Coronavirus privacy notice

About this notice

Due to the coronavirus (COVID-19) pandemic, the UK government has implemented unprecedented measures in an attempt to reduce the spread of the virus. This notice describes how the Council may use your information to protect and assist you, and others, during the outbreak.

In furtherance of this, the Council has set up a Community Hub helpline and email address which works in partnership with other relevant Council services and the voluntary sector to assists residents who need help. It signposts the latest information and government advice, as well as other services the Council can provide.

Following official advice and guidance Council officers across our service areas are also putting plans in place and implementing them as the situation develops.

What information we ask for

We will ask you for enough information so that we can help you. Depending on what you would like us to help you with this might include:

• Your name and contact details so that we can keep in touch with you and tell you about what we have done
• Personal information – for example – about you, your family, your circumstances or if you are vulnerable, have a disability and any other information you may think we need to help you
• Your NHS number (if known) or other identification numbers

Why we need your personal information

To provide support to help you with some or all of the following:

• Food
• Energy supply
• Housing
• Payment of bills
• Collection of your medication
• Financial advice
• Social contact

Why we are allowed to use your personal information

The lawful basis for the processing and sharing of personal data for the purposes described above will be the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018):

GDPR Art6 (1)

• (c) processing is necessary for compliance with a legal obligation to which the controller (the Council) is subject
• (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person
• (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

GDPR Art9 (2)

• (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
• (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
• (g) processing is necessary for reasons of substantial public interest
• (h) processing is necessary for the purposes of preventive or occupational medicine (and) the provision of health or social care or treatment or the management of health or social care systems
• (j)  processing is necessary for archiving purposes in the public interest, scientific research and statistical purposes

Data Protection Act 2018

• Schedule 1. Par. 6. Governmental purpose for health and social care purposes

These lawful bases apply following the legislation outlined in the GDPR Data Sharing Policy and the laws outlined on the Council’s Departmental privacy notices.

The Council has and will continue to take note of relevant legislation together with advice and guidance from central Government and others. This includes, but is not limited to:

• Coronavirus Act 2020
• Department of Health and Social Care. Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 to lawfully and efficiently process confidential patient information as set out in Regulation 3(2) of COPI for purposes defined in regulation 3(1)
• Cabinet Office, acting through the Government Digital Service (GDS)
• Ministry of Housing, Communities and Local Government
  • Guidance on data use for Covid-19 Self-Isolation purposes
  • Covid-19 Data sharing guidance – Clinically Extremely Vulnerable (CEV) Persons Support
• Information Commissioners’ Office

The Council had developed a COVID-19 Local Outbreak Control Plan (2.5 MB) setting out how we will respond to potential future outbreaks in the Borough and provides the Legal and Policy context for doing so.

Using your data

The Council will use the above legal bases for processing in order to help you and your family and protect your vital interests. In addition to using personal data that it already holds the Council may receive data about you from others.

This data may be used and shared by us and by the following organisations:

• NHS
• Public Health England
• Central Government
• GP Practices
• Other Local Authorities
• Voluntary organisations and Charities
• Contracted third parties delivering services to residents

Record keeping

The Information Governance team will keep a Record of Processing Activity (ROPA) that takes place as a result of coronavirus (COVID-19) as well as recording details of any temporary Data Sharing Arrangements. These will be reviewed once government advice changes. Any specific instructions we receive about the disclosure, deletion or return of your personal data will be implemented.

Information security

The Council’s existing technical and organisational measures to protect against unauthorised or unlawful processing of your personal data and against its accidental loss, destruction or damage remain in place.  

Further information

If you have any concerns or questions about how we are looking after your personal information, during the COVID-19 pandemic, please contact our Data Protection Officer at dpo@richmondandwandsworth.gov.uk.