where there is a risk of significant harm to life and relate to emergency operations where individuals lives are potentially at risk.

The Government has issued advice on the sharing of data, they have also provided a link to frequently asked questions about the law.

The Information Commissioners Office and the National Data Guardian have released statements on the use of Health and Social Care data at this time.

For the administering of the Covid Winter Grant Scheme we rely on the Local Government Act 2003 section 31 (3) and Section 31 (4)

Recipients of the data

We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and best service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.

This means that we will only share information where is it necessary and proportionate to delivering care and support. We will share information with and receive information from the list below:

  • Department for Health
  • Department for Education
  • NHS
  • Our local NHS Trusts
  • Hospitals
  • GPs and our local Clinical Commissioning Group (CCG)
  • Local authorities in Lancashire including city and district councils
  • Voluntary sector providers
  • Health and care providers that we work with
  • Schools/colleges
  • County, city, district and parish councillors who will support our efforts across the county in their roles
  • Third party providers for the purposes of administering grant scheme programmes
  • Research institutions (using anonymised data only or where a clear lawful basis exists to do so)

This is not an exhaustive list and may change as the situation does.

Information we share

The kind of personal information we may process are names, age, household composition, addresses and contact details (email, phone numbers, mobile numbers and social media contacts).

We may also process special category around health and care needs to help us identify and provide the support to those who most need it.

We may also ask you for details of your ethnicity, current employment and recent contacts.

The information we collect is recorded on our existing platforms or dedicated databases on the councils’ secure networks where it is accessible only to staff who need to see it to deliver services to support our work around COVID-19.

Any transfers to another country

  • No

Retention periods

We will only keep your information for as long as it is necessary, taking into account of Government advice and the on-going risk presented by Coronavirus.

Health information provided by you in relation to this outbreak of Coronavirus will not be used for any other purpose unless there is a clear lawful basis to do so.

When the information is no longer needed for this purpose, it will be securely deleted.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ 

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

Further details regarding Lancashire County Council's wider Coronavirus response.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO). 

Page 2 of 14