Coronavirus COVID 19 Privacy Notice
Privacy Notice for Coronavirus – COVID-19
This privacy notice explains how we will collect, use and protect personal data specifically with regard to the Coronavirus (COVID-19) pandemic.
Our Corporate Privacy Notice contains more information on how we collect, use and protect personal data generally, as well as your rights as a data subject.
You can also check our website for the latest updates on ‘Covid-19’.
You may have provided personal information to us for a specific reason and normally, we would notify you if your information was being used for a different purpose. However, due to the rapidly emerging situation regarding COVID-19, this will not always be possible.
If we already hold information regarding your vulnerability as defined in the current guidance from the Government and Public Health England, we may share this information with services both internal and/or external to us, for emergency planning purposes and/or to protect your vital interests.
We may need to ask you for personal information, including sensitive personal information that you have not already supplied - for example, your age or if you have any underlying illnesses or are vulnerable. This is so we can assist you and prioritise our services.
If we have information indicating that you are vulnerable, we may contact you to ensure your safety and to assist you where possible.
If you are a volunteer, we use your personal information to enable us to communicate with you in order to provide ‘Dartford Together’1. If you are using ‘Dartford Together’, we use your data to enable our volunteers to support you during the COVID-19 pandemic and to keep you in contact with vital services.
If you apply for 'Kent Together' community support, we will use the information passed onto us by Kent County Council, so that we can arrange the required assistance, as applicable, for you.
Processing activity - we may process personal information relating to:
- NHS patient data - to be used by us to cross-reference with our daily ‘Incoming’ shielding data, to determine if patients are known to us as vulnerable
- Incoming Local Authority Dataset (collected centrally by the Government Digital Service) - provided to us on an ongoing basis for the specific purpose of enabling us to ensure required support gets to those identified as extremely vulnerable in our area - the delivery of the Extremely Vulnerable Persons Service
- 'Dartford Together' Register of Volunteers
- the delivery of Kent County Council's 'Kent Together'
- communications from us to you, to help us match requests for volunteer support with people in our community able to help
Information requirements - our processing activities may include:
- contact details (email and telephone number)
- date of birth
- medical history and GP contact details
- health indicators (mental health status, physical activity status)
- names and contact details for members of your family and support network
- information about your support needs
- Unique IDs
Lawful bases2 - our lawful bases for processing your personal information are:
- where processing is necessary in order to protect the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR);
- where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR), pursuant to the Civil Contingencies Act 2004 and Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (exercise of functions in an emergency), Local Government Act 2000 ( the promotion of the economic, social and environmental well-being of the Borough) and the Care Act 2014 (the promotion and support of an individual’s wellbeing);
- where processing is necessary for the reasons of substantial public interest (Article 9(2)(g) GDPR);
- where processing is necessary in the interests of public health (Article 9(2)(i) GDPR).
Recital 46 of the GDPR states 'Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread..........'
Reasons for processing - some of the information that is collected and shared is classified as special category personal data (health indicators (mental health status, physical activity status). This is processed for reasons of substantial public interest under the laws that apply to us (see above) where this helps to meet our broader social obligations such as where it is necessary for us to fulfil our legal obligations and regulatory requirements during the COVID-19 pandemic. We have a Data Protection Policy that sets out how this information will be handled.
Data sharing - we will not share externally, NHS patient data. We may share NHS patient data internally (where necessary and proportionate), to allow us to cross-check which of the clinically vulnerable patients in our locality are known to us as vulnerable.
We may receive from and share your personal information with and including:
- Our service departments (where necessary and proportionate)
- Kent County Council including Adult Social Care and Health and Children’s Social Care
- Central Government
- General Practitioners, other medical practitioners
- Emergency Services/First Responders
- ‘Dartford Together’ volunteers
- Voluntary and charity sectors
- Register of volunteers
- Other stakeholders (where necessary and proportionate)
We aim to protect your privacy and confidentiality and will only share personal information where necessary to provide support.
We may rely on a number of exemptions, which allow us to share information without needing to comply with all the rights and obligations under the Data Protection Act 2018. Please refer to the Kent and Medway Information Agreement for further details on our sharing arrangements.
Retention period - we will hold your data for the duration of the COVID -19 pandemic and up to three (3) months following notification from Central Government that there is no longer a pandemic.
Anonymisation - your personal information may be converted ('anonymised') into statistical or aggregated data in such a way that ensures that you cannot be identified from it. Aggregated data cannot, by definition, be linked back to you as an individual and may be used to conduct research and analysis, including the preparation of statistics for use in our reports.
We will not sell your personal information to third parties.
Right to object - where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on ‘grounds relating to your particular situation’. We will have to demonstrate why it is appropriate for us to continue to use your personal data.
Changes to this Privacy Notice - we will review this Privacy Notice regularly and will place updates on our website.
Further information - see the Information Commissioner’s FAQs on data handling during the COVID-19 pandemic.
1 Facebook page providing updates from the Council and community partners on the Coronavirus (COVID-19) pandemic
2 Note that we may process your personal information on more than one lawful basis depending on the specific purpose for which we are using your information