Coronavirus (Covid-19) privacy notice

In these difficult times, we are working very closely with our partners with central government, health and care providers, voluntary sectors as well as the volunteers who are helping to deliver the really vital care and support to our local communities. This means that we will need to receive and share personal information about our residents. This notice provides information about what kind of personal information that may be, what we may do with it and who may have access to it.

Cambridgeshire and Peterborough Local Resilience Forum (CPLRF)

The Cambridgeshire and Peterborough Local Resilience Forum declared a Covid-19 major incident on the 23 March 2020 and The Civil Contingencies Act 2004 (CCA) establishes a clear set of roles and responsibilities for those involved in emergency preparation and response at the local level.

The Civil Contingencies Act 2004 and its associated regulations and guidance sets out the responsibilities on Category One organisations to plan for and meet the needs of those who may be vulnerable during an emergency. The arrangements include making and maintaining plans, warning and informing and business continuity during an emergency. 

The Cambridgeshire and Peterborough Local Resilience Forum Vulnerable People Protocol sets out the multiagency approach to ensuring as reasonably practicable the welfare of vulnerable people.  The implementing of the protocol will facilitate the county-wide community hub to support locally identified vulnerable people during Covid-19 incident. 

The primary focus of this protocol is to empower frontline services and voluntary sector by providing them with timely information about the vulnerable people and support requirements of their patients, service users and customers and be in a position to know what support is required and how to manage delivery of care during the Covid-19 response.

During the response to this public health emergency, under the Civil Contingencies Act (2004), Category 1 and Category 2 responders have a duty to share information with other responder organisations.

The information we hold and who it is about

Both councils already hold information about the people who use our services which are described in our privacy notices available on the Cambridgeshire County Council website and the Peterborough City Council website in more detail.

To help with the care and support, the types of council held information being used currently are:

  • Adult Social Care which would include information about vulnerable adults, carers and their families
  • Children’s Social Care which would include children in need of safeguarding and foster care
  • Education which would include schools, those with Education, Health and Care plans, or those receiving early years funding
  • Commissioning which includes how we ask third parties to provide services on our behalf

There will be other council services such as Housing Benefit, Council Tax and the Electoral Register which we may use to help us identify groups of individuals who may need our support because they meet the vulnerable criteria.

The kind of personal information we may use/access are names, age, household composition, addresses and contact details (email, phone numbers, mobile numbers and social media contacts). We may also use/access special category around health and care needs to help us identify and provide the support to those who most need it.

The information we collect is recorded in paper files, in databases and in electronic folders on the councils’ secure networks where it is accessible only to staff who need to see it to deliver services to support our work around COVID-19.

Sharing information

We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and best service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.

This means that we will only share information where is it necessary and proportionate to delivering care and support. We will share information with and receive information from the list below:

  • Department for Health
  • Department for Education
  • NHS
  • Our local NHS Trusts such as Cambridgeshire-Peterborough Foundation Trust, North West Anglian Foundation Trust, Cambridgeshire Community Services
  • Hospitals
  • GPs and our local Clinical Commissioning Group (CCG)
  • Local authorities in Cambridgeshire including city and district councils
  • Voluntary sector providers such as The Red Cross
  • Health and care providers that we work with
  • Schools
  • County, city, district and parish councillors who will support our efforts across the county in their roles
  • Community Hub Volunteers who will be working with the councils and our partners. They will only have access to the information they need to do that work and will be bound by our data protection policy.

This is not an exhaustive list and may change as the situation does.

Volunteers

If you have volunteered to help the councils and become part of the Community Hub, then we will collect, use and store personal information about you. This will be your name, address, contact details and experiences as well as any relevant medical conditions to enable us to make best use of you. We may share your information with voluntary sector providers and other agencies if you are going to be working for them. Any information you provide will only be used for the purposes of the response to COVID-19.

Vulnerable patient data

It is critical that we know who the most vulnerable people are who need our support because of their pre-existing medical conditions. We are being provided with the information from the NHS’ Vulnerable Patient List to enable the councils and our partners to deliver the kinds of support needed. This information will include names, addresses, contact details, information taken from the online form completed and key information such as whether they can get their essential supplies delivered.

This will form part of the Vulnerable Persons Service. This service will relate to food, medicine, medical, health and/or mental health support.

Child protection - information sharing data for 0-19 Services

NHS England has identified a risk that health visitors and school nurses will not receive information about vulnerable children whilst social distancing is in place. Consequently, NHS Digital will provide data from the Child Protection - Information Sharing (CP-IS) system to 0-19 Services about children subject to a Child Protection Plan, pregnant women with an Unborn Child Protection Plan and children who are designated a Looked After Child, in particular children being cared for under the Children's Act 1989.

Data recorded by the councils on CP-IS will be included in the extracts. They will be shared with health visitors and school nurses commissioned by our Public Health service so that the health and welfare of vulnerable children and young people in Cambridgeshire and Peterborough is protected during a period where face to face contact with statutory services is reduced. Further details can be found on the NHS Digital website.

How we will use the information

We will use the information we collect to deliver a number of services which may include:

  • Identifying those in higher risk groups to offer them support such as food collection, medical collection and deliveries
  • The provision of social care and support
  • The provision of health and/or mental health support
  • The Vulnerable Persons Service
  • Awareness and advice
  • Volunteer services
  • Enabling plans to be made to support children returning to school

This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.

Data protection

Under the General Data Protection Regulation (GDPR), we have to identify our lawful basis for collecting, using, sharing and storing personal information. We are relying on Article 6(1) (e) of the GDPR to process personal information which means we are doing so as it is a task in the public interest. This means that it has a basis in the law and is often a statutory duty as we describe below. We also have to identify a lawful basis to process special or sensitive data which in this case is Article 9(2) (g) again where it is a task which is of substantial public interest to meet our duties. We are also processing the information under Article 9 (2) (h) as it can be for the purposes of health and social care.

In some cases, we will already have the information needed for our response to coronavirus as we hold it for very similar reasons, for example it is needed for our usual  statutory duties around social care and health care. We are using other personal information such as the Electoral Register to help with delivering care and support to those who need it as part of our statutory duties and where we believe it is in the public interest to do so.

We already have a duty to protect and improve the well-being of our residents under laws like the Local Government Act 1972, the Children Act 1989 and the Care Act 2014. We have also been given authority to process confidential patient information under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. The Secretary of State for Health and Social Care has issued a notice to the councils to enable them to do so, at present until 20 September 2020. A copy of this notice is available on the GOV.UK website.

We also have powers under the Civil Contingencies Act 2004 which allows personal/sensitive information to be used where it is necessary to protect the vital interests of individuals, where either consent cannot be given or cannot reasonably be expected to be obtained. Vital interests do not just mean ‘life or death’ but also situations where there is a risk of significant harm to life and relate to emergency operations where individuals lives are potentially at risk.

How long we keep information for

The information which we already held will be kept in line with our retention schedules however we will be collecting new information directly as a result of the current situation. There is a limited period of time for which we will keep the information we collect specifically for the response to coronavirus and COVID-19. As we do not yet know how long the situation or response will last then the requirement to keep information will be kept under review however it is likely to be at least a year after the situation is less critical, unless it is based on consent. Any information retained with consent may need to be deleted if consent is withdrawn.

Your rights

You have rights under Data Protection and these are as detailed in the corporate notice and can be accessed on either councils’ pages. You can also find how to make a complaint or raise a concern with both councils.