Coronavirus - COVID-19 privacy notice

Coronavirus – COVID-19 privacy notice

In these difficult times, we are working very closely with our partners with central government, health and care providers, voluntary sectors as well as the volunteers who are helping to deliver the really vital care and support to our local communities. This means that we will need to receive and share personal information about our residents. This notice provides information about what kind of personal information that may be, what we may do with it and who may have access to it.

Bedfordshire Local Resilience Forum (BLRF)

The Civil Contingencies Act 2004 (CCA) establishes a clear set of roles and responsibilities for Category One organisations involved in emergency preparation and response at the local level, to plan for and meet the needs of those who may be vulnerable during an emergency. The primary focus is to empower frontline services and voluntary sector by providing them with timely information about the vulnerable people and support requirements of their patients, service users and customers and be in a position to know what support is required and how to manage delivery of care during the COVID-19 response.

Across Bedfordshire, all blue light services (police, fire, ambulance), NHS organisations, councils (Bedford, Luton and Central Bedfordshire) and other key stakeholders such as the voluntary sector, are working together in co-ordinating and delivering the requirements of the government’s COBRA Committee and take action and develop plans in this context. The arrangements include making and maintaining plans, warning and informing, and business continuity during an emergency. 

As government has advised isolation and social distancing, the implications of this on our residents, communities and services is under constant review.

Throughout this pandemic our three main objectives are to:

  • preserve life
  • support the vulnerable and
  • protect livelihoods

Working in partnership with Public Health England, the councils will provide local flexible and responsive support to identify, monitor and manage outbreaks.

During the response to this public health emergency, under the Civil Contingencies Act (2004), Category 1 and Category 2 responders have a duty to share information with other responder organisations.

The information we hold and who it is about

The council already holds information about the people who use our services which are described in our privacy notice in more detail.

To help with the care and support, the types of council held information being used currently are:

  • Adult Social Care which would include information about vulnerable adults, carers and their families
  • Children’s Social Care which would include children in need of safeguarding and foster care
  • Education which would include schools, those with Education, Health and Care plans, or those receiving early years funding
  • Commissioning which includes how we ask third parties to provide services on our behalf

There will be other council services such as Housing Benefit, Council Tax and the Electoral Register which we may use to help us validate data and identify groups of individuals who may need our support because they meet the vulnerable criteria. 

The kind of personal information we may collect from you or obtain from other sources for the purpose of COVID-19 contact tracing are:

  • name
  • age
  • gender
  • household composition
  • address and contact details (email, phone numbers, mobile numbers and social media contacts)
  • workplace
  • school or college

We may also collect/ access special category (sensitive data) such as ethnicity and health. This includes a positive or negative test result for COVID-19 NHS number.

You may receive a call from our staff and our shared public health service partners or a knock at your door, if we have not been able to contact you by phone. These local contact tracing measures have been inferred on the council to reduce the transmission of COVID-19. This will involve provision of infection prevention and control advice, encouragement to self-isolate and be tested, but also including additional advice where required, such as for schools and workplaces. The overall purpose is to understand and allow effective intervention to reduce transmission of the virus in the local area.

We may inform your workplace, or school or college if you have a positive test result and your workplace or school may be required to inform our public health team that you have tested positive.
We have strict security control measures in place to ensure that only the minimal personal data is shared securely and for the necessary purpose and the information is not held for longer than necessary.
The information we collect may be uploaded to the government's contact tracing platform (CTAS), recorded in paper files, in databases and in electronic folders on the councils’ secure networks where access is restricted only to staff who need to see it to deliver services to support our work around COVID-19.

Sharing information

We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and good service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.

This means that we will only share personal information where is it necessary and proportionate to delivering care and support. We may share personal information with and receive personal information from these organisations:

  • Department for Health
  • Public Health England
  • Department for Education
  • NHS
  • Our local NHS Trusts
  • Hospitals
  • GPs and our local Clinical Commissioning Group (CCG)
  • Local authorities in Bedfordshire
  • Voluntary sector providers
  • Health and care providers that we work with
  • Schools
  • Town and parish councillors who will support our efforts across the county in their roles
  • COVID-19 Mutual Aid Task groups, Foodbanks, Community Volunteers (Bedfordshire Rural Communities Charity) and Good Neighbourhood Schemes and Community Voluntary Service (CVS) Community Action Bedfordshire (CAB), who will be working with the council and our partners. They will only have access to the minimal information they need to do that work and will be bound by our data handling agreement.

This is not an exhaustive list and may change as the situation does.

Vulnerable patient data

It is critical that we know who the most vulnerable people are who need our support because of their pre-existing medical conditions. We are being provided with the information from the NHS’ Vulnerable Patient List to enable the councils and our partners to deliver the kinds of support needed. This information will include names, addresses, contact details, information taken from the online form completed and key information such as whether they can get their essential supplies delivered.

