Under the General Data Protection Regulation 2016 (GDPR) and Data Protection Act 2018 (DPA) Bassetlaw District Council, Queen’s Building, Potter Street, Worksop, Notts, S80 2AH is a Data Controller for the information it holds about you. This notice provides details of how the Bassetlaw District Council collects and uses information about you in relation to the COVID-19 Pandemic.
Lawful Basis for processing your personal data
The lawful basis for Bassetlaw District Council processing your data as a public authority will be:
- Where disclosure is in the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR)
- Where processing is necessary for a public task carried out in the public interest (Article 6(1)(e) and Article 9(2)(g) GDPR)
- Where it is necessary for compliance with a legal obligation (Article 6(1)(c) GDPR)
- Where it is in the interest of public health (Article 9(2)(i) GDPR)
Relevant legislation
Most of what we will do with your personal data will be covered by existing powers in current laws. Including:
- Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)
- Public Health (Control of Disease) Act 1984
- The Civil Contingencies Act 2014
- The Civil Contingencies Act 2014 (Contingency Planning) Regulations 2005
- Coronavirus Act 2020
- Data Protection Act 2018/GDPR
The above list is not exhaustive.
Information we collect about you
We MAY collect the following information as a result of/in our response to the COVID-19 Pandemic:
- Name
- Address
- Contact Information
- Date of Birth
- Age
- Gender
- Race
- Ethnicity
- Key Worker Status
- Health (Physical and Mental)
- COVID-19 Test Date
- Pillar
- Residence Type
- Link to Care Homes
- Associations (Contacts)
- NHS Notification Number
- Record ID
- Occupation
- Employers Name and Address
- Bank Account details
- National Insurance Number
How we collect information about you:
We collect information by the following means:
- Online i.e. our website and social media platforms
- Via email
- Over the telephone
- By paper correspondence
- In person (face-to-face)
- Through relevant 3rd parties (i.e. NHS, Public Health England, Nottinghamshire County Council etc)
Use of your personal data
We are collecting your personal data for the following purposes:
- To support service provision. We may be required to collect your personal information or re-use information we already hold about you to prioritise our services and to support/assist those most vulnerable. For some services, this information may also be used to create risk assessments to ensure the health and safety of our staff and customers.
- Statistics and reporting. We may use your personal information to manage and better understand the spread and impact of the COVID-19 pandemic in our area. This may include using or sharing your data for statistical or reporting purposes. Data will be anonymised where possible.
- To assist the NHS Test and Trace service. We are required to collect data for the COVID-19 Test and Trace service. We will ask you for basic contact details if you enter our premises, access our facilities or visit our venues. Data will only be kept for this purpose for 21 days. This data will be shared with NHS Test and Trace if there is a local outbreak and NHS Test and Trace may then contact you to provide appropriate advice. If you wish to opt out of this processing then please let a member-of-staff know at the point of processing.
- To administer Self-Isolation Payments. If you apply to us for the Self-Isolation Payment, we will need to process some personal information about you in order to administer the service, validate your application and provide the payment.
Sharing of your personal data
We MAY share your information with the following third parties for the reasons detailed above:
- Nottinghamshire County Council
- Public Health England
- NHS
- Central Government and related agencies (Department for Work and Pensions, Department for Health and Social Care, and Ministry for Housing, Communities, and Local Government
- Her Majesty’s Revenue and Customs
- Police
- GP Surgeries
- Community Groups and Volunteers
- Your employer (in relation to Self-Isolation Payment administration)
We MAY be required to disclose information about you in other specific situations such as:
- Where we are required to disclose information by law
- When disclosing the information is required to prevent or detect crime
- When disclosure is in the vital interests of the person concerned
We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes.
Keeping your personal data
We will keep your personal data in accordance with our retention schedule, unless you explicitly request it to be removed under GDPR information rights. This right to have your data removed is not an absolute right, for example, we will need to retain your data if this information forms part of a legal requirement, public registry or an existing contract.
We want to ensure any information we hold is accurate. You can help us by promptly informing us of any changes to the information we hold about you.
View the most recent copy of the Retention Schedule. The Retention Schedule is a Live Document and as such, is updated regularly. Read our policy and guidelines that govern how we manage our Retention Schedule.
Protecting your personal data
We are strongly committed to data security and will take reasonable and appropriate steps to protect your personal information from unauthorised access, loss, misuse, alteration or corruption. We have put in place physical, electronic, and managerial procedures to safeguard the personal information that we hold.
We do not currently transfer your data to any third country or international organisation.
Research and statistics
Anonymised and pseudonymised data may be used for research and statistical purposes. Any data collected may be used for research and statistical purposes that are relevant and compatible with the purpose that the data was collected for.
Your rights
There are a number of rights that you may exercise depending on the legal basis for processing your personal data. In most cases, these rights are not absolute and there may be compelling or overriding legal reasons why we cannot meet these rights in full. This will be explained to you in more detail should you contact us for any of the reasons detailed below:
- Request a copy of the personal information the council holds about you
- To have any inaccuracies corrected
- To have your personal data erased
- To place a restriction on the council’s processing of your data
- To object to processing and
- To request your data to be ported (data portability)
- To object to any automated decision-making including profiling and the right to ask for any automated decision-making to be reviewed by a human
Where the processing of your personal data is based on your consent, in most circumstances, you have the right to withdraw that consent at any time and we will act on your instructions.
For more information about how the Council may use your data and to learn more about your rights please see the Council’s Privacy Statement.
If you have any concerns or questions about how your personal data is processed, please contact the Council’s Data Protection Officer at the above address or by email to DataProtectionOfficer@bassetlaw.gov.uk. If you are dissatisfied, you can then make a complaint to the Chief Executive under stage 1 of the Council’s complaints procedure. Should you wish to pursue this further, please send your reasons in writing to the Council’s Chief Executive Officer here at Queen’s Buildings. If you remain dissatisfied with the Council’s response, you can complain to the Information Commissioner's Office in writing to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone 0303 123 1113 (local rate) or 01625 545 745.
Last Updated on Wednesday, May 8, 2024