Covid-19 Local Outbreak Control Programme
How we will use your information
As the Covid-19 pandemic enters a new phase during which lockdown restrictions are eased and businesses re-open, we have set up a programme to manage outbreaks of the disease that may happen in particular parts of the town. This follows the Government’s recovery strategy which requires the monitoring of the pandemic accurately, as well as quickly detecting and tackling outbreaks.
This will enable us to:
- understand the spread of Covid-19 and the risks to public health, trends in Covid-19 and such risks, and control and prevent the spread of Covid-19 and such risks
- identify and understand information about patients with Covid-19 and collect information about services in relation to testing and contact tracing for Covid-19
- monitor and manage the response to Covid-19 by health and social care bodies in relation to testing, contact tracing and effective management of outbreaks of Covid-19
- provide appropriate and timely support to people who require assistance to isolate when requested to do so
- undertake research and planning in relation to testing, contact tracing and outbreak management for Covid-19
We are processing personal data that may include:
- name, address, date of birth, postcode, language, ethnic group, sex, workplace / school / care home address, telephone number, email address, employment type and details, key worker status, work address
- test date, test result, where test conducted (laboratory, mobile testing station, home test), Covid-19 symptoms, deceased / alive
- household members personal details (as above first bullet point)
- visitor personal details (as above first bullet point)
- places visited within the past 48 hours and postcode for these locations
- whether contact with household members or visitors has been direct or indirect
We will obtain information from:
- you: when we contact you because you tested positive for Covid-19, or because you were identified as having had contact with someone who tested positive for Covid-19
- Public Health England: they are providing us with a de-personalised list of people who have tested positive from the NHS Track and Trace system
- The NHS including NHS England, Local NHS Foundation Trusts and the Rotherham NHS Clinical Commissioning Group for information about local outbreaks of Covid-19 and to provide additional support with the response
- within the Council: we hold a number of datasets with personal information eg Adult and Children Social Care records, shielded/vulnerable list of people identified during phase 1 of the pandemic and educational settings such as schools and colleges
We are carrying out data matching for combining, comparing or matching personal data obtained from multiple sources. We are doing this to complete any gaps in information from any one source so that we can accurately identify individuals to support them and provide the necessary understanding of disease trends.
Lawful Basis for Processing
Under data protection law, we have to have a lawful basis for processing personal data:
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Section 8(c) of the Data Protection Act 2018 sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.
Under ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020, the Council has been given legal notice by the Secretary of State for Health and Social Care to support the processing and sharing of information to help the COVID-19 response.
The processing of special categories of personal data, which includes data concerning a person’s health are prohibited unless specific further conditions can be met. These further relevant conditions are below:
- Article 9.2.(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy
- Schedule 1, Part 1(3) of the Data Protection Act 2018 – processing is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law ie Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002
Who we will share your information with
Your personal data will be shared with:
- Council officers in Public and Environmental Health, Adult and Children’s Social Care and other internal services managing the response to the pandemic
- third party organisations such as the NHS that are directly involved in treating and supporting people
We recognise that the information we are processing is sensitive and we will store and process your information securely. We will ensure access to the data is managed, auditable and restricted to those needing to process the data.
How long we will keep your information
Information from Public Health England will be kept only for the duration of the contract we have with them for sharing personal data or until such time as the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020 is extended (currently 30 September). Otherwise we will keep the information for the duration of the pandemic, taking into account government advice and our business needs.