MVDC Coronavirus Privacy Notice

Privacy Notice for Personal Data Processed by MVDC Officers in Response to the Covid 19 Pandemic

Data Controller: Mole Valley District Council

This privacy notice applies where Mole Valley District Council (“MVDC”) is the body exercising control over the purpose for which and the manner in which your personal data is processed. Where we are passing personal information to the Department for Health and Social Care as part of the NHS Test and Trace program, DHSC is the data controller. The DHSC Privacy Notice is available link here.

Data Controller’s contact details:

MVDC Pippbrook, Dorking RH4 1SJ. Telephone: 01306 885001.

Data Protection Officer:

Mr Tom Penlington (Legal Services Manager). Telephone: 01306 879354

The legal basis for and the purposes of the processing:

This privacy notice describes how we may use your information during the Coronavirus pandemic.

MVDC is one of a number of delivery agencies which have responsibilities under both (i) specific coronavirus related legislation, and (ii) more general emergency planning related legislation. The over arching aims of processing personal data in response to the coronavirus pandemic are to assist in containing the pandemic and assist in mitigating its effects on individuals.

The lawful basis for processing your personal data in response to the coronavirus pandemic will, on the majority of occasions, be “public task” (ie, MVDC is carrying out its powers in the public interest or under other official authority). The power to share will relate to a legal function – which will generally be set out in legislation. However, because there are a number of reasons for processing, as part of the response to the pandemic, the lawful basis may be “legal obligation” (where we obliged by law to process the information for the stated purposes), or “vital interests” (where there is a genuine life or death emergency). Alternatively, any of the other lawful bases for processing set out in MVDC’s main Privacy Notice may apply.

Existing laws which allow personal information to be used and shared appropriately and lawfully in a public health emergency, for example those set out in the Civil Contingencies Act 2004, for the purposes of responding to that emergency, are being used during this outbreak.

Using these laws the Secretary of State has required the NHS, health organisations and local authorities to share personal information to respond to the Coronavirus outbreak.

A non exhaustive list of examples of specific types of processing includes:

Homelessness

Households placed in emergency accommodation under the homelessness legislation by Mole Valley District Council (eg, Housing Act 1996 and Homelessness Reduction Act 2017) are asked the Covid 19 health triage questions as recommended by Surrey County Council Public Health and the answers are recorded. Certain information may be passed on to the Landlord/ Licensor of the Property where this is fair and lawful, but this will always be kept to the minimum reasonably required to keep you and other occupiers or staff members safe.

Business grants

The administration of business grants to sole traders, individual trustees, partners or other named persons.

Self-Isolation Payments

From 12^th October, a one-off payment of £500 or access to a discretionary fund will be available for eligible individuals.

If you apply, we will need to process your personal data to assess whether you are eligible to receive financial support, and if so, to provide a payment to you.

Assistance for the clinically extremely vulnerable

Contacting local residents who are clinically extremely vulnerable in order to facilitate the provision of emergency aid (eg, food and medicines), or other appropriate assistance (eg, social contact).

Community Leaders

Another example where personal data that may be used to assist in the regional coronavirus response is to contact community leaders to discuss ways in which communities can pull together, principally to reduce the risk of infection. In this situation, no personal data about people in those communities will be processed by MVDC.

Dorking Halls

If you are attending the cinema or other public event at Dorking Halls, then your contact details are obtained when you book on line or come into the café. The information you provide will be kept securely by MVDC for 21 days and then destroyed/ confidentially shredded. The name and contact details of the lead contact for groups (of 6 or less) using Dorking Halls café may be requested in writing if you do not have a smart phone and have not used the NHS QR code scanning software. If this is the case they will be stored on separate sheets and place in a safe for 21 days when they will be confidentially shredded. Please refer to the DHSC privacy Notice referred to above for further information on what happens to your personal data if it is passed to a representative of the DHSC in connection with its Test and Trace program.

Enforcement against persons who are required to self isolate and are not doing so

Enforcement action can be taken against someone where they either (i) test positive for Coronavirus, or (ii) have been identified by NHS Test and Trace as having been in close contact with someone who has tested positive for Coronavirus, and, in either case, where that person is not self isolating as required by law. Any enforcement action that results, – pursuant to the Health Protection (Coronavirus, Restrictions) (England) No 3 Regulations 2020, will be taken for and on behalf of Surrey County Council, who will be the data controller. Please refer to Surrey County Council’s Privacy Notice for further information.

