Coronavirus privacy notice

This privacy notice is designed to help you understand how and why North Yorkshire Council processes your personal data. This notice should be read in conjunction with our corporate privacy notice.

Who are we?

North Yorkshire Council is a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).

North Yorkshire Council has statutory duties and responsibilities to fulfil as set out by the civil contingencies act (CCA) 2004. To fulfil these duties, the council processed the personal data of service users to support individuals during the Covid-19 pandemic in order to prevent and/or mitigate the impact of the virus (in compliance with the civil contingencies act).

During the pandemic, the processing of personal data changed rapidly and affected various multiple services across the council. To reflect this, we produced a single privacy notice for the processing of personal data related to Coronavirus (Covid-19) to be read in conjunction with other relevant privacy notices relating to specific council services. Following the de-escalation of the governments response to the Covid-19 situation, we have updated this privacy notice to help you understand how the council will continue to process information collected during the Covid-19 pandemic.

The council has appointed Veritau to be its data protection officer. Their contact details are:

Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA

Email: infogov@northyorks.gov.uk

Tel: 01904 552848

What personal information relating to the Covid-19 pandemic did the council collect?

In relation to Coronavirus (Covid-19), the council collected certain types of personal information and ‘special category’ data. This may have included, but not necessarily limited to, the following:

• name
• contact details
• address or other geographical marker
• medical Information, age or any other personal information which would mark a vulnerability to the virus
• recent history of contacts with other individuals or any other personal information which could help prevent or trace transmission of the virus
• any other personal information which the council is asked to be collected by the relevant health or government authorities to mitigate the risks associated with Coronavirus (Covid-19) this includes health risks, economic risks and social risks
• contact information provided by third parties for example, pubs, restaurants, etc. for a Covid-19 purpose

Why did the council collect your personal information?

The council has certain responsibilities towards ensuring good public health and the health of individuals under its care. The Coronavirus (Covid-19) situation meant that to fulfil these responsibilities, including statutory obligations, the council may have collected additional personal information where relevant to the prevention or mitigation of the impact, of the virus (in compliance with the CCA).

The personal information that the council collected was processed in order to:

• understand Covid-19 and the risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19
• support NHS test and trace
• identify and understand information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19
• the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19
• understand information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care
• monitor and manage the response to Covid-19 by health and social care bodies and the government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
• deliver services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services
• with your consent, provide basic information to community organisations, supermarkets and volunteers to provide you with support you have requested, such as picking up groceries
• research and plan in relation to Covid-19

The council may also have collected and processed personal information in order to mitigate the other impacts of Coronavirus (Covid-19) such as economic or social impacts.

Who did we obtain your information from?

As part of the council’s response to the Coronavirus pandemic, we may have collected information from other organisations including, but not limited to, the following:

• other council services, public bodies and authorities including North Yorkshire Council and other district councils within North Yorkshire
• central government
• emergency services
• NHS agencies
• healthcare organisations
• voluntary organisations

Who did we share this information with?

During our response, we may have shared information with other organisations, including, but not limited to the following:

• other local authorities
• central government
• emergency services
• NHS agencies
• healthcare organisations
• utility companies
• voluntary organisations
• schools
• supermarkets (for priority delivery slots only)
• other relevant partners such as certain charities or public services

How long do we keep your information for?

The council processed your information to assist with the response to the Covid-19 pandemic. The UK government has announced the Covid-19 public inquiry which requires the council to retain information for compliance with the inquiry. Once concluded, the council will dispose of information in accordance with appropriate retention periods.

What is our lawful basis for processing your information?

North Yorkshire Council relies on the following lawful basis to process your personal data:

The legal basis the council relied upon during our Covid-19 response will have been determined by the specific process. When processing your personal data, North Yorkshire Council relied upon (and will continue to rely upon where necessary) the following lawful basis as applicable:

• UK GDPR Article (6)(1)(a)- the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• UK GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject
• UK GDPR Article 6(1)(d) – processing is necessary in order to protect the vital interests of the data subject or of another natural person
• UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest

Some of the personal data processed by the council is defined as special category data. In order to lawfully process this type of information, the council relied upon (and will continue to rely upon where necessary) the following Article 9 conditions:

• UK GDPR Article (9)(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
• article 9(2)(c) – processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

UK GDPR Article 9(2)(g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2, of the Data Protection Act 2018 as below:

• (6) Statutory and government purposes
• (16) Support for individuals with a particular disability or medical condition
• (18) Safeguarding of children and individuals at risk
• (19) Safeguarding of economic well-being of certain individuals
• article 9(2)(h) - Health or social care (with a basis in law)
• article 9(2)(i) - Public health (with a basis in law)

The legislations, policies and guidance that underpin this processing include, but are not limited to:

• Civil Contingencies Act (CCA) 2004
• The Local Government Act 2000
• The Local Government Act 1972
• Care Act 2014
• Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005