Public Health Intelligence

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service:

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:

Public Health Intelligence
Business Intelligence
PO Box 78
County Hall
Preston
PR1 8XJ

Email: BusinessIntelligence.publichealth@lancashire.gov.uk

Reasons for processing your personal data

Local authorities have a duty to improve the health of the population they serve. To help with this, our Public Health Intelligence team in Business Intelligence use data and information from a range of sources, including information collected at the registration of a birth or a death and information about hospital activity. Lancashire County Council has Data Sharing Agreements with NHS England and data are supplied in accordance with section 261 of the Health and Social Care Act 2012.

We use this data and information to fulfil our statutory public health functions. This helps us to understand more about the health and care needs of our local population. By using the data to measure the health, mortality, morbidity and care requirements of our population we can effectively plan public health initiatives to protect and improve the health of the citizens of Lancashire.

We act as a data processor and as a data controller. This means that we collect and process personal information and data. We also comply with the NHS England's information governance standards allowing us access to NHS England services.

There is an external organisation contracted to process data on behalf of the council, under strict contractual and data protection controls (e.g. Microsoft Azure).

Types of information we use:

We work with many types of data to be able to promote health and support improvements in the delivery of health and care services in Lancashire. This includes the processing of:

Personal data: information relating to a living, identifiable individual

Identifiable data: data that can identify individuals, but which does not meet the definition of 'personal data', as defined in Article 4 (1) UK GDPR, in that the data relates to deceased individuals

Pseudonymised data: personal identifiable data is replaced with artificial identifiers for Public Health staff to use the information without being able to identify any individuals.

Anonymised data: information about individuals that has all identifying details removed

Aggregated data: this is where all anonymised data is grouped together, and it is not possible to identify individuals

We hold the following data collections that contain various types of data about individuals and populations:

Hospital Episode Statistics (HES)

Data supplied are pseudonymised, a process by which information within a data record that may identify an individual are replaced by artificial identifiers, or pseudonyms which means that individuals are no longer identifiable. Information held includes age, method of admission, source of admission, diagnosis codes, procedure and investigation codes, area of residence, hospital attended, date of attendance, and GP practice of patient.

HES data are accessed via an NHS England hosted secure environment and do not contain person identifiable data. Aggregation of HES data is usually performed in the secure environment. Any downloaded pseudonymised data are stored on Lancashire County Council's secure network and access is restricted to two named members of staff. We do not hold identifiable hospital activity data. Any downloaded pseudonymised data are immediately deleted after aggregated analysis has been undertaken. Only aggregated information is shared further.

Primary Care Mortality Database (PCMD)

The PCMD provides access to identifiable mortality data as provided at the time of the registration of the death, along with the additional general practice details, geographical indexing and coroner details where applicable. Access to the PCMD is based upon geographical boundaries as an Upper Tier Local Authority and Clinical Commissioning Group within Lancashire. The mortality data are managed by NHS England and downloaded through NHS England's Secure Electronic File Transfer System. Information held includes but is not limited to date of birth, date of death, place of death, address of deceased, causes of death, age, sex, GP and practice, place of birth country

Births dataset

This dataset provides access to identifiable data about the number of births that occur within the geographical boundary as an Upper Tier Local Authority and Clinical Commissioning Group within Lancashire. Individual records of births include address, place of birth, postcode of usual residence of mother, postcode of place of birth of child, NHS number of child, date of birth of child. Names of mothers and babies are not recorded.

These data are supplied to Lancashire County Council by NHS England under strict licence and data disclosure controls. The births data are downloaded through NHS England's Secure Electronic File Transfer System.

Use of artificial intelligence (AI) technologies

We do not use AI technology to process or analyse HES, PCMD and births datasets.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.

Official authority is vested in the controller by virtue of:

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by Section 287 of the Health and Social Care Act (2012); and

Regulation 3 of the Health Service (Control of Patient Information) Regulations (2002)

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:

(i) Processing is necessary for reasons of public interest in public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.

Official authority is vested in the controller by virtue of:

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by Section 287 of the Health and Social Care Act (2012); and

Regulation 3 of the Health Service (Control of Patient Information) Regulations (2002)

Legal basis for processing criminal offence data

Criminal offence data is not processed for this purpose.

Information we process about you

Lancashire County Council does not process personal data by automated means.

Personal data (information relating to a living, identifiable individual)

  • Name
  • Date of birth
  • Address/Postcode
  • Next of Kin
  • NHS Number
  • Name of certifier

Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

  • Health /Medical diagnosis data

Recipients of the personal data that we process about you

Lancashire County Council Public Health Intelligence team shares or provides access to personal data only where it is necessary to fulfil statutory public health functions and in compliance with UK GDPR and NHS England information governance standards. Recipients include:

  1. Lancashire County Council Public Health Intelligence Team
    • Authorised staff within the Public Health Intelligence team who require access to data for analysis and reporting purposes. Access is strictly controlled and limited to named individuals.
  2. NHS England
    • As the provider of data sources such as Hospital Episode Statistics (HES), Primary Care Mortality Database (PCMD), and Births datasets. NHS England manages these datasets and provides them under strict licence and disclosure controls.
  3. Secure Data Transfer Systems
    • NHS England’s Secure Electronic File Transfer System and NHS England hosted Secure Environment are used for the secure transmission and processing of pseudonymised or identifiable data.
  4. Other Internal Council Teams (where necessary)
    • Limited sharing with other Lancashire County Council teams involved in statutory public health duties, under strict access controls and data sharing agreements.
  5. External Organisations (where legally required or permitted)
    • For example, with the Office for Health Improvement and Disparities (OHID) or other public health bodies, where sharing is necessary for public health surveillance, planning, or statutory reporting. Any sharing is governed by data sharing agreements and legal requirements.
  6. Data Processors acting on behalf of Lancashire County Council
    • Approved third-party service providers who support secure storage or processing of data under contract and in compliance with UK GDPR (e.g. Microsoft Azure).

Any transfers to another country

  • No

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description Security Retention period
Database Hospital Episode Statistics (HES) Any downloaded pseudonymised data are stored on Lancashire County Council's secure network and access is restricted to two approved users agreed with NHS England. All downloaded pseudonymised data are destroyed upon completion of the aggregated analysis. Where downloaded aggregated data is suppressed in line with the HES analysis guide, such data may be retained beyond the period of the agreement.
Database Public Health Mortality Database (PCMD) Stored securely on LCC network and accessible only by 2 named officers Held locally until no longer required and then securely deleted. Data is only retained with an extant DSA with NHS England in place.
Dataset Births dataset Stored securely on LCC network and accessible only by 2 named officers Held locally until no longer required and then securely deleted. Data is only retained with an extant DSA

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).