Your NHS number

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Your NHS Number is a number made of 10 digits that is unique to you and is used to correctly match you to your health care records. This number will appear on the majority of the official documents you receive from the NHS, including letters from your doctor, hospital appointments, results and prescriptions.

Why we need your NHS number

If you are receiving support from social care then the NHS may share your NHS number with us. This is so that the NHS and social care can use the same number to identify you whilst providing your care. By using the same number the NHS and Lancashire County Council Social Care can work together more closely to improve your care and support.

The information shared

Your NHS number is accessed through an NHS service called the Personal Demographic Service (PDS). Social Care sends basic personal information such as your name, address and date of birth to the PDS so they can find your NHS number. Once retrieved from the PDS the NHS number is stored on the Council’s Social Care system which is called Liquid Logic.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

The public task with a clear basis in law is by virtue of the following legislation:

Health and Social Care Act 2015 – places a duty on health and social care providers to share information about a person’s care with other health and care professionals. Relevant health and adult social care bodies will also be required to use a consistent identifier - the NHS Number - when processing and/or sharing information about an individual for their direct care. This will enable better connection of health and care records as people move between services, so relevant information is shared, meaning safer and better aligned care.

Care Act 2014

Sections 2 and 3: Local Authorities must exercise their functions with a view to ensuring the integration of care and support where it would promote the wellbeing of adults, contribute to prevention or delay of care or support for carers and adults. The NHS Number is used to match information across health and care. It terms of this application this would only be for people receiving direct care from both health and social care.

Section 6: Local Authority must cooperate with each of its relevant partners in the exercise of functions relating to adults and carers. The NHS Number is used to share information to support the effective care coordination of individuals.

Section 25: Local Authority must give a copy of the support plan to the carer, adult needing care and any other person to whom the carer asks the authority to give a copy. The NHS Number is used to share information to support the effective care coordination of individuals. The NHS Number is used to ensure records are not duplicated and that the information shared is accurate.

Section 27: Local Authority must keep under review care and support plans and review the plan. The NHS Number is used to ensure that the information used when reviewing care is accurate

Section 37 and 38: Local Authorities must cooperate where they receive notification that someone intends to move between Local Authority area. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Section 74: Local Authorities must comply with regard to the discharge of hospital patients likely to need care or support. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Disabled Persons Act 1986 – Section 7: Places a duty on Local Authorities to assess an individual when discharge notifications are received after a person has received treatment for a mental disorder. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Recipients of the data

Information we share

Name
Address
Date of Birth
NHS Number

Any transfers to another country

Retention periods

Lancashire County Council will add your NHS to your social care record. The type of support and care you receive from us will determine the length of time we keep your information for. We will only retain your information for as long as is legally required or in situations where there is no legal retention period we will follow established best practice. At the end of the retention period electronic data will be deleted and any physical files will be confidentially disposed of.

File type	Retention period
Children's Social Care
Adoption Agency, Non Agency and inter-Country, Adoption Welfare Supervision	100 years from date of Adoption Order
Children Looked After	Files of children who are looked after, or who cease to be looked after, before the age of 18 years, should be retained completely intact until the 18 Birthday is reached. 75 years from date of birth or if the child has died before reaching 18 years, for the period of 15 years from the date of death or when the age of 18 would have been achieved, whichever is the later. Any historic family records previously created on children who are look after for 75 years from the date of birth of the youngest child will be stored by records management team.
Child Protection Records	Records of children where child protection enquiries took place under Section 47 of the Children Act 1989, but did not lead to registration, will have a retention period of 20 years following closure of the case. If the child dies within the retention period the records remain archived for the full retention period. Records of children who have been on the Child Protection Register will have a retention period of 75 years from the date of birth of the child. . If the child dies within the retention period the records remain archived for the full retention period.
Records of children not currently looked after but subject to a legal order to the authority requiring supervision (Supervision Order or Family Assistance Order the Children Act 1989)	75 years from date of birth or if the child has died before reaching 18 years, for the period of 15 years from the date of death or when the age of 18 would have been achieved, whichever is the later.
Children’s records other than those referred to above, - cases closed after initial assessment; - children receiving Family Centre support; - other Children In Need and Family Support cases;	10 years after the case is closed
Records in respect of children in Children’s Homes as described in Schedule 4 of the Children’s Homes Regulations 2001 Amendment 2011	50 years after the child is discharged from the home The legislative retention period for these records is 15 years but Lancashire policy is to keep some of them for 50 years.
Records on persons cautioned or convicted of an offence under Schedule 1 of the Children and Young Persons Act 1933 or persons posing a risk to children.	100 years from the creation of the record.
Records of those Children who have been detained under Section 2 or 3 of the Mental Health Act 1983	20 years after no further treatment considered necessary or 8 years after the patient’s death if the patient died while still receiving treatment
Adult Social Care
Anyone who has been subject to detention under the Mental Health Act 1983 and Mental Health Act 2007 amendments	20 years after no further treatment considered necessary, or 8 years after the patient's death if patient died while still receiving treatment.
Other records of adults with a service user category of Mental Health	5 years from the date the service ceases for service users with a category of Mental Health.
Social care records relating to service users with a section 117 under the Mental Health Act 1983	Service users with a section 117 classification need to stay open indefinitely as an annual reviewable record to ensure the section 117 is still current. This will continue until a discharge notice has been actioned and approved. If S117 legal status start date + end date applied then the retention period should be 5 years from ended date.
Safeguarding - Where a safeguarding alert has been created and progressed to a safeguarding case.	10 years from date of closure.
Organisational Safeguarding Alerts (OSA) - Where there is a Safeguarding alert for an organisation such as a provider or care home, the retention period applied is 10 years from the date the case is closed.	10 years from date of closure.
4.4.2 Deprivation of Liberty (DOLs) - Deprivation of liberty safeguards form part of the Mental Capacity Act 2005 and relate to where an individual has been admitted to a hospital or residential/nursing home against their will following a best interests decision. The retention applied is 10 years from the date of closure.	10 years from date of closure.
All other service user records including, elderly, physically disabled, learning disabilities	3 years after the death of the service user; or after the case has been closed
Blind and Partially Sighted register	Indefinitely until death The local authority has a statutory duty to maintain a register of severely sight impaired (Blind) and sight impaired (partially sighted people). Records to be held 3 years after death
Deaf and Hard of Hearing register	Indefinitely until death The local authority has a statutory duty to maintain a register of citizens that are deaf or hard of hearing. Records to be held 3 years after death

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Or email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact enquiries@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).