This will form part of the Community Hub approach. This service will relate to food, medicine, medical, health and/or mental health support.

Child protection - information sharing data for 0-19 Services

NHS England has identified a risk that health visitors and school nurses will not receive information about vulnerable children whilst social distancing is in place. Consequently, NHS Digital will provide data from the Child Protection - Information Sharing (CP-IS) system to 0-19 Services about children subject to a Child Protection Plan, pregnant women with an Unborn Child Protection Plan and children who are designated a Looked After Child, in particular children being cared for under the Children's Act 1989.

Data recorded by the councils on CP-IS will be included in the extracts. They will be shared with health visitors and school nurses commissioned by our Public Health service so that the health and welfare of vulnerable children and young people in Bedfordshire is protected during a period where face to face contact with statutory services is reduced. Further details can be found on the NHS Digital website.

NHS Test & Trace Central Bedfordshire Council Run Establishments - Leisure, Libraries, Theatres and Community facilities

There is a higher risk of transmitting COVID-19 in premises where customers and visitors spend a longer time in one place and potentially come into close contact with other people outside of their household. To manage this risk, we will collect details and maintain records of staff, customers and visitors. This includes name contact details, date of visit arrival and departure times. If not collected in advance, the required information will be collected at the point that visitors enter the premises.

This information is only collected and used for the purposes of stopping the spread of the Virus.

Records will be held for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of and electronic records erased.

This is a voluntary exercise and if you do not agree for us to share these details with NHS Test and Trace you can say so and opt out, but we strongly encourage customers and visitors to share their details in order to support NHS Test and Trace which will be used only where necessary to help stop the spread of COVID-19. More information can be found here on NHS Test and Trace.

How we will use the information

We will use the information we collect to deliver a number of services which may include:

  • Identifying and contacting those in higher risk groups to offer them support such as food collection, medical collection and deliveries
  • Providing support to those who have registered with us or directly requested support such as for wellbeing calls, prescription collections and Food support, or those experiencing hardship and would like some financial advice.
  • The provision of social care and support
  • The provision of health and/or mental health support
  • Our COVID-19 Community Hub
  • Awareness and advice
  • Volunteer services
  • Enabling plans to be made to support children returning to school
  • Monitor and manage outbreaks. Implementation of the local outbreak control plan (LOCP). Action to support individuals who have tested positive, to provide assurance that tracing of all known contacts of confirmed cases are followed up and advised appropriately, to offer advice and support to those who have not yet provided their contact tracing details, and to provide advice and practical support to cases and their close contacts in order that they can successfully self-isolate for the appropriate time
  • To coordinate and facilitate the Covid vaccination program
  • To coordinate and facilitate the local contact tracing program to effectively tackle local outbreaks of Covid
  • To coordinate and facilitate local Covid testing

This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.

Data protection

Under the General Data Protection Regulation (GDPR), we have to identify our lawful basis for collecting, using, sharing and storing personal information. We are relying on Article 6(1) (e) of the GDPR to process personal information which means we are doing so as it is a task in the public interest. This means that it has a basis in the law and is often a statutory duty as we describe below. We also have to identify a lawful basis to process special or sensitive data which in this case is Article 9(2) (g) again where it is a task which is of substantial public interest to meet our duties. We are also processing the information under Article 9 (2) (h) as it can be for the purposes of health and social care.

In some cases, we will already have the information needed for our response to coronavirus as we hold it for very similar reasons, for example it is needed for our usual statutory duties around social care and health care. We are using other personal information such as the Electoral Register to help with delivering care and support to those who need it as part of our statutory duties and where we believe it is in the public interest to do so.

We already have a duty to protect and improve the well-being of our residents under laws like the Local government Act 1972, the Children Act 1989 and the Care Act 2014. We have also been given authority to process confidential patient information under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. The Secretary of State for Health and Social Care has issued a notice to the councils to enable them to do so, at present until 20 September 2020. A copy of this notice is available on the GOV.UK website.

We also have powers under the Civil Contingencies Act 2004 which allows personal/sensitive information to be used where it is necessary to protect the vital interests of individuals, where either consent cannot be given or cannot reasonably be expected to be obtained. Vital interests do not just mean ‘life or death’ but also situations where there is a risk of significant harm to life and relate to emergency operations where individuals’ lives are potentially at risk.

How long we keep information for

The information which we already hold will be kept in line with our retention schedule however we will be collecting new information directly as a result of the current situation. There is a limited period of time for which we will keep the information we collect specifically for the response to coronavirus and COVID-19. As we do not yet know how long the situation or response will last then the requirement to keep information will be kept under review however it is likely to be at least a year after the situation is less critical, unless it is based on consent. Any information retained with consent may need to be erased if consent is withdrawn.

