Your council

City Of York Council COVID-19 Privacy Notice

We keep the City Of York Council COVID-19 Privacy Notice under review. It was last reviewed and updated in June 2020.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy information for all of the City of York Council (CYC).


Personal data

We only collect and share the minimum amount of personal information required when providing you with assistance and support. This includes but is not limited to the following:

  • information about you, this could include your name, address, date of birth
  • national identifiers, such as NHS number, National Insurance number
  • financial information, such as your benefit entitlement
  • information about your family and social circumstances
  • physical or mental health details (where appropriate)
  • social care support/involvement

We get most of this information from you, but we may also get some of this data from:

  • central government agencies
  • other local authorities
  • health and social care providers
  • police and probation services
  • members of the public (referrer)
  • commissioned partners
  • family members
  • local charities and other community support groups

See further details about how we define personal data and non-personal data.


Collecting personal data

The personal information being processed will be sourced through a number of different channels, including but not limited to partner organisations including:

  • Public Health England
  • York GP practices
  • datasets provided by NHS England and other health partners
  • other volunteering initiatives including those delivered by the NHS and City of York Council

Using personal data

City of York Council and selected health and care providers are the data controllers for the processing of personal data.

We are processing personal data relating to the following services and groups.

Delivering Services

To deliver services connected with COVID-19, including to:

  • provide information, health and social care services
  • control and prevent the spread of COVID-19
  • identify and understand trends and information about individuals with COVID-19 and about services in relation to testing
  • monitor and manage the response by health and social care bodies in relation to testing
  • research and plan testing

Groups of people defined on medical grounds as requiring shielding

Personal data is being collected to assess and provide support to adults, children and young people who are in high-risk categories and would be considered vulnerable, if they became infected with the coronavirus.

Citizens requiring emergency support and assistance

Personal data is being collected to assess and provide support to adults, children and young people in this category.

Community volunteers

Personal data is being collected in order to co-ordinate the community response to coronavirus.

See the Coronavirus Community Volunteer Privacy Notice.

Coronavirus business support

We may collect personal data in support of business grant applications during the coronavirus pandemic:


Our legal basis for using personal data

Our legal basis for using your personal data includes, but is not limited to, the following set out within the GDPR:

  • Article 6.1(a) – the data subject has given consent
  • Article 6.1(b) – processing is necessary for the performance of a contract
  • Article 6.1(c) – processing is necessary for compliance with a legal obligation
  • Article 6.1(d) – processing is necessary to protect the vital interests of individuals
  • Article 6.1(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

For the processing of “special category data” such as someone’s physical and mental health, it is

  • Article 9.2(g) of the GDPR - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

The processing of special category under Article 9 also requires the following conditions for processing from the UK Data Protection Act 2018 to be met:

  • Schedule 1, Part 2 section 6(a), processing is met under the exercise of a function conferred on a person by an enactment
  • Schedule 1, Part 1 section 2(1), this condition is met if the processing is necessary for health and social care purposes

Sharing personal data

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. We'll only share the minimum information for each circumstance.

We may sometimes need to share some of your information with:

  • health service providers, including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
  • education providers
  • care providers, such as day care, domiciliary, residential
  • government agencies, such as the Department of Health and Social Care and Department for Work and Pensions
  • support groups for people with disabilities
  • local government
  • prepaid card providers
  • Direct Payment Support Services
  • housing associations
  • technology assistance providers

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

Retaining personal data

We'll only use your personal information whilst delivering support and assistance to you, unless the law requires us to keep it for a longer period.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.


Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.


Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145