COVID-19 Vaccination Programme privacy notice

This privacy notice is designed to help vulnerable Cheshire West and Chester residents in receipt of support from us to understand how we use their personal information in the COVID-19 vaccination programme.

This is a voluntary programme and it remains the choice of the individual whether to have the vaccine. If you choose to get a vaccine, we need to be able to share clients data with the lead providers to ensure all vulnerable residents in receipt of our services are given the chance to receive their vaccination as part of the early cohort.

The services covered within this privacy notice

Vulnerable Residents Data

Vulnerable resident’s personal data is needed by the NHS in order to contact them to offer a COVID-19 vaccination.

We will share some or all of the following information:

name
NHS number
date of Birth
contact details

Under the UK GDPR and Data Protection Act 2018 we are relying on the following legal basis:-

GDPR Article 6 (1) (e) Public task: The processing is necessary for you to perform a task in the public interest or for your official functions and the task or function has a clear basis in law
GDPR Article 9(2)(i) Public Health: Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’
Data Protection Act 2018, Sch 1, Part 1, (d): Public Health.

The basis in law is met by the Coronavirus (COVID-19): notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 – general:

Identifying and understanding information about patients or potential patients with or at risk of COVID-19.
Providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19.
Monitoring and managing the response to COVID-19 by health and social care bodies and government.
Delivering services to patients, clinicians, the health services and adult social care services workforce and the public in connection with COVID-19, including the provision of health care services.

Who your information may be shared with (if applicable)

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. We will only share the minimum information for each circumstance.

We may sometimes need to share some of your information with:

Health service providers including NHS Agencies
Care providers, e.g. day care, domiciliary, residential
Government Agencies (e.g. Department of Health)

The Data Controller

Cheshire West and Chester Council is the Data Controller for this processing.

Protecting your information

Your information will be securely stored on our network

How long will we keep your personal information?

The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC).

More information can be found on GOV.UK's Coronavirus (COVID-19) notice.

If we need to use your information for research or reports, your information will be anonymised and any information taken from notes (hand written or typed) during any consultation sessions will be securely destroyed. The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely

Your rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

To make a request follow the instructions on our Data protection for you page.

How to complain if you are unhappy about how your data is used

You can complain directly to our Data Protection team by email or post.

Online: Contact the DPO
By post: Data Protection Officer, The Portal, Wellington Road, Ellesmere Port, CH65 0BA

You also have the right to complain to the Information Commissioner’s Office using the following details:

Information Commissioner's Office (ICO) website
By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113

Will my personal information be accessible outside the UK?

Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information.

Your information will be stored within the UK.