COVID19 - How we use your information

This notice describes how we may use your information to protect you and others during the Covid-19 outbreak. It supplements our main Privacy Notice.

The health and social care system is facing significant pressures due to the Covid-19 outbreak. Health and care information is essential to:

• deliver care to individuals
• support health and social care services
• protect public health

Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it is even more important to share health and care information across organisations.

Existing law is being used during this outbreak. It allows confidential patient information to be used and shared appropriately and lawfully.  This is in a public health emergency. The Secretary of State has required:

• NHS Digital
• NHS England and Improvement
• Arms Length Bodies (such as Public Health England)
• local authorities
• health organisations
• GPs

to share confidential patient information to respond to the Covid-19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak. Unless there is another legal basis to use the data. Further information is available on gov.uk.  Some FAQs on this law are also available on the NHS website.

During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak.  This is due to the public interest in sharing information. This includes National Data Opt-outs. It may also take us longer to respond to:

• Subject Access requests
• Freedom of Information requests
• New opt-out requests

whilst we focus our efforts on responding to the outbreak.

To look after your health and care needs we may share your confidential patient information.  This includes health and social care records.  This may be shared with clinical and non-clinical staff in other primary health and social care providers. For example:

• neighbouring GP practices
• hospitals
• community health services
• voluntary sector
• NHS 111

Examples of organisations assisting in the Council’s COVID19 response include but are not limited to:

• Royal Cornwall Hospitals Trust
• NHS Kernow Clinical Commissioning Group
• Cornwall Partnership Foundation Trust
• Age UK
• Cornwall Council social care providers including care homes and home care services
• Newton Europe Ltd
• Housing providers

We will ensure we remain compliant with Data Protection legislation.  We will only share what is proportionate and necessary.  This is in order to provide a response to the COVID19 pandemic including relevant Council services.

We may also use the details we have to send public health messages to you. Either by phone, text or email.

We will also be required to share personal/confidential patient information with health and care organisations. As well as other bodies engaged in disease surveillance for the purposes of:

• protecting public health
• providing healthcare services to the public
• monitoring and managing the outbreak

Further information about how health and care data is being used and shared by other NHS and social care organisations.

NHS England and Improvement and NHSX have developed a single, secure store.  This is to gather data from across the health and care system to inform the Covid-19 response. This includes data already collected by:

• NHS England
• NHS Improvement
• Public Health England
• NHS Digital

New data will include:

• 999 call data
• data about hospital occupancy and A&E capacity data
• data provided by patients themselves

All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

In such circumstances where you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require. We will ensure that any information collected is treated with the appropriate safeguards.

The Neighbourhoods and Public Protection Service is also engaged in enforcement activities.  This is to ensure that citizens and businesses are abiding by legislation put in place to protect the spread of COVID19. We share information with Devon and Cornwall Police and Highways England.  This is in order for appropriate action to be taken

Cornwall Council and NHS Test and Trace

The easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. The Department of Health and Social Care (DHSC) has asked organisations to support this service.  This includes Cornwall Council. They can do this by keeping a temporary record of our customers and visitors for 21 days. Staff data will be obtained using office sign-in registers and the desk booking system. In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.

Requirement to provide information

The DHSC are clear that this is a voluntary scheme and nobody visiting our premises is required to provide their details.  Please tell a member of staff when you visit if you do not want your booking details to be used for Test and Trace purposes.

Although this is a voluntary scheme we strongly encourage our customers and visitors to share their details.  This is in order to support NHS Test and Trace. This information will only be used where necessary to help stop the spread of COVID-19.

The accuracy of the information provided will be the responsibility of the individual who provides it. The Council will not verify any customer’s or visitor’s identity for NHS Test and Trace purposes.

We already collect and process information about persons visiting council premises.  This includes public functions, tours, weddings and meetings etc and the types of information we collect and use:

Staff, customers and visitors

• the name of the member of staff on the office sign-in sheet and desk booking system. Contact details will be obtained from Oracle in the case of an outbreak. Data may be retained for longer than 21 days as it is also used for fire safety purposes in the event of a fire alarm. 
• the name of the customer or visitor. If there is more than one person, then we can record the name of the ‘lead member’ of the group.  We also record the number of people in the group
• a contact phone number for each customer or visitor. Or for the lead member of a group of people
• date of visit, arrival time and, where possible, departure time

Recording arrival and departure times helps reduce the number of customers / visitors needing to be contacted by NHS Test and Trace. We recognise, however, that recording departure times will not always be practicable.

NHS Test and Trace QR posters have been created for key Cornwall Council buildings with public access. These can also be used by staff, customers and visitors if preferable.

Information sharing

We'll keep the information you give us in the Council’s electronic or physical secure storage facilities. We will make sure it can only be accessed by authorised staff.

In the event of a local outbreak of the coronavirus names and contact details of:

• customers and
• visitors to our sites

will only be provided to the NHS to support Test and Trace when they ask for these records, either because:

• someone who has tested positive for COVID-19 has listed Council premises as a place they visited recently, or
• our premises have been identified as the location of a potential local outbreak of COVID-19

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. See further information on how NHS Test and Trace works.

NHS Test and Trace will handle all data according to the highest ethical and security standards.  It will also ensure it is used only for the purposes of protecting public health. Including minimising the transmission of COVID-19. The DHSC has a separate privacy notice to detail how they process personal data for Test and Trace purposes.

If you are contacted by NHS Test and Trace Contact tracers they will:

• call you from 0300 013 5000
• send you text messages from ‘NHStracing’
• ask you to sign into the NHS Test and Trace contact-tracing website

Contact tracers will never:

• ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
• ask you to make any form of payment or purchase a product or any kind
• ask for any details about your bank account
• ask for your social media identities or login details, or those of your contacts
• ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
• disclose any of your personal or medical information to your contacts
• ask about protected characteristics that are irrelevant to the needs of test and trace
• provide medical advice on the treatment of any potential coronavirus symptoms
• ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
• ask you to access any website that does not belong to the government or NHS

Our legal basis for processing data

The Council is processing this personal information as it is necessary for the performance of a task carried out in the public interest.  This is in accordance with Article 6 1 (e) of the General Data Protection Regulation.

The Council will not process any special category data for this purpose.

Data retention period

The Council will only keep the information which is collected and stored solely for NHS Test and Trace for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days).  As well as an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted.

We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.

Test and Trace support payments

The Test and Trace Support Payments Privacy Notice has been drafted by the Revenues and Assessments Service.  It details how your information will be processed if you apply for support payments.

If you have any questions about our privacy notices please contact the Council’s Data Protection Officer at dpo@cornwall.gov.uk