COVID-19 Response Work privacy policy

Skip to:

COVID-19 Response Work

Between 2020 and 2022 the council processed personal data for a variety of purposes relating to the pandemic response.

The council had key activities as part of its COVID-19 Response. These were: 

  • identifying and supporting high risk and vulnerable residents
  • identifying at risk staff, and redeploying staff to essential services
  • delivering Support Hubs
  • crime prevention for pandemic-related laws and anti-fraud activities
  • Test and Trace delivery and support, testing and vaccine delivery and monitoring public health status and needs

Most of the personal data processed for pandemic purposes was either kept as part of a normal case file or has been transferred into our normal business processes. For example: 

  • extra social care support provided to you is part of your social care records
  • COVID-19 relief payments are part of your business rates or benefit records
  • changes to your business licensing to relax or change rules are part of your licensing records

The council will continue some work related to the pandemic, but this will be done as part of normal processes, such as paying benefits or public health data analysis. Find out more about full privacy notices

Test & Trace

The council worked with the NHS and Public Health England to carry out different activities. This included:

  • contact tracing, using data from the NHS Test & Trace scheme and contact details we already held for residents, for example, social care or council tax records
  • coronavirus testing for residents, including working with PHE and local and voluntary sector organisations to run testing sites or provide outreach testing programmes
  • making sure that those who needed to isolate did so and supporting them throughout

The data we processed and shared with PHE for Test & Trace included: 

  • your full name and ethnicity, language spoken 
  • your address, postcode, phone number and email address 
  • the date of symptom onset 
  • your test results, where the council has this information, for example, when we run outreach testing 
  • details of those with whom you had been in contact

The council also used personal and special category data gathered from its own files (social care, revenues and benefits) or from partners (NHS including Test & Trace, Public Health England, Barnet Homes, electoral registration, police, fire and ambulance services, voluntary and charities). 

As of February 24, 2022, the council no longer undertakes contact tracing specifically for COVID-19 and does not have direct access to the NHS Test & Trace system.  

Personal data processed for COVID-19 Test & Trace purposes between March 2020 and March 2022 is retained for 12 months from 1 April 2022, for analysis and research purposes. 

The council has wide responsibilities for public health, and it is a normal part of our work to identify, manage and prevent outbreaks, such as COVID-9 or Legionnaire’s Disease. The Public Health privacy notice describes this work. 

Vaccinations

The council supported the national vaccination programmes, including running vaccine sites where necessary, but we do not retain any personal data.

Contact Tracing for our sites

We asked you for basic contact details as you entered our buildings (libraries, museums, children’s centres, community centres and council office buildings). 

This data was kept safely for 21 days and then securely destroyed. We no longer ask for or keep this data. 

 

The council used personal and special category data of employees to:  

  • facilitate the increase in home working. 
  • identify those staff at high risk and mitigate for their safety and service delivery. 
  • manage redeployment of staff to priority areas.   

The council continues to keep records of sick absence in the normal way on the HR system. Records of self-isolation and redeployment are kept by line management for a short period as necessary to manage service delivery and staffing.

Record of vaccination status, where vaccination was/is required by law or council policy, are kept by line management for 12 months from 1st April 2022. 

Personal information collected 

  • Name 
  • Address & contact details 
  • DOB 
  • Financial information 
  • Equalities Information 
  • Property information 
  • Criminal/Prosecution Information  
  • Health/Medical Information   
  • Social Services Records  
  • Human Resources Records 
  • Equalities information 
  • Other Agencies Involved  
  • Education Information  
  • Housing Information   
  • Employment 
  • Family/Relationship Information 
  • NHS Number 
  • Support Network 
  • Referees 
  • Referral/Assessment Information 
  • Images in photographs or film/CCTV 

Who we share the information with  

  • DWP  
  • Health Agencies including NHS Trusts and Public Health England 
  • Council services  
  • Voluntary Agencies /Third Sector 
  • Housing providers 
  • Police  
  • Government departments 
  • Legal representatives  
  • Council legal service 
  • Judicial Agencies such as Courts  
  • HMRC 
  • Other local authorities 
  • Professional Regulatory Bodies 
  • Trade Unions 
  • Home Office

Legislation that applies 

Much of the council’s work to support individuals during the pandemic has formed part of our usual obligations for safeguarding, such as: 

  • Care Act 2014: this allows councils to process and share data to promote individual well-being, prevent the individual need for care and to support and promote the integration of health and social care
  • Children’s Act 1989: this allows councils to process and share data to safeguard and promote the wellbeing of children
  • Homelessness Reduction Act 2017: this allows councils to process and share data as part of taking reasonable steps to help applicants secure accommodation 

In addition, the council processed personal data under the following legislation: 

  • Civil Contingencies Act 2004: this allows councils to process and share data as part of complying with our duty to plan and prepare for, advise about, respond to and recover from emergencies
  • The Department of Health & Social Care issued Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002, to require local authorities to process personal and special category data to support the Secretary of State’s response to COVID-19

These pieces of legislation give the council power to use personal data for the following purposes. Because we have: 

  • a legal obligation (GDPR Article 6, 1 (c)) 
  • a public task (GDPR Article 6, 1 (e)) 
  • duties under employment law (GDPR Article 9, 2 (b)) 
  • a substantial public interest (GDPR Article 9, 2 (g)) 
  • to provide health and social care (GDPR Article 9, 2 (h))

In circumstances of immediate and serious risk to an individual, the council can use personal data to protect the ‘vital interests’ of individuals. (GDPR Article 6, 1(d) and Article 9, 2 (c)) 

Data protection legislation also allows us to use personal data for public health reasons, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care. (GDPR Article 9, 2 (i)) 

How long we keep your information 

Most of the data processed to provide support and deliver services throughout the pandemic form part of the relevant service records, such as for benefits or safeguarding. The retention listed within the relevant published privacy notice will apply.  

Personal data processed for COVID-19 Test & Trace purposes between March 2020 and March 2022 is retained for 12 months from 1 April 2022, for analysis and research purposes.