Coronavirus COVID-19 Privacy Notice
Privacy Notice for Coronavirus - COVID-19
This privacy notice explains how we will collect, use and protect personal data specifically with regard to the Coronavirus (COVID-19) pandemic.
Our Corporate Privacy Notice contains more information on how we collect, use and protect personal data generally, as well as your rights as a data subject.
You may have provided personal information to us for a specific reason and normally, we would notify you if your information was being used for a different purpose. However, due to the rapidly emerging situation regarding COVID-19, this will not always be possible.
If we already hold information regarding your vulnerability, as defined in the current guidance from the Government, we may share this information with services, internal and/or external to us. This is for emergency planning purposes and/or to protect your vital interests.
We may need to ask you for personal information, including sensitive personal information that you have not already supplied. e.g. your age or if you have any underlying illnesses or are vulnerable. This is so we can assist you and prioritise services.
If we have information indicating that you are vulnerable, we may contact you or arrange for others to contact you to ensure your safety and to assist you where possible.
If you are a volunteer, then personal information has been shared to enable us to communicate with you. This will help in the safe co-ordination and delivery of volunteer support.
If you are using volunteer support services, we use your data to enable volunteers to support you during the COVID-19 pandemic and to keep you in contact with vital services.
We may collect information about you in respect of any financial claims or initiatives.
Processing activity - we may process personal information in support of the delivery of direct and indirect services
Information requirements - our processing activities may include:
- personal information (such as name, address, contact details, age)
- medical history and GP contact details
- health indicators (mental health status, physical activity status)
Lawful bases - our lawful bases for processing your personal information are:
- where processing is necessary in order to protect the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR);
- where processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e)
- where processing is necessary for the reasons of substantial public interest (Article 9(2)(g) GDPR);
- where processing is in the interest of public health (Article 9(2)(i) GDPR).
Reasons for processing - some of the information that is collected and shared is classified as special category personal data (health indicators, mental health status, physical activity status).
This is processed for reasons of significant public interest under the laws that apply to us, as a local authority, (see above) where this helps to meet our broader social obligations. i.e. when it is necessary for us to fulfil our legal obligations and regulatory requirements during the COVID-19 pandemic.
Data sharing - we may receive and share your personal information with and including, but not limited to:
- Our service departments (where necessary and proportionate)
- Powys Teaching Health Board
- Welsh Government
- General Practitioners, other medical practitioners
- Emergency Services
- Volunteers
- Contractors (where necessary and proportionate to do so)
- Other stakeholders (where necessary and proportionate to do so)
Retention period - we will hold your data for the duration of the COVID-19 pandemic and for a short period of time after notification from Central Government that there is no longer a pandemic.
Anonymisation- your personal information may be converted ('anonymised') into statistical or aggregated data in such a way that ensures that you cannot be identified from it. Aggregated data cannot, by definition, be linked back to you as an individual and may be used to conduct research and analysis, including the preparation of statistics for use in our reports.
We will not sell your personal information to third parties.
Right to object - where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on 'grounds relating to your particular situation'. We will have to demonstrate why it is appropriate for us to continue to use your personal data.
Further information - see the Information Commissioner's website