Your council

City Of York Council COVID-19 Privacy Notice

We keep the City Of York Council COVID-19 including Test and Trace, Privacy Notice under review. It was last reviewed and updated in October 2020.

View the privacy information for all of the City of York Council (CYC).

Personal data

We only collect and share the minimum amount of personal information required when providing you with assistance and support or to fulfil our responsibilities to take action to manage and mitigate the spread and impact of an outbreak of COVID-19.

This includes but is not limited to the following:

  • direct personal identifies eg name, address, date of birth, postcode, telephone number,  and special categories of personal data such as racial or ethnic origin, data about your physical or mental health
  • national identifiers, such as NHS number, National Insurance number
  • financial information, such as your benefit entitlement
  • information about your family and social circumstances
  • social care support/involvement

When responding to cases, we will collect and use the following personal data:

  • full name
  • date of birth
  • sex
  • NHS Number
  • home postcode and house number
  • mobile phone number
  • telephone number
  • email address

We will also collect and use the following special category personal data (‘data about health’):

  • coronavirus test result and test date
  • details of COVID-19 symptoms, start date and nature

When making contact as part of the test and trace programme, we will collect and use the following personal data:

  • full name
  • date of birth
  • sex
  • NHS Number
  • home postcode and house number
  • mobile phone number
  • telephone number
  • email address

We will also collect and use the following special category personal data (‘data about health’):

  • details of COVID-19 symptoms and start date
  • clinically vulnerable or extremely vulnerable status

Collecting personal data

We get most of this information from you, but we may also get information from :

  • Public Health England
  • Department of Health and Social Care
  • Ministry of Housing, Communities and Local Government
  • NHS Test and Trace
  • Contact Tracing Advisory Service
  • York GP practices
  • datasets provided by NHS England and other health partners
  • other volunteering initiatives including those delivered by the NHS and City of York Council
  • central government agencies
  • other local authorities
  • health and social care providers
  • commissioned partners
  • police and probation services
  • local charities and other community support groups
  • other council services and records
  • members of the public (referrer) and/or family members

See further details about how we define personal data and non-personal data.

Using personal data

We are using your personal data to identify citizens requiring emergency support and assistance, and for the following purposes.

To deliver services connected with COVID-19, including to:

  • provide information, health and social care services
  • control and prevent the spread of COVID-19
  • identify and understand trends and information about individuals with COVID-19 and about services in relation to testing
  • monitor and manage the response by health and social care bodies in relation to testing
  • research and plan testing
  • identify groups of people defined on medical grounds as requiring shielding

To verify the identity of patients as a resident in our area, and to contact the patient to provide advice or direct care as follows:

  • targeted care for clinically extremely vulnerable people outside of shielding
  • to monitor the wellbeing of known people as clinically extremely vulnerable to Covid-19, for a period of time after National Shielding ends
  • to continue to provide ongoing direct care needs to clinically vulnerable persons as a result of the virus

Shielding readiness:

  • to provide Shielding support again immediately in event of local, regional and/or national Covid-19 outbreaks
  • targeted support during a local outbreak that may require people within the affected area/s to resume shielding

Community volunteers

Personal data is being collected in order to co-ordinate the community response to coronavirus.

See the Coronavirus Community Volunteer Privacy Notice.

Coronavirus business support

We may collect personal data in support of business grant applications during the coronavirus pandemic.

See the COVID-19 Grants and Payments to Businesses Privacy Notice.

Self-isolation support payments

If your earnings are affected by self-isolating following a COVID-19 diagnosis, you may be entitled to some financial support; a one-off 'Test and Trace Support Payment' of £500.

See the Self-Isolation Support Payments Privacy Notice.

Council staff, vaccinations, NHS Test and Trace, and testing

The Department of Health and Social Care has asked organisations including City of York Council to support this service by keeping a temporary records for employees, staff and Gough and Kelly, for 21 days.

See the CYC employees, staff and contractors Privacy Notice.

This includes privacy notices for:

  • COVID-19 vaccinations
  • NHS Test and Trace
  • COVID-19 testing

Attend Anywhere video appointments

We may also use Attend Anywhere for virtual appointments.

