Coronavirus COVID 19 Privacy Notice
Privacy Notice for Coronavirus – COVID-19
This privacy notice explains how we will collect, use and protect personal data specifically with regard to the Coronavirus (COVID-19) pandemic.
Our Corporate Privacy Notice contains more information on how we collect, use and protect personal data generally, as well as your rights as a data subject.
You can also check our website for the latest updates on ‘Covid-19’.
You may have provided personal information to us for a specific reason and normally, we would notify you if your information was being used for a different purpose. However, due to the COVID-19 situation, this will not always be possible.
If we already hold information regarding your vulnerability as defined in the current guidance from the Government and Public Health England, we may share this information with services both internal and/or external to us, for emergency planning purposes and/or to protect your vital interests.
We may need to ask you for personal information, including sensitive personal information that you have not already supplied - for example, your age or if you have any underlying illnesses or are vulnerable. This is so we can assist you and prioritise our services.
If we have information indicating that you are vulnerable, we may contact you to ensure your safety and to assist you where possible.
If you are a volunteer, we use your personal information to enable us to communicate with you in order to provide ‘Dartford Together’1. If you are using ‘Dartford Together’, we use your data to enable our volunteers to support you during the COVID-19 pandemic and to keep you in contact with vital services.
If you apply for 'Kent Together' community support, we will use the information passed onto us by Kent County Council, so that we can arrange the required assistance, as applicable, for you.
In order to contain clusters or outbreaks of Covid-19 and to assist NHS Test and Trace, if you (customer, visitor or staff) are accessing one of our buildings e.g. Civic Centre, Museum, community centres etc. we will ask you for specific information that has been set out in government guidance (see below).
NHS Test and Trace will ask for these records only where it is necessary, either because someone who has tested positive for COVID-19 has listed our premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.
Processing activity - we may process personal information relating to:
- 'Dartford Together' Register of Volunteers
- the delivery of Kent County Council's 'Kent Together'
- communications from us to you, to help us match requests for volunteer support with people in our community able to help
- closure orders
Information requirements - our processing activities may include:
- contact details (email and telephone number)
- date of birth
- medical history and GP contact details
- health indicators (mental health status, physical activity status)
- names and contact details for members of your family and support network
- information about your support needs
- Unique IDs
NHS Test and Trace– in relation to customers and visitors, we will record:
- the name of the customer or visitor. If there is more than one person, we will record the name of the ‘lead group member’ and the number of people in the group;
- a contact phone number for each customer, visitor or ‘lead group member’;
- date of visit, arrival time and where possible, departure time for each customer, visitor and ‘lead group member’;
- if a customer, visitor or ‘lead group member’ interacts with a member of staff, the name of the staff member will be recorded alongside that of the customer, visitor or ‘lead group member’.
In relation to staff, we will record:
- the names of staff who work at the premises;
- a contact phone number for each member of staff;
- the dates and times that staff are at work.
Lawful bases2 - our lawful bases for processing your personal information are:
- where processing is necessary in order to protect the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR);
- where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR), pursuant to the:
- Local Government (Miscellaneous Provisions) Act 1976 - recreational facilities
- Public Libraries and Museums Act 1964 - maintenance of museums and galleries
- Health and Safety at Work etc. Act 1974 - employer’s general duties to staff and persons other than staff
- Health Service (Control of Patient Information) Regulations 2002 - includes dissemination of confidential patient information to persons and organisations permitted to process confidential patient information under Regulation 3(3) of the Control of Patient Information Notice (COPI) – as required for a Covid-19 purpose and processed solely for that Covid-19 purpose in accordance with Regulation 7 of COPI
- Civil Contingencies Act 2004 and Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 – exercise of functions in an emergency
- Business and Planning Act 2020 - pavement licences
- Health Protection (Coronavirus, Restrictions) (No. 2) (England) Regulations 2020 – enforcement (closure of premises and businesses during the emergency)
- Health Protection (Coronavirus, Restrictions) (England) (No. 3) Regulations 2020 – powers to restrict movement in relation to certain premises, events and open public spaces (as directed by Kent County Council)
- where processing is necessary for the reasons of substantial public interest (Article 9(2)(g) GDPR).
Recital 46 of the GDPR states 'Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread..........'
Reasons for processing - some of the information that is collected and shared is classified as special category personal data (health indicators (mental health status, physical activity status). This is processed for reasons of substantial public interest under the laws that apply to us (see above) where this helps to meet our broader social obligations such as where it is necessary for us to fulfil our legal obligations and regulatory requirements during the COVID-19 pandemic. We have a Data Protection Policy that sets out how this information will be handled.
Data sharing - We may receive from and share your personal information with and including:
- Our service departments (where necessary and proportionate)
- Kent County Council including Adult Social Care and Health and Children’s Social Care
- Central Government
- General Practitioners, other medical practitioners
- Emergency Services/First Responders
- ‘Dartford Together’ volunteers
- Voluntary and charity sectors
- Register of volunteers
- Healthy Living Centre Dartford
- Other stakeholders (where necessary and proportionate)
- NHS Test and Trace
We aim to protect your privacy and confidentiality and will only share personal information where necessary to provide support.
We may rely on a number of exemptions, which allow us to share information without needing to comply with all the rights and obligations under the Data Protection Act 2018. Please refer to the Kent and Medway Information Agreement for further details on our sharing arrangements.
Retention period - we will hold your data for the duration of the COVID -19 pandemic and up to three (3) months following notification from Central Government that there is no longer a pandemic. Our NHS Test and Trace log will be maintained for 21 days.
Anonymisation - your personal information may be converted ('anonymised') into statistical or aggregated data in such a way that ensures that you cannot be identified from it. Aggregated data cannot, by definition, be linked back to you as an individual and may be used to conduct research and analysis, including the preparation of statistics for use in our reports.
We will not sell your personal information to third parties.
Right to object - where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on ‘grounds relating to your particular situation’. We will have to demonstrate why it is appropriate for us to continue to use your personal data.
Changes to this Privacy Notice - we will review this Privacy Notice regularly and will place updates on our website.
Further information - see the Information Commissioner’s FAQs on data handling during the COVID-19 pandemic.
1 Facebook page providing updates from the Council and community partners on the Coronavirus (COVID-19) pandemic
2 Note that we may process your personal information on more than one lawful basis depending on the specific purpose for which we are using your information