Public health coronavirus (Covid-19) privacy notice

In these difficult times, we are working very closely with our partners with central government, health and care providers, voluntary sectors as well as the volunteers who are helping to deliver the really vital care and support to our local communities. This means that we will need to receive and share information about residents and businesses at a number of different levels. This notice explains what this means, what kind of information we mean, what we will do with it and who we may share it with.

Cambridgeshire County Council and Peterborough City Council have a joint Public Health directorate led by Dr. Liz Robin. You can find out more about what the directorate does here. This notice explains in more specific details what information Public Health are using to support the councils’ response to COVID-19.

Sharing information

We are working with our partners both locally and nationally to make sure that we are delivering a coordinated and best service for residents. It is critical that we do this because then we can make sure that the right people are receiving the right support from the right resources.

This means that we will only share information where is it necessary and proportionate to identifying needs for care and support. We will share information with and receive information from the list below:

• Department for Health
• Department for Education
• Public Health England (PHE)
• Contact Tracing Advisory Service (CTAS)
• NHS
• Our local NHS Trusts like Cambridgeshire-Peterborough Foundation Trust, North West Anglian Foundation Trust, Cambridgeshire Community Services
• Hospitals
• GPs and NHS Cambridgeshire and Peterborough
• Local authorities in Cambridgeshire including city and district councils
• Health and care providers that we work with

This is not an exhaustive list and may be subject to change.

How will we use the information?

We will use the information to deliver services in line with the purposes of COVID 19 as defined in the notice issued by the Secretary of State for Health and Social care under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. Data will be processed for the purpose of delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services. Specifically, this will enable:

1. understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;
2. identifying and understanding information about patients with Covid-19 and collecting information about services in relation to testing for Covid-19;
3. monitoring and managing the response to Covid-19 by health and social care bodies in relation to testing for Covid-19;
4. research and planning in relation to testing for Covid-19.

This list may change depending on the needs of the response efforts however any use of data will be proportionate and necessary for the delivery of those efforts.

The information will be stored securely in the UK and accessed only by members of staff who have authorization to access it.

What information are we talking about and about who?

Data Sets - not person identifiable

The information is about people who have been affected by COVID-19 and have been tested, either positive or not, for the virus. This is not one specific group of people.

While both councils already hold information about the people who use our services which are described in more detail in our privacy notices available on Cambridgeshire County Council website and Peterborough City Council website.

We are receiving additional information from Public Health England and partners we work with such as government, health, district councils, care homes, schools and others who may provide or be provided with information at this time to help support the response to COVID-19.

The kind of information we will be using will fall into two distinct sets but both will help with our response.

The first set is non-personalised information we receive as described below:

• Information on any outbreaks by postcode and dates which would identify specific locations such as care homes, schools and work places.
• Aggregated data on test and trace for our county which helps us understand the picture and impact as well as compare to other areas.
• Aggregated health activity data in acute, primary and secondary care settings which helps us develop actions to support those settings
• School attendance data from the Department for Education
• Aggregated data about traffic movement

The second set is pseudonymised Test and Trace data from Public Health England Cambridgeshire County Council website and Peterborough City Council website. You can find out about the way personal information is used if you are tested for the virus on the Public Health England website. In order for the councils and our partners to understand what is happening on our areas then we will receive personal information but we will not know a name or a complete address. Each record will have a unique record identifier and means it has been pseudonymised – this means that if needed then the person can be re-identified by Public Health England but not by the councils. The information we will receive will be:

• Unique record identifier
• Sex
• Age in years
• Place of residence postcode
• Ethnic group (pending a quality / completion review)
• Occupational group
• Key worker status
• Date of Covid-19 test or specimen test
• Covid-19 test location type (laboratory, mobile testing station, home test)

With this information, we will develop location specific views, area views and aggregated view over the county of testing, impact and so on to help us shape our response as well as help us understand where we and our partners like district councils can provide support. We will not know who has been tested but knowing some of these details will help to boost support or advice in some areas, as well as helping make sure that we are all supporting those who need it. The sharing of this data will be covered by contracts between the councils and partners.

The third set of data relates to the testing in specific settings by a company on behalf of the councils which is explained below.

Testing and Tracing Data – Person Level

Community Testing

Cambridgeshire County Council and Peterborough City Council have contracted a company called Commisceo to undertake tests in the community or settings if there is a potential outbreak. They will test people with their consent, may share the results with the councils and Public Health England.