Local Track and Trace response

Personal data (which will for routine responses be limited to name, contact details (telephone, postal and email address) and date of birth) will be passed to Surrey County Council on request to assist with its local track and trace response to the Coronavirus pandemic. The intention of the sharing is (broadly) to identify, contact and provide advice and information to those who have contracted Coronavirus or have been in contact with those who have contracted Coronavirus.  The lawful basis for the processing is public task, but to the extent any special category personal information is shared the lawful basis will then be article 9(2)(i) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare”.  Further information about how Surrey County Council and Public Health England may use your personal information can be found on their privacy notices at https://www.surreycc.gov.uk/council-and-democracy/your-privacy/our-privacy-notices/local-tracing-partnership and https://contact-tracing.phe.gov.uk/help/privacy-notice.

Spike in cases in Mole Valley

In early November 2020 Mole Valley had the highest rates (per 100,000) of Coronavirus cases in Surrey. We are therefore looking at different ways to contact you to provide information designed to keep you informed about the local and national situation and what actions are needed or recommended to try and protect Mole Valley residents.

Special Category Personal Data:

If MVDC processes special category personal data about you, then the lawful basis is likely to be “substantial public interest” provided that (i) the processing has first been considered to be for reasons in the substantial public interest, and (ii) the purposes of the processing are in connection with one of MVDC’s functions (eg, to enable MVDC to fulfil its emergency response functions under the Civil Contingencies Act 2004). There are, however, a number of ways in which processing of special category personal data may be lawful and MVDC may seek to rely on other lawful bases too. The other lawful bases are set out in MVDC’s main Privacy Notice.

The source of the personal data:

We hold a wide range of personal information so far as is necessary to support residents, businesses, health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. The source of the information will often be you, but information may also be received from third parties including other category 1 or category 2 responders (as defined in the Civil Contingencies Act 2004)

Recipients and categories of recipients of the personal data:

We take careful consideration to only collect and use personal information when we need it and it will only be shared in order to deliver a service or meet a requirement.

We may also be required to share personal information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

Further information on onward transfers:

MVDC will not transfer the personal data you have provided outside of the UK or European Union unless this is permitted in accordance with the Data Protection Act 2018

How long the personal data will be kept for:

Any information used or shared during the Coronavirus outbreak for the purposes of our response to it will be limited to the period of the outbreak unless there is another legal basis to use the data. As the future length of the pandemic cannot be ascertained at this time we are not in a position to confirm the length of the retention period.

Automated Decision Making:

Your personal data will not be used for any automated decisions.

Data Subject Rights:

You have some specific rights in respect of your personal data. These may include some or all of the following rights to:

• see what personal data about you MVDC holds at any time (subject to certain caveats, for example where third parties are identified);
• have MVDC correct any errors (if any) in the personal data it holds about you
• request your personal data is erased (though this right will not apply where MVDC is processing your personal data because it is necessary to comply with a legal obligation).
• Request processing of your personal data is restricted (this will only apply in certain situations, for example where its accuracy is contested, where the processing is unlawful and you oppose its proposed erasure by MVDC, or where MVDC no longer needs to process the personal data but it is required by you in connection with legal claims).
• Following any changes to your personal data made as a result of (i) rectification, (ii) erasure, or (iii) restriction, MVDC will inform any third party recipients of the changes made, unless this is impossible or would involve disproportionate effort.
• object to the processing where the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller (though MVDC will still be able to continue with the processing in certain circumstances, such as if there are compelling grounds for the processing which override your interests).
• The Right to data portability which provides you with the right to receive personal data (which you have previously provided to MVDC) in a commonly used and readable format.

Will the personal data be processed for a different purpose?

Not other than as described in this or other parts of MVDC’s Privacy Notice and in accordance with the law for the reasons given. If MVDC needs to inform recipients about any action it has taken under the Data Protection Act then it will do so by placing a Notice on MVDC’s website informing the public of any relevant changes

If you are dissatisfied with how your personal data is processed by MVDC then you have the right to complain to the Information Commissioner who can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

Google Analytics

MVDC uses Google Analytics software to collect information about how you use www.molevalley.gov.uk. MVDC does this to help make sure the site is meeting the needs of its users and to help us make improvements.

The cookies MVDC uses for this purpose are:

Universal Analytics

Google Analytics

How do I prevent being tracked by Google Analytics?

If you are uncomfortable with this tracking, you can take the following actions:

• Use a tracking-blocker, such as Privacy Badger
• Clear cookies after every browsing session

Install the Google Analytics opt-out extension.