Coronavirus (Covid-19) privacy notice

This privacy notice applies to the support and services the Council and its partners will be providing in response to the coronavirus (Covid-19) and emergency planning services. The London Borough of Hackney is committed to protecting and respecting your privacy.

This privacy notice covers contact with the Council and its officers directly (face to face), through email, telephone and the website. The privacy notice will continue to be monitored and updated. You are advised to check this page from time to time.

Information we collect

When you contact us by phone, email or through the Council’s website we may need to collect personal information about you or your family so that the appropriate support and services can be provided. The information we require from you may include personal data and special categories of personal data, such as:

• contact details – title, full name, address, email address, telephone number etc
• date of birth / age
• proof of identity – this will only be collected where required
• next of kin details
• NHS number or other identification numbers
• date of travel / last visit to high risk countries
• health details relating to your physical and/or mental health
• financial details for purposes of receiving and/or making payments
• housing information relating to your council tenancy
• details regarding whether you hold a driver’s license
• details regarding whether you have a current DBS
• IP address (if using our website)

It will only be necessary to collect this type of information where it is of relevance to the support and services you require. We will only process data that is absolutely necessary. Any information we collect about you will be strictly in accordance with the data protection law.

The information we use about you can be given to us directly by you, a family member or in some cases can be shared with us by another organisation. This includes organisations such as central government, national and local NHS bodies, the Office for National Statistics, NHS Digital, other local authorities and schools.

Why we need your information (purposes of processing)

We may use new or existing information held by the Council in order to:

• best support and protect children and individuals at risk
• exercise our public health functions, such as:
• manage risks to public health
• control of infection
• provide support and health protection
• preventing illness
• monitoring safety
• research and emergency planning
• analyse patterns and trends to help us create strategies and decision making
• future epidemiological analysis
• register you as a volunteer

The Council will check the information you provide to direct you to a suitable voluntary organisation. Your details will be passed to a suitable voluntary organisation who may contact you and request further details.

Our lawful basis for processing your information

Our lawful bases under GDPR when supporting children and individuals at risk, in relation to this pandemic, include:

• necessary for reasons of substantial public interest – Article 6(1)(e) and Article 9 (2)(g)
• providing health or social care treatment or the management of health or social care systems and services – Article 9 (2)(h)
• necessary for compliance with a legal obligation – Article 6 (1)(c) and Article 9 (2)(b) – including, but not limited to:
  • Care Act (2015)
  • Children’s Act (1989)
  • Digital Economy Act (2017)
  • Homelessness Reduction Act (2017)

Our lawful basis under GDPR when using your information to exercise our public health functions are:

• performance of a task carried out in the public interest – article 6(1)(e)
• reasons of public interest in the area of public health – article 9(2)(i)
• protect vital interests of a person
  • article 6(1)(d) and 9(2)(c)
  • article 6(1)(c)
• necessary for compliance with a legal obligation – article 6 (1)(c) and article 9 (2)(b)

If there is a significant threat to health of the public, for instance an outbreak of an infectious disease, the Council has the legal right to use identifiable data under:

• section 287 of the Health and Social Care Act (2012)
• regulation 3 of the Health Service (Control of Patient Information) Regulations 2002

2) Our lawful basis under GDPR when you register to volunteer are:

• explicit consent – article 6(1)(a) and 9(2)(a).

You can revoke your consent at any time by contacting the Council.

Who your information may be shared with (internally and externally)

If we are required to, we will only share your information with internal departments and other service providers, contractors and/or partner bodies, but only where it is necessary and as described above. Such as:

• Public Health England
• NHS
• GP practices
• central government
• other local authorities
• local voluntary partners
• emergency services
• care providers
• contracted suppliers who have been procured to provide support and services to our residents

We will strive to ensure that any personal data in our care will be kept safe and that where your information is disclosed to a third party that they ensure to do the same. We will not use your personal data for third party marketing purposes.

Freedom of Information Requests and Exercising Individual Rights under GDPR

Information in regards to Hackney Council’s preparations for, response to, and advice regarding the coronavirus pandemic is available on this website.

Any request for information during this time will be delayed due to urgent operational responses to dealing with coronavirus (Covid-19) priorities. We apologise for any inconvenience this may cause, we do remain committed to responding to your request and will respond as soon as we are able. Should our response to your request breach the statutory time-frame and you remain unhappy with our response you have the right to complain to the Information Commissioner’s Office.

Following the suspension of the Contact Tracing programme and Here to Help service, the Council no longer collects residents’ data in relation to the pandemic.

The information previously collected has been destroyed where there is no lawful basis for it to be processed.

The Public Health team no longer processes any personal identifiable information in relation to COVID cases.