We may share the following with Commisceo Primary Care Solutions who will need to collect and be provided with the following:

• Name
• Setting/address
• Date of birth
• Contact details
• Health data (swab)
• GP practice

The following may be shared with the councils and partners:

• Name
• Setting/address
• Date of birth
• Contact details
• Test date and time
• Test outcome
• GP practice

Public Health England may undertake contact tracing but in some circumstances this will be undertaken by the councils.

We may share the information with district councils to enable them to undertake contact tracing work with those who have tested positive. This may be undertaken by a council service who have a connection with the setting such as Housing or Environmental Health. The purpose of the contact tracing is:

• to enable people with COVID-19 to provide the details of people they have been in close contact with and who may have been infected with corona-virus
• to manage the process of tracing these contacts to provide advice on self-isolation and to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
• help monitor the numbers of people infected with COVID-19 and the numbers of contacts who have been traced

Contact tracers will collect the names and contact details of people who have been in close contact with that person. We will only use this information to undertake the contact tracing. Any information collected may be shared with Public Health England and CTAS for the further work on contact tracing.

Contact Tracing Advisory Service and Local Contact Tracing (CTAS)

The Director of Public Health receives information from PHE as part of the routine investigation of outbreaks and incidents. This includes information on individual cases and their contacts as required to support the public health response. This continues to help us the usual part of the management of COVID-19 outbreaks in specific settings or groups. From Monday 20 July and to augment the standing local arrangements between PHE and the Director of Public Health, we receive fully identifiable (including names) test, case and contact tracing data via a digital platform with the Director of Public Health, to further support our investigation of the COVID-19 outbreak. This is updated daily and continues to be enhanced and expanded, in collaboration with Director of Public Health. From Tuesday 4 August, Director of Public Health were able to access a tool called CO-VIS which has been developed to support the councils to both visualise and undertake spatial analysis of the data that they already receive daily. It is accessible via the same digital platform through which they currently access the record level data.

CTAS is part of Public Health England and they are also sharing the same kind of data as described above with Peterborough City Council as part of a pilot scheme where the council will contacting people who have tested positive but are not responding to the national test and trace programme. Peterborough City Council will use the information for the same reasons as above. We will also share the information with our health partners to determine whether there is a medical reason for a person not responding such as the person is an in-patient at a hospital.

We may share the information with Peterborough City Council’s Environmental Health & Licensing Service which will undertake to make contact through phone, email or visits to properties. This information will then be fed back to CTAS on whether we have made contact and the information collected if possible.

What is our legal basis for using personal information?

Under the General Data Protection Regulation (GDPR), we have to identify our lawful basis for collecting, using, sharing and storing personal information. We are relying on Article 6(1) (e) of the GDPR to process personal information which means we are doing so as it is a task in the public interest. This means that it has a basis in the law and is often a statutory duty as we describe below. We also have to identify a lawful basis to process special or sensitive data which in this case is Article 9(2) (g) again where it is a task which is of substantial public interest to meet our duties. We are also processing the information under Article 9 (2) (h) and (i) as it can be for the purposes of health and social care as well as for public health reasons.

We have been given authority to process confidential patient information under section 3(4) of the Health Service (Control of Patient Information (COPI) Regulations 2002. The Secretary of State for Health and Social Care has issued a notice to the councils to enable them to do so, at present until 30 September 2020. A copy of the notice is available on the GOV.UK website.

The Cambridgeshire and Peterborough Local Resilience Forum declared a Covid-19 major incident on the 23rd March 2020 and The Civil Contingencies Act 2004 (CCA) establishes a clear set of roles and responsibilities for those involved in emergency preparation and response at the local level.

The Civil Contingencies Act 2004 and its associated regulations and guidance sets out the responsibilities on Category One organisations to plan for and meet the needs of those who may be vulnerable during an emergency. The arrangements include making and maintaining plans, warning and informing and business continuity during an emergency.

During the response to this public health emergency, under the Civil Contingencies Act (2004), Category 1 and Category 2 responders have a duty to share information with other responder organisations.

How long do you keep information for?

The information which we already held will be kept in line with our retention schedules however we will be collecting new information directly as a result of the current situation. There is a limited period of time for which we will keep the information we collect specifically for the response to coronavirus and COVID-19. As we do not yet know how long the situation or response will last then the requirement to keep information will be kept under review however it is likely to be at least a year after the situation is less critical, unless it is based on consent. Any information retained with consent may need to be deleted if consent is withdrawn.

Your Rights

You have rights under Data Protection and these are as detailed in the corporate notice and can be accessed on either councils’ pages. You can also find how to make a complaint or raise a concern with both councils.

Cambridgeshire County Council

Peterborough City Council