Coronavirus - COVID-19 privacy notice

In these difficult times, we are working very closely with our partners with central government, health and care providers, voluntary sectors as well as the volunteers who are helping to deliver the really vital care and support to our local communities. This means that we will need to receive and share personal information about our residents. This notice provides information about what kind of personal information that may be, what we may do with it and who may have access to it.

Bedfordshire Local Resilience Forum (BLRF)

The Civil Contingencies Act 2004 (CCA) establishes a clear set of roles and responsibilities for Category One organisations involved in emergency preparation and response at the local level, to plan for and meet the needs of those who may be vulnerable during an emergency. The primary focus is to empower frontline services and voluntary sector by providing them with timely information about the vulnerable people and support requirements of their patients, service users and customers and be in a position to know what support is required and how to manage delivery of care during the COVID-19 response.

Across Bedfordshire, all blue light services (police, fire, ambulance), NHS organisations, councils (Bedford, Luton and Central Bedfordshire) and other key stakeholders such as the voluntary sector, are working together in co-ordinating and delivering the requirements of the government’s COBRA Committee and take action and develop plans in this context. The arrangements include making and maintaining plans, warning and informing, and business continuity during an emergency. 

As government has advised isolation and social distancing, the implications of this on our residents, communities and services is under constant review.

Throughout this pandemic our three main objectives are to:

  • preserve life
  • support the vulnerable and
  • protect livelihoods

Working in partnership with Public Health England, the councils will provide local flexible and responsive support to identify, monitor and manage outbreaks.

During the response to this public health emergency, under the Civil Contingencies Act (2004), Category 1 and Category 2 responders have a duty to share information with other responder organisations.

The information we hold and who it is about

The council already holds information about the people who use our services which are described in our privacy notice in more detail.

To help with the care and support, the types of council held information being used currently are:

  • Adult Social Care which would include information about vulnerable adults, carers and their families
  • Children’s Social Care which would include children in need of safeguarding and foster care
  • Education which would include schools, those with Education, Health and Care plans, or those receiving early years funding
  • Commissioning which includes how we ask third parties to provide services on our behalf

There will be other council services such as Housing Benefit, Council Tax and the Electoral Register which we may use to help us validate data and identify groups of individuals who may need our support because they meet the vulnerable criteria. 

The kind of personal information we may collect from you or obtain from other sources for the purpose of COVID-19 contact tracing are:

  • name
  • age
  • gender
  • household composition
  • address and contact details (email, phone numbers, mobile numbers and social media contacts)
  • workplace
  • school or college

We may also collect/ access special category (sensitive data) such as ethnicity and health. This includes a positive or negative test result for COVID-19 NHS number.

You may receive a call from our staff and our shared public health service partners or a knock at your door, if we have not been able to contact you by phone. These local contact tracing measures have been inferred on the council to reduce the transmission of COVID-19. This will involve provision of infection prevention and control advice, encouragement to self-isolate and be tested, but also including additional advice where required, such as for schools and workplaces. The overall purpose is to understand and allow effective intervention to reduce transmission of the virus in the local area.

We may inform your workplace, or school or college if you have a positive test result and your workplace or school may be required to inform our public health team that you have tested positive.
We have strict security control measures in place to ensure that only the minimal personal data is shared securely and for the necessary purpose and the information is not held for longer than necessary.
The information we collect may be uploaded to the government's contact tracing platform (CTAS), recorded in paper files, in databases and in electronic folders on the councils’ secure networks where access is restricted only to staff who need to see it to deliver services to support our work around COVID-19.

Sharing information

We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and good service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.

This means that we will only share personal information where is it necessary and proportionate to delivering care and support. We may share personal information with and receive personal information from these organisations:

  • Department for Health
  • Public Health England
  • Department for Education
  • NHS
  • Our local NHS Trusts
  • Hospitals
  • GPs and our local Clinical Commissioning Group (CCG)
  • Local authorities in Bedfordshire
  • Voluntary sector providers
  • Health and care providers that we work with
  • Schools
  • Town and parish councillors who will support our efforts across the county in their roles
  • COVID-19 Mutual Aid Task groups, Foodbanks, Community Volunteers (Bedfordshire Rural Communities Charity) and Good Neighbourhood Schemes and Community Voluntary Service (CVS) Community Action Bedfordshire (CAB), who will be working with the council and our partners. They will only have access to the minimal information they need to do that work and will be bound by our data handling agreement.

This is not an exhaustive list and may change as the situation does.

Vulnerable patient data

It is critical that we know who the most vulnerable people are who need our support because of their pre-existing medical conditions. We are being provided with the information from the NHS’ Vulnerable Patient List to enable the councils and our partners to deliver the kinds of support needed. This information will include names, addresses, contact details, information taken from the online form completed and key information such as whether they can get their essential supplies delivered.

This will form part of the Community Hub approach. This service will relate to food, medicine, medical, health and/or mental health support.

