COVID-19 Hub Privacy Notice

Those who are ‘shielding’ during the Covid19 pandemic;
Those who are not shielding but in need of support due to Covid19 (perhaps because they are self-isolating, their economic circumstances have changed or their usual support arrangements have been disrupted);
Those who have been asked to self-isolate by the national NHS Test and Trace service; and
Those who qualify for a vaccine but require support or additional information before they accept it.

The notice explains the purpose for processing this information, categories of personal information and who we may share it with. The general functions are described in the service Fair Processing Notice.

The Hub coordinates a wide range of services for residents affected by Covid19. The core areas are:

Access to food;
Support with shopping and other errands;
Delivery of medication and prescriptions
In support of the NHS Test and Trace service; and
Assistance to receive a vaccination.

The Hub also acts as a first point of contact for all related enquiries and ongoing case management. As such it is a route to a wide range of council support, such as advice on Council Tax, Benefits and financial support.

These services are being provided in line with the wider processing detailed within our corporate fair processing notice.

In order to provide a quality service, the Council must collect, hold and process a considerable amount of information, including personal information relating to personal circumstances and general information relating to service use. It does this to provide services in the most effective and efficient way that it can.

We collect the following information

Personal information (name, address, contact details and NHS number) for all ‘shielding’ residents has been provided to the council by the government’s Ministry of Housing, Communities and Local Government (MHCLG). We have entered into a Memorandum of Understanding issued by the MHCLG that sets out how the council will ensure your personal information remains secure and is used appropriately.

This information has been provided to the Council with the express purpose of ensuring you receive the support you need from the council to ‘shield’ yourselves from Covid19 for the 12 weeks advised by government.

Personal information (name, address, contact details) is collected for all other residents who are not shielding but contact the Covid19 Hub for support.

Personal information (name, address, contact details, NHS number, gender, ethnicity and test information) is provided by the national NHS Contact Tracing Advisory Service for residents who have been asked to self-isolate.

Personal information (NHS number, name, age, postcode, phone number ([mobile and landline]) is provided under a data sharing agreement with North West London Integrated Care System (NWL ICS) for residents who qualify for a vaccine but have not yet received it.

NWL ICS are the Joint Data Controllers defined in the Whole Systems Integrated Care (WSIC) Interoperability Service Specification and include primary care, providers (acute, community and mental health) and social care (local authorities).

Your personal information is only used for the specified purposes listed above. Your information will be stored on Council systems in line with Council retention policies. Your information may be anonymised and aggregated to improve and develop Council services. Information held on Council systems may also be used to prevent and detect fraud as set out in our Fair Processing Notice. Where practicable we will always seek to inform you of any significant proposed changes to how we process or intend to process your personal information.

Personal data is collected and retained to support delivery of services to residents during the Covid19 pandemic. The key services delivered include food provision, shopping, assistance with accessing medication, prescriptions and vaccinations and social support. Personal data collected includes household composition, living circumstances, care arrangements, utility arrangements, dietary requirements, online access, general support requirements as well as support that has been provided.

How we collect your information

In order to fulfil our legal duties, it is important that we have access to your personal data, as it helps us to deal with your queries and provide services. We collect information in a variety of lawful ways, including:

For shielded residents through provision of data by MHCLG.
For residents who are required to self-isolate following a positive Covid-19 test through provision of data by the NHS Contact Tracing Advisory Service.
Through Health and Social Care service partners to support residents who qualify for a vaccine
Direct contact from a resident for a service (for example through the Hub or another council service).
Via third party referrals (for example voluntary agencies, family representatives).
From elected members.

Legal basis for using your personal data

Although access to your data is restricted, there are occasions when we need to share it with others. Some examples are:

Where we have a lawful basis to do so, for example in general performance of a contract or service.
As part of public task and public duty where appropriate to do so.
When we are legally obliged to, for example debt collection or in connection with legal proceedings.
For the detection and prevention of fraud.
In the event of an emergency or risk of serious harm or threat to life, when the emergency services and other local authorities may need it to assist.

Who else will we send your data to?

We will only share information with any third party where there is an Information Sharing Protocol in place to allow joined up and coordinated support to be provided to individuals affected by Covid19, whilst safeguarding rights to privacy. This includes:

The NHS Volunteer Scheme.
Government bodies such as MHCLG/DEFRA who are involved in service delivery, for oversight purposes.
Bodies involved in prevention and detection of crime and fraud (for example: DWP, HMRC).
External / Partner Health and social care organisations.

The Council has entered into a data sharing agreement with DEFRA to allow non-shielding vulnerable residents to secure a priority online supermarket delivery slot with either Tesco or Iceland. Any resident wishing to access this service from Tesco will be required to provide their Personal information (full name, email address, contact number, address) and this will be shared with DEFRA and Tesco to facilitate the delivery of this service. Staff will explain this to any resident wishing to use the service and ensure they have their agreement to proceed on that basis. Residents can request for this information to be updated or deleted by Tesco and DEFRA at any point by contacting the Council.

Our vaccination and support services are achieved through the lawful provision and transfer of data with our Health and Social Care partners. This includes data from the NWL ICS via the North West London Whole Systems Integrated Care (NWL WSIC) and its onward sharing with Health Care Central London, for the purposes of enabling them to liaise with GP practices about any support needs identified by our service.

How long do we keep your information?

We will only keep your information for as long as is required by law and to provide you with the necessary services in line with our stated retention policy. Government guidance is that data should be held for a minimum of 18 months before being reviewed. However all master data provided from the NHS and NSSS will be deleted.

We may also anonymise personal data, to allow the Council to effectively target and plan the provision of services. At this point the data would cease to be personal data.

Your rights and access to your information

You have the right to have a copy of the information that we hold about you. The Data Protection Act 2018 also gives you additional rights that refer to how the council holds and uses your information.

Consequently, under certain circumstances, by law you have the right to:

The right to object and restrict further processing of your data; however, this may affect service delivery to you.
Request to have your data deleted where there is no compelling reason for its continued processing and provided that there are no legitimate grounds for retaining it.
Request your data to be rectified if it is inaccurate or incomplete.
Where feasible, have your data transferred or copied should you move to another authority.
Not be subject to automated decision-making including profiling.

Further information about how to submit a Subject Access Request.

Please visit the Data Protection page for further details on how the council complies with the new Data Protection Act 2018.

If you have any concerns

Please contact us if you would like to know more about the information we hold about you and how we use it at [email protected].

You have a right to complain to us if you think we have not complied with our obligation for handling your personal information; please email: [email protected].

If you are not satisfied with the Council’s response you have a right to complain to the Information Commissioner’s Office (ICO). You can report a concern by visiting the ICO website.

Last updated: 3 May 2022

On this page