Privacy and data sharing: COVID-19 vaccine support programme

The shared public health service for Bedford Borough, Central Bedfordshire and Milton Keynes has begun a vaccine support programme. The objective of this programme is to make direct contact inviting those who have not yet had a COVID-19 vaccination to take up the vaccination offer and to provide support or advice to do this. Individuals may be contacted by phone, text, email, by letter or by a doorstep contact.

Along with Bedford Borough Council and Milton Keynes Council, we are conducting this programme within a Data Sharing Agreement with Bedfordshire, Luton, and Milton Keynes Clinical Commissioning Group (BLMKCCG).

The personal data that will be securely shared from BLMKCCG to designated, authorised, vaccine support officers within the local shared public health team across the three councils are:

  • NHS number
  • GP practice
  • name
  • phone number
  • address
  • email address

This data is for adults who are recorded as not having received the COVID-19 vaccine jab.

No health records or health data is shared other than these.

A record of call outcome such as whether contact was made, will be retained for no longer than the period of the programme and is then securely destroyed. Phone calls may be recorded for monitoring purposes. Recordings of phone calls will be retained for no longer than six months and then automatically securely deleted. The data will not be shared with any third parties. If information regarding views or opinions of the COVID-19 vaccine are voluntarily provided, this may be noted anonymously for feedback purposes for improvement on the provision of advice and support.

What to expect

The call handler will give their name and explain they are calling on behalf of either Central Bedfordshire Council, Milton Keynes Council, or Bedford Borough Council and will ask you to verify your name and address. They will not ask you to provide any further verification information. You will be asked whether you have received an invitation to book a vaccination appointment. You are not required or obligated to discuss your vaccination status, but you will be offered support and advice about the vaccine and how to locally obtain the vaccination. The call handler may also offer to arrange this on your behalf. If you wish to receive specific advice about the vaccine from a clinician or your GP, the call handler may arrange this to be scheduled for you, with your consent. For a personalised or detailed clinical consultation, call handlers will suggest you contact your own GP.

If, during a phone call or visit to your address, you do not wish to discuss whether you have received an invitation to obtain the COVID-19 vaccine or to be provided advice or support to obtain the COVID-19 vaccine, you may decline the offer and terminate the call or visit and you will not be further contacted in this manner.

The councils have secure procedures and encryption practices in place to ensure personal data is handled in accordance with UK GDPR and the Data Protection Act 2018.

Lawful basis

The lawful basis for processing your personal data for the purpose of this vaccine support programme is because it is a necessary task in the public interest (Article 6(1) (e) UK GDPR) to mitigate the spread and impact of the COVID-19 virus. In addition, the condition for processing at Article 9(2) (g) UK GDPR applies as this is a task of substantial public interest to meet our public health duties, along with the lawful condition for processing at Schedule 1 Part 2 Data Protection Act 2018:

Statutory etc and government purposes 6(1) This condition is met if the processing — (a) is necessary for a purpose listed in sub-paragraph (2), and (b) is necessary for reasons of substantial public interest. (2) Those purposes are — (a) the exercise of a function conferred on a person by an enactment or rule of law.

The shared public health service councils have been given authority to process confidential patient information for this purpose, as set out in the COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 from the Department of Health and Social Care on behalf of the Secretary of State for Health and Social Care.

Your rights

You have the right to request a copy of your personal information held by us (subject Access). You also have the right to object to processing (this is not an absolute right and will be assessed in accordance with UK GDPR), along with the right to request inaccurate data is rectified.

The Information Commissioner's Office (ICO) on 4 August 2021, published changes to direct marketing rules (Privacy and Electronic Communications Regulations (PECR)). If a public authority's message (via email, text (SMS) or phone call) is necessary for the authority's task or function, these messages are not direct marketing. This means that we are not required to obtain your consent to send these communications or to provide you the opt-out facility, as listed within the Privacy and Electronic Communication Regulations (PECR), as these rules along with the absolute opt-out right from direct marketing contained in the UK GDPR do not apply to these communications.

Please email if you wish to raise a concern about our handling of personal data. You may also contact the Information Commissioner's Office (ICO) if you have cause to submit a complaint.