Covid-19 PHE Privacy Notice

Personal data will be shared between Public Health England and Solihull Council during the Covid-19 emergency

Objectives for Processing

The Data shall be processed for the purpose of delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services. Specifically, this will enable:

1. understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;
2. identifying and understanding information about patients with Covid-19 and collecting information about services in relation to testing for Covid-19;
3. monitoring and managing the response to Covid-19 by health and social care bodies in relation to testing for Covid-19;
4. research and planning in relation to testing for Covid-19.

How long will the information be shared?

30 September 2020 or until such time as the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020 is extended.

Legal Gateway (common law duty)

Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002 in accordance with the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020.

Lawfulness of Processing (GDPR)

All processing must be carried out in accordance with the Data Protection Act 2018, GDPR and any associated codes of practice issued by the ICO.

More particularly, the legal bases for any processing are:

Article 6.1.(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and

Article 9.2.(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

Schedule of information that is shared