COVID-19 High Risk Groups privacy notice

This privacy notice is to make it easier to understand and provide you with more information about how Cheshire West and Chester Council may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

At this time, Cheshire West and Chester Council may seek to collect and process your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be collected in order to ensure your safety and well-being.

Such information will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government and health professionals, in order to manage and contain the virus.

It will enable the Council to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.

What personal data is being collected?

In order to best respond and help coordinate the community response for COVID-19 it is necessary to collect:

Basic details about you including name, address, telephone number and email address. WE will also need to collect details about your health to identify if you (or those closely linked to you) are in any of the high-risk categories and would be considered vulnerable, if infected with Coronavirus.

Who is processing your data?

All personal data held, is processed in accordance with data protection law. The Data Controller for the information outlined in this privacy notice is Cheshire West and Chester Council.

How we will use the information we hold about you?

We will use the information you provide to:

Connect you to support in the community as part of the COVID-19 response.
To analyse your information in order to improve the services we offer.

What is your lawful basis for processing your personal data?

The legal basis for processing the data is that it is in the public interest for us to deal with the outbreak of COVID-19.

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:

Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.
The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:
- Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
- Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.
- Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England

Who we will share your information with?

We will normally only share your information with other partner organisations as part of the response to the COVID-19 outbreak.

We will not share your information with anyone else unless required to do so under additional legal requirements, for example to assist the government in containing the spread of COVID-19. This may be where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.

Information will not be shared with other parts of the Council for any other non-related purposes.

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

How long will my personal data be retained by the Council?

The Council will only keep your information for as long as it necessary, taking into account of Government advice and the on-going risk presented by Coronavirus. At a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.

Information provided in relation to this outbreak of Coronavirus will not be used for any other purpose, including to be held within personnel files ‘just in case’ it may be needed again.

When the information is no longer needed for this purpose, it will be securely deleted.

Your rights

If you are not happy about the way your personal data is being processed you can complain directly to the Council’s Data Protection team: Contact the DPO

You also have the right to complain to the Information Commissioner’s Office.

Website: Information Commissioner's Office (ICO) website
By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 08456 30 60 60 or 01625 54 57 45

If you require further information about how we process your personal data, you can contact the Data Protection Officer: Contact the DPO

Further advice and guidance from the ICO on this issue can be found on the ICO website.