COVID-19 (Coronavirus) Community Response Privacy Notice
Last update: 31 July 2020
This privacy notice will be periodically updated to reflect any changes to the COVID-19 community response coordination effort which impact the collection or use of personal data. This notice may be amended at any time, so please review it frequently. The date at the top of this page will be amended each time this notice is updated.
Introduction
This privacy notice explains how the Council uses your data to help co-ordinate the community response to COVID-19 (Coronavirus).
This sits alongside the addendum to our overarching privacy notice [PDF], which covers amendments to pre-existing data processing for the duration of the COVID-19 pandemic.
Who will be using your data?
Nottinghamshire County Council will be the data controller for the data you provide to us. We may also receive data from other local agencies (including the NHS) in maintain a consolidated list of agencies and individuals in Nottinghamshire who need help or can provide support to those that need help.
We are working in partnership on the COVID-19 Community Response with other Nottinghamshire Local Resilience Forum partner organisations (including public authorities, emergency services, and other stakeholders which have a statutory duty to respond to emergencies) to meet the care and welfare needs of Nottinghamshire residents during the pandemic. For more information, see the Local Resilience Forum privacy notice.
What personal data do we use?
This will vary depending on the task being carried out and includes, but is not limited to:
- Name and Contact Details (email address and telephone number)
- Date of Birth
- Address
- Identifiers, eg. NHS number, if applicable
- Details of support needs, if applicable
- Details of DBS check, if applicable
- References, if applicable
- Organisation bank sort code and account details (where applicable: e.g. for successful funding applications)
We will receive personal information from a number of sources identifying vulnerable people in the community. This includes information about those that do not meet our normal criteria for support, but who have become vulnerable because their normal support from friends and family may be interrupted or reduced.
What types of special category personal data do we need from you?
- Physical and/or mental health details, if applicable
Why do we use your data?
- If you have been identified as vulnerable or in need: to coordinate the most appropriate support to meet your needs
- If you are requesting support: to coordinate support to meet your needs; to provide advice to you or people supporting you on local community, voluntary and other organisations that can provide services/meet needs other than those being carried out directly by the council
- If you are applying to access emergency support / assistance (e.g. to provide food, essential supplies and advice): to administer the applications for support
- If you are offering support as an individual: to help connect you with community groups you can join or individuals you can support
- If you are offering support as a commercial or charitable organisation: to coordinate support where is needed and maximise the efficiency of the support being offered
- If you are applying for a community fund grant: to administer funding schemes / process grant payments
- To support service planning and improvement.
What legal reasons allow us to use your data in this way?
Under the General Data Protection Regulation (GDPR), we are processing this information on the basis that we are carrying out a task in the public interest and to protect the vital interests of people more vulnerable to coronavirus.
Some of the information we hold is sensitive health and care information. This is classed as ‘special category’ personal data within the meaning of Schedule 1 to the Data Protection Act 2018, meaning we must state a further lawful basis for processing it. We processing this data on the basis of substantial public interest in the area of public health and in line with government requirements.
Who may we share your data with or receive it from?
Your details will be shared with Nottinghamshire district councils, Local Resilience Forum partner organisations, and Nottinghamshire CVS organisations for the purpose of co-ordinating and providing appropriate services to meet the needs of people in the community.
We will also share your data where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.
Any information which is shared will only be shared on an appropriate and need to know basis to provide support services in respect of COVID-19. Only the minimum information for the purpose will be shared.
We may share your data with or receive it from:
- District and borough councils
- NHS agencies (GPs, Hospitals)
- Health organisations
- Welfare organisations and care providers
- Charity, voluntary and/or community organisations
- Religious organisations
- Businesses and commercial organisations
- Service Providers
- Education providers (including Schools & Academies)
- Government departments, eg. Department for Health
- Non-departmental government bodies
- The Police
- Prisons and probation services
- Courts
- Housing associations
- Fire & Rescue services
- Other customers and service users
- Family Members
- Carers and Guardians
- Members of the public (referrers)
- The Disclosure and Barring Service
- Other identity verification services
If you are registering details on behalf of a group to offer services in the community, details will be included in a publicly searchable database unless you opt to make them not publicly available. The details will still be viewable by the County Council and partner organisations (typically other Councils in Nottinghamshire) who may signpost to, or contact your group, regarding the support it can offer.
If you are registering your details as an individual volunteer, your details will not be publicly available. They will be available to the Council and partner organisations (typically other councils) who may signpost to, or contact you, regarding the support you can offer.
How long is your data kept for?
We will only keep your personal data for as long as is necessary for the purpose for which we are processing it, unless we have a legitimate reason for keeping it, for example, any legal requirement to keep the data for a set time period. At this stage it is not known how long data relating to the management of the pandemic will be retained. We will ensure that we follow any published guidance in this respect as it becomes available.
As a minimum the information outlined in this privacy notice will be kept for the duration of the COVID 19 response and, after that, in accordance with the Council’s retention schedule.
Where possible we will anonymise this data so that you cannot be identified.
Where we do not need to continue to process your personal data, it will be securely destroyed.
What will happen if you do not provide or we cannot obtain the data needed or we cannot share it?
We could not provide this service.
Does the service make decisions using fully automated processes?
No.
What rights do you have over this use of your data?
- To be informed about how we use your personal data
- To access a copy of your personal data
- To have us rectify or correct your personal data
- To restrict our processing of your personal data
- To object to the use of your personal data
- To have your personal data erased
Some of these rights are subject to exceptions. Please refer to the County Council’s privacy statement part 10 for further details.
Contact the Data Protection Officer
If you have any concerns about how the Council is using your data, you can contact the Council’s Data Protection Officer by writing to:
Or
Data Protection Officer
Nottinghamshire County Council
County Hall
West Bridgford
Nottingham
NG2 7QP
Please see the County Council’s privacy statement for further information.
Contact details of the Information Commissioner’s Office
If you are unhappy with how your data has been processed by the Council or you feel your data protection rights have been breached, you have the right to complain to the Information Commissioner’s Office at:
Or
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Please note that the the Information Commissioner’s Office will expect you to raise any data protection issues with the County Council for us to resolve directly, before you contact them.
