Coronavirus (COVID-19) privacy notice
This privacy notice is an addendum to our overarching privacy notice. It provides information as to how Ealing Council will collect, use and protect your personal data in respect of the COVID-19 pandemic.
Who is the data controller for this processing?
Ealing Council is the data controller.
What personal information do we hold?
We only collect and use the minimum amount of personal information required when delivering a service to you. Personal data is anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details.
Special category data
Some of your personal data is classed as 'special category data' because it is the information that is considered to be more sensitive and therefore requires more protection. This will include your medical data.
How do we use your personal information?
We use your information for one or more of the following reasons:
- Deliver the service, or handle your enquiry to us during the Covid-19 pandemic
- To plan and improve the services we can offer during the Covid-19 pandemic
Shielding and protecting extremely vulnerable people
Some people have been urged to stay at home, at all times, and to avoid all face to face contact except for with essential carers and health care workers.
We will be using our information, as well as information provided by the National Health Service (NHS) to identify extremely vulnerable people already receiving services from other parts of the council, so that we can provide appropriate assistance to them as required.
Who else might we share your personal information with?
Sometimes we may need to share your information, but we will only do so where it is necessary or required by law and we will only share the minimum information necessary for the purpose of the COVID-19 pandemic..
This could include:
- Other departments of the council
- Health service providers including NHS Agencies
- Education providers
- Care providers, e.g. day care, domiciliary, residential
- Government Agencies (e.g. Department of Health, Department of Work and Pensions)
- Support groups for people who are enlisted to provide emergency responses to vulnerable groups
- Direct Payment Support Services
- Housing associations, temporary accommodation and private rented accommodation
What is the legal basis for our use of your personal information?
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for using your personal information are:
- to undertake a legal obligation -GDPR Article 6 ( c )as per the Coronavirus Act 2020 and for a COVID 19 Purpose, as defined by the Health Service (Control of Patient Information) Regulations 2002'
- to protect your vital interests - GDPR Article 6 (d)
- to perform a public task - GDPR Article 6 (e)
When we collect data about your health, we also rely on the following lawful basis:
- where it is in your vital interests (GDPR Article 9 (2) (c)
- to collect it for public health (GDPR Article 9 (2) (i) as per the Coronavirus Act 2020 and for a COVID 19 Purpose, as defined by the Health Service (Control of Patient Information) Regulations 2002
- to analyse your information (GDPR Article 9 (2) (j))
Where will we store your information?
Your information will be securely stored on our network.
How long will we keep your personal information?
We will only use your personal information whilst delivering the service to you and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period. We do not currently know how long personal data relating to the Covid-19 pandemic will be required to be held for.
Under data protection law, you have rights including:
- Your right of access - You have the right to ask us for copies of your personal information
- Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances
- Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances
Whilst we will make every effort to provide a response to you within the statutory timescales, please be aware that resources across the organisation may be diverted away from usual compliance or information rights work as we strive to support other functions of the service and to ensure the health and safety of our staff and residents. However, we endeavour to complete requests as soon as possible.
Will my personal information be accessible outside the UK?
Your information is stored within the UK.
Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information
The Information Commissioner's Office has also provided guidance on handing personal data during this pandemic.
If you wish to complain about how your personal data has been processed:
You can complain directly to the Council's Data Protection team by email firstname.lastname@example.org
You also have the right to complain to the Information Commissioner's Office using the following details:
- Information Commissioner's Office (ICO) website
- By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113