Worcestershire County Council will collect and use your personal information in order to help coordinate and respond to the coronavirus (COVID-19). Here2Help Worcestershire provides a central location for individuals needing to request help, for those who want to volunteer to help, and to find useful resources.

The council will collect and use your personal information in order to manage and mitigate the spread and impact of the current outbreak of coronavirus (COVID-19):

• to protect public health
• to provide public health and social care services to the public
• to monitor and manage the Covid-19 outbreak and incidents of exposure.
• for the purposes of research, health and social care data, including ‘confidential patient information’ including physical/mental health

Information collected and processed will enable the Council to fulfil our obligations to keep people safe, ensure contingency plans, aid business continuity, and safeguard those considered high risk or vulnerable as a result of the outbreak.

The Council will collect only the personal information we need to facilitate this service.

We will collect or process:

• your name
• your contact details (email address, phone number)
• your address and postcode
• the district you live in within Worcestershire

We may also collect or process:

• details of the help you need
• information about the help you can offer including how far you are able to travel to provide this help or support and whether you are DBS checked
• details about your health and physical or mental condition

The legal bases for processing this personal information are:

• task in the public interest under the official authority of the Controller
• compliance with a legal obligation
• to protect the vital interests of individuals
• consent of the individuals

The processing condition for special category personal data:

• necessary for reasons of public interest in the area of public health

The Department of Health and Social Care has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require us to process confidential patient information for purposes set out in Regulation 3(1) COPI.

We may need to share the personal information you have given to us or we’ve collected about you with partner organisations and other third parties where relevant. These include but are not limited to:

• following your agreement, specific identified individuals who are in need of the help or support you have offered
• social care services if they may be able to provide the help or support you have requested
• District Councils if they may be able to provide the help or support you have requested or be able to utilise the help you have offered
• voluntary, community, charity organisations or businesses if they may be able to provide the help or support you have requested or be able to utilise the help you have offered
• NHS services if they may be able to provide the help or support you have requested or be able to utilise the help you have offered
• The Department for Environment, Food and Rural Affairs (Defra) if you are eligible for the non -shielded food vulnerable program run by Defra to support certain individuals in accessing supermarket deliveries; Defra may make your personal data available to supermarkets who join the program, including Tesco plc, for the purposes set out in the separate privacy notice they will send to you
• Public Health England (PHE)

Information will only ever be shared when it is strictly necessary to help us provide effective services and you may have the right to refuse. We will not pass it onto any other parties unless required to do so by law or in all reasonable circumstances the disclosure is fair and warranted for the purposes of processing or subject to a data protection exemption.

We have specific data sharing agreements in place with local agencies and sometimes the law requires that we may have to pass your details on to a third party, for example, to prevent crime.

We will hold personal data only for as long as necessary for the purposes it has been collected for. More information about our retention periods can be found in our summary Disposal Schedule (Excel file).

It is currently defined that any data shared with Defra for the purposes of the non-shielded food vulnerable programme will be held by them for a maximum period of 18 months from the commencement of the scheme. However due to the uncertainty surrounding the duration of the pandemic, this period will be subject to review.

Data processed under the ‘COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020 will be shared until 30 September 2020 or until such time as it is extended.

Please note that any stated retention periods may be subject to any legal holds imposed under the Inquiries Act 2005 that may concern the information and override standard retention periods.

NHS Shielded Data List for local authorities

We are also processing data we have received from the NHS Shielded Data List of extremely Vulnerable People. This will only be processed for the specific purpose it has been provided to us: to cross check which individuals on this list are existing social care service users or are otherwise known to the Council as vulnerable so we can prioritise contact with individuals to offer help, social care and support. 

This data will be handled in accordance with the Memorandum of Understanding and the guidance issued by the Government Digital Service (GDS), NHS Digital (NHSD), Ministry of Housing, Communities and Local Government (MHCLG).

Public Health England Rapid Data

We are also processing data we have received from Public Health England.  The Data shall be processed for the purpose of delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services. Specifically, this will enable:

• understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;
• identifying and understanding information about patients with Covid-19 and collecting information about services in relation to testing for Covid-19;
• monitoring and managing the response to Covid-19 by health and social care bodies in relation to testing for Covid-19;
• research and planning in relation to testing for Covid-19

The data elements that will be shared are:

• record ID
• sex
• age
• postcode
• ethnic group
• occupation
• patient key worker status
• COVID-19 or specimen test date
• COVID-19 test location type (laboratory, mobile testing station, home test)

You are entitled to a copy, or a description, of the personal data we hold that relates to you, subject to lawful restrictions. Please go to our Make a Data Protection Request page to find out how to make a request.

You may be entitled to rectification, restriction, objection, and erasure of your personal information depending on the service and legal basis. Please contact dataprotection@worcestersgire.gov.uk to exercise these Information Rights or call the main Worcestershire County Council contact telephone number of 01905 765765.

Please see our overarching Privacy Notice for further contact details and if you have a complaint about your information rights.

We keep this Privacy Notice under regular review and we will place any updates on this web page. This Notice was last updated on 26 June 2020.