Privacy notice

Coronavirus (COVID-19) privacy notice

This privacy notice is an addendum to our overarching privacy notice. It provides information as to how Ealing Council will collect, use and protect your personal data in respect of the COVID-19 pandemic.

Who is the data controller for this processing?

Ealing Council is the data controller.

What personal information do we hold?

We only collect and use the minimum amount of personal information required when delivering a service to you.  Personal data is anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details.

Special category data

Some of your personal data is classed as 'special category data' because it is the information that is considered to be more sensitive and therefore requires more protection. This will include your medical data.

How do we use your personal information?

We use your information for one or more of the following reasons:

  • Deliver the service, or handle your enquiry to us during the Covid-19 pandemic
  • To plan and improve the services we can offer during the Covid-19 pandemic
  • Understand the local resident population identified as vulnerable (including clinically extremely vulnerable) to COVID-19, in order to able to prepare to provide support rapidly in the event of a national or local lockdown.

Shielding and protecting extremely vulnerable people

Some people have been urged to stay at home, at all times, and to avoid all face to face contact except for with essential carers and health care workers.

We will be using our information, as well as information provided by the National Health Service (NHS) to identify extremely vulnerable people already receiving services from other parts of the council, so that we can provide appropriate assistance to them as required.

From the 1 August 2020, the national shielding programme has been paused. In accordance with government direction we will still need to understand the local resident population identified as clinically extremely vulnerable to COVID-19, to rapidly make offers of support.

Specifically we will be processing data about vulnerable residents (including those that are clinically extremely vulnerable). This will include:

  • Verifying the identity of clinically extremely vulnerable patients as residents of Ealing, and to contact the patient to provide advice or direct care as follows:
    • Targeting care for clinically extremely vulnerable people outside of shielding.
      • To monitor the wellbeing of known people as clinically extremely vulnerable to COVID-19, for a period of time after national shielding ends
      • iTo continue to provide ongoing direct care needs to clinically vulnerable persons as a result of the virus.
  • Shielding readiness. To provide shielding support again immediately in event of local, regional and/or national COVID-19 outbreaks.
  • Targeted support during a local outbreak that may need people within the affected area/s to shield again.

Who else might we share your personal information with?

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law and we will only share the minimum information necessary for the purpose of the COVID-19 pandemic..

This could include:

  • Other departments of the council
  • Health service providers including NHS Agencies 
  • Education providers
  • Care providers, e.g. day care, domiciliary, residential
  • Government Agencies (e.g. Department of Health, Department of Work and Pensions)
  • Support groups for people who are enlisted to provide emergency responses to vulnerable groups
  • Direct Payment Support Services
  • Housing associations, temporary accommodation and private rented accommodation
  • Companies directly involved with the provision of food parcels (your details will not be shared for marketing purposes)

What is the legal basis for our use of your personal information?

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for using your personal information are: 

  • to undertake a legal obligation -GDPR Article 6 ( c  )as per the Coronavirus Act 2020 and for a COVID 19 Purpose, as defined by the Health Service (Control of Patient Information) Regulations 2002'
  • to protect your vital interests - GDPR Article 6 (d)
  • to perform a public task - GDPR Article 6 (e)

When we collect data about your health, we also rely on the following lawful basis:

  • where it is in your vital interests (GDPR Article 9 (2) (c)
  • to collect it for public health (GDPR Article 9 (2) (i) as per the Coronavirus Act 2020 and for a COVID 19 Purpose, as defined by the Health Service (Control of Patient Information) Regulations 2002
  • to analyse your information (GDPR Article 9 (2) (j))

Where will we store your information?

Your information will be securely stored on our network.

How long will we keep your personal information?

We will only use your personal information whilst delivering the service to you and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period. We do not currently know how long personal data relating to the Covid-19 pandemic will be required to be held for.

Your rights

Under data protection law, you have rights including:

  • Your right of access - You have the right to ask us for copies of your personal information
  • Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances
  • Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances

Whilst we will make every effort to provide a response to you within the statutory timescales, please be aware that resources across the organisation may be diverted away from usual compliance or information rights work as we strive to support other functions of the service and to ensure the health and safety of our staff and residents. However, we endeavour to complete requests as soon as possible.

Further details on your rights

Will my personal information be accessible outside the UK?

Your information is stored within the UK.

Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information

Further information

The Information Commissioner's Office has also provided guidance on handing personal data during this pandemic.

If you wish to complain about how your personal data has been processed:

You can complain directly to the Council's Data Protection team by email dataprotection@ealing.gov.uk

You also have the right to complain to the Information Commissioner's Office using the following details:

Further advice and guidance from the ICO on data protection and the coronavirus.