Child protection - information sharing data for 0-19 Services

NHS England has identified a risk that health visitors and school nurses will not receive information about vulnerable children whilst social distancing is in place. Consequently, NHS Digital will provide data from the Child Protection - Information Sharing (CP-IS) system to 0-19 Services about children subject to a Child Protection Plan, pregnant women with an Unborn Child Protection Plan and children who are designated a Looked After Child, in particular children being cared for under the Children's Act 1989.

Data recorded by the councils on CP-IS will be included in the extracts. They will be shared with health visitors and school nurses commissioned by our Public Health service so that the health and welfare of vulnerable children and young people in Bedfordshire is protected during a period where face to face contact with statutory services is reduced. Further details can be found on the NHS Digital website.

NHS Test & Trace Central Bedfordshire Council Run Establishments - Leisure, Libraries, Theatres and Community facilities

There is a higher risk of transmitting COVID-19 in premises where customers and visitors spend a longer time in one place and potentially come into close contact with other people outside of their household. To manage this risk, we will collect details and maintain records of staff, customers and visitors. This includes name contact details, date of visit arrival and departure times. If not collected in advance, the required information will be collected at the point that visitors enter the premises.

This information is only collected and used for the purposes of stopping the spread of the Virus.

Records will be held for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of and electronic records erased.

This is a voluntary exercise and if you do not agree for us to share these details with NHS Test and Trace you can say so and opt out, but we strongly encourage customers and visitors to share their details in order to support NHS Test and Trace which will be used only where necessary to help stop the spread of COVID-19. More information can be found here on NHS Test and Trace.

How we will use the information

We will use the information we collect to deliver a number of services which may include:

  • Identifying and contacting those in higher risk groups to offer them support such as food collection, medical collection and deliveries
  • Providing support to those who have registered with us or directly requested support such as for wellbeing calls, prescription collections and Food support, or those experiencing hardship and would like some financial advice.
  • The provision of social care and support
  • The provision of health and/or mental health support
  • Our COVID-19 Community Hub
  • Awareness and advice
  • Volunteer services
  • Enabling plans to be made to support children returning to school
  • Monitor and manage outbreaks. Implementation of the local outbreak control plan (LOCP). Action to support individuals who have tested positive, to provide assurance that tracing of all known contacts of confirmed cases are followed up and advised appropriately, to offer advice and support to those who have not yet provided their contact tracing details, and to provide advice and practical support to cases and their close contacts in order that they can successfully self-isolate for the appropriate time.

This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.

Data protection

Under the General Data Protection Regulation (GDPR), we have to identify our lawful basis for collecting, using, sharing and storing personal information. We are relying on Article 6(1) (e) of the GDPR to process personal information which means we are doing so as it is a task in the public interest. This means that it has a basis in the law and is often a statutory duty as we describe below. We also have to identify a lawful basis to process special or sensitive data which in this case is Article 9(2) (g) again where it is a task which is of substantial public interest to meet our duties. We are also processing the information under Article 9 (2) (h) as it can be for the purposes of health and social care.

In some cases, we will already have the information needed for our response to coronavirus as we hold it for very similar reasons, for example it is needed for our usual statutory duties around social care and health care. We are using other personal information such as the Electoral Register to help with delivering care and support to those who need it as part of our statutory duties and where we believe it is in the public interest to do so.

We already have a duty to protect and improve the well-being of our residents under laws like the Local government Act 1972, the Children Act 1989 and the Care Act 2014. We have also been given authority to process confidential patient information under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. The Secretary of State for Health and Social Care has issued a notice to the councils to enable them to do so, at present until 20 September 2020. A copy of this notice is available on the GOV.UK website.

We also have powers under the Civil Contingencies Act 2004 which allows personal/sensitive information to be used where it is necessary to protect the vital interests of individuals, where either consent cannot be given or cannot reasonably be expected to be obtained. Vital interests do not just mean ‘life or death’ but also situations where there is a risk of significant harm to life and relate to emergency operations where individuals’ lives are potentially at risk.

How long we keep information for

The information which we already hold will be kept in line with our retention schedule however we will be collecting new information directly as a result of the current situation. There is a limited period of time for which we will keep the information we collect specifically for the response to coronavirus and COVID-19. As we do not yet know how long the situation or response will last then the requirement to keep information will be kept under review however it is likely to be at least a year after the situation is less critical, unless it is based on consent. Any information retained with consent may need to be erased if consent is withdrawn.

Your rights

You have rights under the General Data Protection Regulation and Data Protection Act 2018. For the processing outlined above your rights include: to request a copy of the information held about you (Subject Access); to request we rectify inaccurate information, and to object to processing.

More information can be found in our Data Protection & Privacy Statement.

You can also find how to make a data protection complaint or raise a concern.

Telephone: 0300 300 4968
Email our Data Protection Officerinformation.governance@centralbedfordshire.gov.uk