Your rights

You have rights under the General Data Protection Regulation and Data Protection Act 2018. For the processing outlined above your rights include: to request a copy of the information held about you (Subject Access); to request we rectify inaccurate information, and to object to processing.

More information can be found in our Data Protection & Privacy Statement.

You can also find how to make a data protection complaint or raise a concern.

Telephone: 0300 300 5765
Email our Data Protection Officer: information.governance@centralbedfordshire.gov.uk

COVID-19 vaccine support programme

The shared public health service for Bedford Borough, Central Bedfordshire and Milton Keynes has begun a vaccine support programme. The objective of this programme is to make direct contact inviting those who have not yet had a COVID-19 vaccination to take up the vaccination offer and to provide support or advice to do this. Individuals may be contacted by phone, text, email, by letter or by a doorstep contact.

Along with Bedford Borough Council and Milton Keynes Council, we are conducting this programme within a Data Sharing Agreement with Bedfordshire, Luton, and Milton Keynes Clinical Commissioning Group (BLMKCCG).

The personal data that will be securely shared from BLMKCCG to designated, authorised, vaccine support officers within the local shared public health team across the three councils are:

  • NHS number
  • GP practice
  • name
  • phone number
  • address
  • email address

This data is for adults who are recorded as not having received the COVID-19 vaccine jab.

No health records or health data is shared other than these.

A record of call outcome such as whether contact was made, will be retained for no longer than the period of the programme and is then securely destroyed. Phone calls may be recorded for monitoring purposes. Recordings of phone calls will be retained for no longer than six months and then automatically securely deleted. The data will not be shared with any third parties. If information regarding views or opinions of the COVID-19 vaccine are voluntarily provided, this may be noted anonymously for feedback purposes for improvement on the provision of advice and support.

What to expect

The call handler will give their name and explain they are calling on behalf of either Central Bedfordshire Council, Milton Keynes Council, or Bedford Borough Council and will ask you to verify your name and address. They will not ask you to provide any further verification information. You will be asked whether you have received an invitation to book a vaccination appointment. You are not required or obligated to discuss your vaccination status, but you will be offered support and advice about the vaccine and how to locally obtain the vaccination. The call handler may also offer to arrange this on your behalf. If you wish to receive specific advice about the vaccine from a clinician or your GP, the call handler may arrange this to be scheduled for you, with your consent. For a personalised or detailed clinical consultation, call handlers will suggest you contact your own GP.

If, during a phone call or visit to your address, you do not wish to discuss whether you have received an invitation to obtain the COVID-19 vaccine or to be provided advice or support to obtain the COVID-19 vaccine, you may decline the offer and terminate the call or visit and you will not be further contacted in this manner.

The councils have secure procedures and encryption practices in place to ensure personal data is handled in accordance with UK GDPR and the Data Protection Act 2018.

Lawful basis

The lawful basis for processing your personal data for the purpose of this vaccine support programme is because it is a necessary task in the public interest (Article 6(1) (e) UK GDPR) to mitigate the spread and impact of the COVID-19 virus. In addition, the condition for processing at Article 9(2) (g) UK GDPR applies as this is a task of substantial public interest to meet our public health duties, along with the lawful condition for processing at Schedule 1 Part 2 Data Protection Act 2018:

Statutory etc and government purposes 6(1) This condition is met if the processing — (a) is necessary for a purpose listed in sub-paragraph (2), and (b) is necessary for reasons of substantial public interest. (2) Those purposes are — (a) the exercise of a function conferred on a person by an enactment or rule of law.

The shared public health service councils have been given authority to process confidential patient information for this purpose, as set out in the COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 from the Department of Health and Social Care on behalf of the Secretary of State for Health and Social Care.

Your rights

You have the right to request a copy of your personal information held by us (subject Access). You also have the right to object to processing (this is not an absolute right and will be assessed in accordance with UK GDPR), along with the right to request inaccurate data is rectified.

The Information Commissioner's Office (ICO) on 4 August 2021, published changes to direct marketing rules (Privacy and Electronic Communications Regulations (PECR)). If a public authority's message (via email, text (SMS) or phone call) is necessary for the authority's task or function, these messages are not direct marketing. This means that we are not required to obtain your consent to send these communications or to provide you the opt-out facility, as listed within the Privacy and Electronic Communication Regulations (PECR), as these rules along with the absolute opt-out right from direct marketing contained in the UK GDPR do not apply to these communications.

Please email information.governance@centralbedfordshire.gov.uk if you wish to raise a concern about our handling of personal data. You may also contact the Information Commissioner's Office (ICO) if you have cause to submit a complaint.