Coronavirus – Supplementary Privacy Notice for our employees

Privacy Notice Coronavirus – Supplementary Privacy Notice for our employees

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

• Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

• Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

This notice describes how we may use your personal data to protect you and others during the Covid-19 outbreak. It supplements our main privacy notice, which is available here,

This privacy notice is to make it easier to understand and provide you with more information about how Lancashire County Council may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

Lancashire County Council may seek to collect and process your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be collected from its employees and their dependents, to ensure their safety and well-being.

Such personal data will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government and health professionals, in order to manage and contain the virus. It will enable the Council to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.

Where the information is to be used to make organisational decisions, steps will be taken to anonymise the data and general statistics/numbers used, wherever possible.

Employee personal data would be collected to enable the Council to identify any staff (or those closely linked to staff/dependents) who are in any of the high-risk categories and would be considered vulnerable, if infected with Coronavirus.

As part of the vaccination roll-out process, we are asking our employees to record their vaccination status. We are doing so to ensure the safety and wellbeing of both the employees themselves as well as that of our service users. Lancashire County Council may also ask employees to voluntarily provide the reason for non-vaccination. This is done for the purposes of informing our efforts to encourage take-up of the vaccination.

Category of personal data being processed

1. Personal data (information relating to a living, identifiable individual)
2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(d) Vital Interests: the processing is necessary to protect someone's life.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

The lawful basis that is applied will depend on individual circumstances.

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(b) Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

(c) Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

(g) Processing is necessary for reasons of substantial public interest.

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

(i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.

The lawful basis that is applied will depend on individual circumstances.

When relying on the above Article 6 and Article 9 lawful basis for processing personal data, we do so by virtue of the following legislation where applicable:

We have a duty to protect the wellbeing of our employees under laws like the Health and Safety at Work Act 1974.

There may also be circumstances where we rely on the Health Protection (Coronavirus) Regulations 2020 and the Inquiries Act (2005) for the processing of personal data where it is necessary to do so. This may be linked to Lancashire County Council's response to the Covid-19 public inquiry.

The Government has issued advice on the sharing of data. 

The Information Commissioners Office and the National Data Guardian have released statements on the use of Health and Social Care data at this time.

Recipients of the data

The council may need to share this information with organisations such as:

• Central government
• Health authorities
• Relevant partner organisations

Information we share

For these purposes, the Council may collect:

• Name and contact details
• Current job role and responsibilities
• Medical information, age or any other personal information which would mark a vulnerability to the virus
• Recent history of contacts with other individuals whilst at work or with service users; or any other personal information which could help prevent or trace transmission of the virus
• Any other personal information which the council is asked to be collected by the relevant health or government authorities to mitigate the risks associated with Coronavirus (Covid-19) this includes health risks, economic risks and social risks
• Vaccination status

Any transfers to another country

• No

Retention periods

We will only keep your information for as long as it is necessary, taking into account of Government advice and the on-going risk presented by Coronavirus.

Health information provided by you in relation to this outbreak of Coronavirus will not be used for any other purpose.

When the information is no longer needed for this purpose, it will be securely deleted.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

• to be informed via Privacy Notices such as this.
• to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
• of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
• of rectification, we must correct inaccurate or incomplete data within one month.
• to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
• to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
• to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
• to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
• in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

For further details regarding Lancashire County Council's wider Coronavirus response, please find these details at the following website,

https://www.lancashire.gov.uk/health-and-social-care/your-health-and-wellbeing/coronavirus/

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).