Self-isolation payment privacy notice

This privacy notice is designed to help you understand how and why North Yorkshire Council, processes your personal data. This notice should be read in conjunction with our corporate privacy notice.

Who are we?

North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).

In 2020, the Government announced a financial support scheme for those required to self-isolate under the national Coronavirus Test and Trace scheme. Further information about this scheme can be found here.

North Yorkshire Council acted as the data controller for the purposes of assessing eligibility, administering and managing the payments of those who have applied for support, under the test and trace support scheme. The department of health and social care (DHSC) commissioned NHS test and trace on behalf of the government and, at the time of the scheme, were the data controller for the purposes of providing test and trace data to North Yorkshire Council in order to validate the applicant’s isolation status.

The council has appointed Veritau to be its data protection officer. Their contact details are:

Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA

Email: infogov@northyorks.gov.uk

Tel: 01904 552848

What personal information did we collect?

To administer the Covid-19 self-isolation payment scheme, the council processed the personal information you provided when completing your application for a self-isolation support payment. This included:

• full name
• full residential address
• email address
• mobile telephone number
• home telephone number
• proxy applicant details (as above where you may nominate someone else to complete this application on your behalf)
• employer name and address
• NHS notification number (the unique reference you will be given by NHS Test and Trace Service to self-isolate)
• bank account details
• your national insurance number
• proof of self-employment e.g. recent business bank statement (within the last two months), most recent set of accounts or evidence of self-assessment

Why did we collect your personal information?

When you applied for the self-isolation support payment, we were required to process your personal data to assess whether you were eligible to receive financial support, and if so, to provide a payment to you.

We continue to process relevant information held in relation to the payment outlined above in accordance with legislative or regulatory obligations.

Who did we obtain your information from?

The department of health and social care (DHSC) administered the NHS test and trace scheme. We shared information with test and trace in order to validate a claim and to confirm if the applicant has been told to self-isolate, either because you had tested positive for Covid-19 or because you had close contact with an individual who tested positive for Coronavirus.

Who do we share this information with?

Internally, we shared information with the following areas of the council:

• revenues and benefits for council tax, housing benefit and/or council tax reduction purposes

Externally, we shared information with the following organisations:

• department for health and social care (DHSC) (NHS test and trace), department for work and pensions (DWP) and your employer for verification purposes
• her majesty’s revenue and customs (HMRC) for income tax purposes
• any other relevant body responsible for auditing or administrating public funds

How long do we keep your information for?

We will only keep your personal data for as long as it needed for the purposes of Covid-19 emergency, and for audit and payment purposes.

Please note, the UK government has announced the Covid-19 public inquiry which requires the council to retain information for compliance with the inquiry. Once concluded, the council will dispose of information in accordance with appropriate retention periods.

What is our lawful basis for processing your information?

North Yorkshire Council relies on the following lawful basis to process your personal data:

• UK GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
• UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

When processing special category data, the Council relied upon the following lawful basis:

UK GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of domestic law meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:

• (2) Health or social care purposes

The legislations, policies and guidance that relate to this service includes, but is not limited to:

• section 251 of the national health service act 2006
• regulation 3 of the associated health service (control of patient information) regulations 2002