Toggle mobile menu visibility

COVID-19 privacy notice for the provision of support

What this document is for

This privacy notice provides details on how we, Norfolk County Council, use your personal information for the purposes of meeting the exceptional challenges posed by the Coronavirus (COVID-19) outbreak – including testing for COVID-19, meeting the needs of individuals and providing a community response to the Covid-19 outbreak. By ‘use’ we mean the various ways it may be processed, including storing and sharing the information.

Please note: In order to help you, during this period of emergency, we may offer you a conversation via telephone or video-conferencing. By accepting the invitation and engaging in the conversation you are consenting to this. Your personal information will be safeguarded in the same way it would with any other conversation or meeting.

Further details

We also provide the following details in our general privacy notice on our website:

  • Who we are
  • How long we use your information for
  • Your rights under the General Data Protection Regulation (the GDPR) and
  • How to exercise them 

You can also ask us for a copy of this information.

What we use your information for

We may use the information about you to:

  • Arrange for testing for COVID-19
  • Trace people who have or may have come into contact with people tested positive for COVID-19
  • Handle your query and determine eligibility for urgent and essential support
  • Deliver support to you if eligible and/or connect you to support in the community. Further details can be found in the privacy notices of the relevant services on our website
  • Analyse your information in order to improve the support we offer and to enable us to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity
  • Protect public health and support health and social care services 
  • Research, monitor, track outbreaks to predict potential outbreaks and to map epidemiological trends or local geographical migration

The use of this information will be limited to what is proportionate and necessary, taking into account the latest guidance issued by Central Government and health professionals, in order to manage and contain the COVID-19 outbreak.

What personal data we collect and use about you

We will collect and use:

  • Information about you, this could include your name, date of birth, address, email address, telephone number, the area of your district council 
  • National identifiers such as NHS number, National Insurance number etc
  • Whether you fall in a risk group
  • Special issues/risks to take into consideration 
  • Your isolating situation
  • Your well-being
  • Your home circumstances
  • Your support needs and support provided
  • People you have been in contact with

We may also collect information about:

  • Language spoken (which may identify your ethnicity) and other communication needs
  • Your physical or mental health (or those close to you) including details of your disability/medical conditions, medication and mental health and wellbeing if you or someone closely linked to you are in any of the risk groups classed as “vulnerable” and “extremely vulnerable” if infected with Covid-19.

This data is classed as “special category data” under the GDPR.

Who provides this information

We receive most of this information from you, but we may also obtain some of this data from:

  • Health bodies including Public Health England 
  • Central government agencies
  • District councils
  • Family members and friends 
  • Other people you may have met
  • Members of the public 
  • Your employer
  • Health and social care providers
  • Organisations commissioned by us to provide services 
  • Police and probation services

Who we share your information with

We may need to share your information with:

  • Our internal services e.g. Public Health; Adult Social Services and Children’s Services
  • Health service providers including NHS agencies (e.g. testing agencies; GPs, Hospitals, Ambulance, Health Visitor, Mental Health Services)
  • Other local authorities e.g. district councils 
  • Care providers, e.g. day care, domiciliary, residential
  • Support groups for people with disabilities
  • Education providers
  • Health bodies including Public Health England 
  • Other government agencies (e.g. Department of Work and Pensions)
  • Prepaid card providers
  • Direct Payment Support Services
  • Housing associations
  • Voluntary Community and Social Enterprise Health and Wellbeing Alliance (HW Alliance) partners involved in the delivery/response to COVID-19 outbreak. View further information about the HW Alliance and its partners
  • Voluntary Norfolk

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

How the law protects you and the legal basis for processing your information

We have legal grounds under the GDPR to process this information because it is necessary:

  • For the performance of a task carried out in the public interest and the task or function has a clear basis in law
    These statutory powers and duties can be found in the relevant service privacy notices on our website
  • To protect your vital interests 

We have legal grounds to process (including share) special category data because it is necessary:

  • For reasons in the substantial public interest and in the exercise of a statutory function
    (The statutory functions are the same as the statutory powers and duties referred to above)
  • For reasons of the public interest in the area of public health

Your personal information will also be given to third parties contracted by the County Council to provide a service to the County Council. These service providers are known as data processors and have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service. In particular, the County Council has entered into a contract with Voluntary Norfolk for the purposes of coordinating the arrangement for members of the public requiring assistance of a volunteer.

During this period of emergency, opt-outs will not generally apply to the personal information used to support the Covid-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. View further information about the National Data Opt-out.

How long will we keep your personal information for

Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the information, for example, to provide further services to you.

When the information is no longer needed for these purposes, it will be securely deleted.

If we need to use your information for research or reports, your information will be anonymised and any information taken from notes (hand written or typed) during any consultation sessions will be securely destroyed. The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely.

How we keep your information

The information is stored electronically, on the County Council’s network including records management systems and in paper files.

Personal data processed by Voluntary Norfolk is stored by Better Impact Software Ltd in Canada, one of twelve countries outside the EU that is covered by an adequacy decision by the European Commission, meaning it is recognised as an appropriate destination for data storage. Personal data will also be stored securely on their networks

Changes to this notice

We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated.

This notice was amended 16 October 2020.