This notice describes how we may use your information to protect you and others during the COVID-19 outbreak.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency, it has become even more important to share health and care information across relevant organisations.

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; arms-length bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further

information is available on GOV.UK along with some FAQs on this law.

In order to look after your health and care needs, we may share your confidential information with staff in other health and care providers, for example, GP practices, hospitals and community or voluntary sector organisations. We may also use the details we have to send public health messages to you, either by phone, text or email.

We will also be required to share personal/confidential information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information is available about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response.

NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

In such circumstances where you tell us you’re experiencing COVID-19 symptoms, we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.

What information do we need?

Information has been provided to us from central government which includes the names and contact details (address and telephone numbers) of those people who need to shield as they are at greater risk should they contract COVID-19. When we speak to you, we will collect further information about your situation, including whether you need any essential items.

Where a telephone number is not provided, we will take steps using other sources of information held within the Council, such as our Council Tax records to locate a number.

Why we need it?

One of the requirements placed on local authorities as part of the pandemic response is that contact is made with those people who need to shield to ensure that they are OK and have enough essential supplies.

Where we take steps to locate a contact number via different council records, we do this in order to protect your vital interests so we can make every effort to check you are OK.

Therefore under the GDPR, we are processing your information on the basis that we’re carrying out a task in the public interest and to protect the vital interests of those more vulnerable to COVID-19.

Do we share your information?

When we call you we will ask you whether you would like us to pass your details on to any other agency, such as the Community Development Trust or Adult Services.

If we are concerned for your immediate safety in which case information will be shared with the appropriate agency without your consent.

We will also share information with GP practices in order to prevent you from being contacted a number of times about being shielded.

How long do we keep your information?

We will hold your information on a secure database for as long as we need it. Your personal information will not be subject to any overseas transfers.

What information do we need?

We need your contact details such as your name, email address and address so that we are able to contact you and provide you with the information you need in order to fulfil this role. 

Why we need it?

We need to check you are based within Torbay. We also ask for information about your community networks and communication preferences so we can send you the most relevant updates.

Do we share your information?

We do not trade personal data for any commercial or marketing purposes and we will not share the personal data you provide for this purpose with anyone else, unless we have a lawful reason to do so, such as for the prevention and detection of crime.

How long do we keep your information?

We will keep the information as long as you are volunteering in the role. Should you opt-out of the role, we will keep your information in an archive for 12 months. After that time it will be deleted.

What information do we need?

We will hold the following data in relation to people who have tested positive for COVID-19, or who have (or may have) been in close contact with someone who has tested positive for COVID-19:

• full name
• date of birth
• gender
• ethnicity
• NHS number
• address details
• contact details (email/tel number)
• occupation/key worker type
• test centre
• vulnerability group
• shielding status
• any related hospital admissions.

We will also receive data from the NHS Test and Trace Service to confirm that you have either tested positive for COVId-19 or that you have been in close contact with someone who has tested positive. 

Why we need it – lawful basis

We need personal data about you for purposes relating to contact tracing as part of the national response to COVID-19. The contact tracing programmes allows us to track recent close contacts of people who have tested positive for COVID-19, to ensure that they are quickly notified of the need to self-isolate and/or to provide support and advice to help stop the spread of the virus. Public Health England have published privacy information for NHS test and trace.

We are helping NHS Test and Trace by contacting residents who have tested positive to ask them about their close contacts and places they have visited recently.

Our lawful basis for the processing of your personal data and in making the payment to is:

• GDPR Article 6(1)(e) that it is necessary for the performance of a task carried out in the public interest or in the exercise of our official authority.

Our lawful basis for the processing of special category data relating to your health is:

• GDPR Article 9(2)(i) that it is necessary for reasons of public health in the area of public health, such as protecting against serious cross border threats to health or ensuring high standards of quality and safety of healthcare.

Data Protection Act 2018 Schedule 1 Part 1(2) – health or social care purposes.

Do we share your information?

We do not trade personal data for any commercial or marketing purposes.

In some cases, we may match your data with information from other locally held data sets, such as council tax records in order to improve the quality of contact tracing data i.e. where contact details have not been provided such as telephone numbers.  This will be done only where key information is missing and to improve the effectiveness of contact tracing – ensuring we can get hold of people as quickly as possible.

We may also share your data with NHS organisations, such as Torbay Hospital, Public Health England, GPs, where it is necessary for the purpose of contact tracing in response to local outbreaks.

In some limited circumstances, we may share data with the police for the purposes of enforcing regulations relating to self-isolation and other legal requirements related to COVID-19.

How long do we keep your information?

We will only keep your personal data for as long as is necessary for the purposes unless we are under a legal obligation or have a further legitimate reason to keep it for longer.

Whilst we are unable to state a retention period for this data at this stage, given the ongoing pandemic response required, we anticipate that we will not need to retain the data collected for the purposes of contract tracing beyond the local involvement in the response.  Public Health England’s privacy notice currently states that data on relating to individuals who test positive for COVID-19 will be retained for up to 8 years and data related to close contacts will be retained for up to 5 years.