See the Attend Anywhere privacy notice.

NHS Test and Trace

If you are contacted by NHS Test and Trace, contact tracers will:

  • call you from 0300 013 5000
  • send you text messages from ‘NHStracing’
  • ask you to sign into the NHS Test and Trace contact-tracing website

You may also be contacted by the local council Test and Trace (CYC Tracing) and they will:

  • call you from 01904 551559
  • send you messages from “Gov Notify” which is an SMS text messaging service

The message title will be 'CYC Tracing' and the message will read: “You are identified as Covid-positive; we therefore need to speak with you, so please expect a call soon from City of York Council on this number: 01904 551559”.

Contact tracers will never:

  • ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • ask you to make any form of payment or purchase a product or any kind
  • ask for any details about your bank account
  • ask for your social media identities or login details, or those of your contacts
  • ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • disclose any of your personal or medical information to your contacts
  • ask about protected characteristics that are irrelevant to the needs of test and trace
  • provide medical advice on the treatment of any potential coronavirus symptoms
  • ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else

Our legal basis for using personal data

Our legal basis for using your personal data will be one or more of the following as set out within the GDPR:

  • Article 6.1(a): the data subject has given consent
  • Article 6.1(b): processing is necessary for the performance of a contract
  • Article 6.1(c): processing is necessary for compliance with a legal obligation
  • Article 6.1(d): processing is necessary to protect the vital interests of individuals
  • Article 6.1(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

For the processing of “special category data” such as someone’s physical and mental health, it is one or more of the following as set out within the GDPR:

  • Article 9(2)(a): Explicit consent of the data subject
  • Article 9(2)(b): Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement
  • Article 9.2(g) of the GDPR: processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
  • Article 9(2)(i): Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices

The processing of special category under Article 9 also requires the following conditions for processing from the UK Data Protection Act 2018 to be met:

  • Schedule 1, Part 2 section 6(a): processing is met under the exercise of a function conferred on a person by an enactment
  • Schedule 1, Part 1 section 2(1): this condition is met if the processing is necessary for health and social care purposes

Sharing data under Data Protection legislation

Sometimes we may need to share your information, but we will only do so where we have your consent or where it is necessary or required by law. We'll only share the minimum information for each circumstance.

For the purposes set out in this privacy notice, we may sometimes need to share some of your information with:

  • health service providers, including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
  • education providers
  • care providers, such as day care, domiciliary, residential
  • government agencies, such as the Department of Health and Social Care and Department for Work and Pensions
  • support groups for people with disabilities
  • local government
  • prepaid card providers
  • Direct Payment Support Services
  • housing associations
  • technology assistance providers
  • NHS Test and Trace
  • Contact Tracing Advisory Service

We may also be required or permitted, under data protection legislation, to disclose your data without your explicit consent, for example:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

Storage of information

We will keep your information you give us in CYC’s secure network drive and make sure it can only be accessed by authorised staff.

Transferring personal data abroad

As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA). However, for as long as

As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA).

However, for as long as the provisions of the Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020/392 remain in effect, we'll be hosting public virtual meetings and we are currently using Zoom Pro or Business version of Zoom to host meetings (version 5) for that purpose.

Where meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom.

Some personal data will be stored securely on Zoom’s system in the USA (that is, outside the EEA) in compliance with the EU, USA Privacy Shield Framework. This data may include a user's:

  • name
  • email address
  • telephone number where applicable
  • IP address
  • MAC address
  • other device ID (UDID)
  • device type
  • operating system type and version
  • client version
  • type of camera, microphone or speakers
  • connection type

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services.

Retaining personal data

We'll only keep your information for as long as is necessary for the purposes set out in this privacy notice, unless the law requires us to keep it for a longer period.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

Your rights

To find out about your rights under data protection law, you can go to the Information Commissioners Office (ICO) website.

If you have any questions about this privacy notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us by email:, on telephone: 01904 554145 or write to:

Data Protection Officer
City of York Council
West Offices
Station Rise

See further details of your rights relating to personal data.

Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145