Coronavirus – Supplementary Privacy Notice for our service users
In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Identity and contact details of the data controller
- Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
- Our Data Protection Officer is Paul Bond. You can contact him at firstname.lastname@example.org or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Purposes for processing
This notice describes how we may use your information to protect you and others during the Covid-19 outbreak. This supplements our main Privacy Notice.
In these difficult times, we are working very closely with our partners with central government, health and care providers and other partner organisations who are helping to deliver the vital care and support to our local communities. This means that we will need to receive and share personal information about our residents.
This notice provides information about what kind of personal information that may be, what we may do with it and who may have access to it.
We will use the information we collect to deliver a number of services, which may include:
- Identifying those in higher risk groups to offer them support such as food collection, medical collection and deliveries
- The provision of social care and support
- The provision of health and/or mental health support
- Awareness and advice
- Enabling plans to be made to support children returning to school
- Facilitating safe and controlled access to Lancashire County Council premises both for service users and our employees.
- Working with the NHS and other system partners to complete recovery work following the restart of the Continuing Health Care Framework, from 1st September 2020.
This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.
Purposes for processing – Interaction with Lancashire County Council services and premises
When visiting Lancashire County Council premises, we may ask that you provide us with personal data prior to your visit and at the point at which you visit our buildings.
This is to ensure the safety and security of visitors and our employees. We will always ensure the safety and security of any personal data we process for these purposes.
During this period of emergency, services may be provided or offered to you via video conferencing in an effort to reduce the risks associated with face-to-face contact. Where such services are offered, Lancashire County Council will ensure that your personal data is processed lawfully and your personal data is handled securely.
Purposes for processing - Test and Trace personal data processing
As part of the NHS Test and Trace Service's efforts to address the coronavirus, we may ask that you provide personal data when visiting LCC premises or when attending local authority community testing sites across Lancashire.
Covid Winter Grant Scheme
Lancashire County Council may process your personal data for the purposes of administering the Covid Winter Grant Scheme. Where we have a requirement to do so we will maintain the security and confidentiality of your personal data at all times and adhere to Data Protection legislation.
Category of personal data being processed
- Personal data (information relating to a living, identifiable individual)
- Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)
Legal basis for processing personal data
The legal basis for processing your personal data, in accordance with the UK GDPR is:
(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.
(d) Vital Interests: the processing is necessary to protect someone's life.
(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.
Legal basis for processing special categories of personal data
The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:
(c) Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
(g) Processing is necessary for reasons of substantial public interest.
(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
(i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.
When relying on the above Article 6 and Article 9 lawful basis for processing personal data, we do so by virtue of the following legislation where applicable:
We already have a duty to protect and improve the well-being of our residents under laws like the Local Government Act 1972, the Public Health Act 1984, the Children Act 1989 and the Care Act 2014.
We have also been given authority to process confidential patient information under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. The Secretary of State for Health and Social Care has issued a notice to the councils to enable them to do so, at present until 30 September 2021. A copy of this notice is available on the GOV.UK website.
There may also be circumstances where we rely on the Health Protection (Coronavirus) Regulations 2020 for the processing of personal data where it is necessary to do so.
We also have powers under the Civil Contingencies Act 2004, which allows personal/sensitive information to be used where it is necessary to protect the vital interests of individuals, where either consent cannot be given or cannot reasonably be expected to be obtained. Vital interests do not just mean ‘life or death’ but also situations where there is a risk of significant harm to life and relate to emergency operations where individuals lives are potentially at risk.
For the administering of the Covid Winter Grant Scheme we rely on the Local Government Act 2003 section 31 (3) and Section 31 (4) and COVID Winter Grant Scheme: Guidance for County Councils and Unitary Authorities
Recipients of the data
We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and best service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.
This means that we will only share information where is it necessary and proportionate to delivering care and support. We will share information with and receive information from the list below:
- Department for Health
- Department for Education
- Our local NHS Trusts
- GPs and our local Clinical Commissioning Group (CCG)
- Local authorities in Lancashire including city and district councils
- Voluntary sector providers
- Health and care providers that we work with
- County, city, district and parish councillors who will support our efforts across the county in their roles
This is not an exhaustive list and may change as the situation does.
Information we share
The kind of personal information we may process are names, age, household composition, addresses and contact details (email, phone numbers, mobile numbers and social media contacts).
We may also process special category around health and care needs to help us identify and provide the support to those who most need it.
We may also ask you for details of your ethnicity, current employment and recent contacts.
The information we collect is recorded on our existing platforms or dedicated databases on the councils’ secure networks where it is accessible only to staff who need to see it to deliver services to support our work around COVID-19.
Any transfers to another country
We will only keep your information for as long as it is necessary, taking into account of Government advice and the on-going risk presented by Coronavirus.
Health information provided by you in relation to this outbreak of Coronavirus will not be used for any other purpose unless there is a clear lawful basis to do so.
When the information is no longer needed for this purpose, it will be securely deleted.
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:
- to be informed via Privacy Notices such as this.
- to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
- of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
- of rectification, we must correct inaccurate or incomplete data within one month.
- to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
- to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
- to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
- to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
- in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
For further details regarding Lancashire County Council's wider Coronavirus response, please find these details at the following website,
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: email@example.com
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).