We keep the City Of York Council COVID-19 Privacy Notice under review. It was last reviewed and updated in June 2020.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy information for all of the City of York Council (CYC).
We only collect and share the minimum amount of personal information required when providing you with assistance and support. This includes but is not limited to the following:
- information about you, this could include your name, address, date of birth
- national identifiers, such as NHS number, National Insurance number
- financial information, such as your benefit entitlement
- information about your family and social circumstances
- physical or mental health details (where appropriate)
- social care support/involvement
We get most of this information from you, but we may also get some of this data from:
- central government agencies
- other local authorities
- health and social care providers
- police and probation services
- members of the public (referrer)
- commissioned partners
- family members
- local charities and other community support groups
See further details about how we define personal data and non-personal data.
Collecting personal data
The personal information being processed will be sourced through a number of different channels, including but not limited to partner organisations including:
- Public Health England
- York GP practices
- datasets provided by NHS England and other health partners
- other volunteering initiatives including those delivered by the NHS and City of York Council
Using personal data
City of York Council and selected health and care providers are the data controllers for the processing of personal data.
We are processing personal data relating to the following services and groups.
To deliver services connected with COVID-19, including to:
- provide information, health and social care services
- control and prevent the spread of COVID-19
- identify and understand trends and information about individuals with COVID-19 and about services in relation to testing
- monitor and manage the response by health and social care bodies in relation to testing
- research and plan testing
Groups of people defined on medical grounds as requiring shielding
Personal data is being collected to assess and provide support to adults, children and young people who are in high-risk categories and would be considered vulnerable, if they became infected with the coronavirus.
Citizens requiring emergency support and assistance
Personal data is being collected to assess and provide support to adults, children and young people in this category.
Personal data is being collected in order to co-ordinate the community response to coronavirus.
Coronavirus business support
We may collect personal data in support of business grant applications during the coronavirus pandemic:
Our legal basis for using personal data
Our legal basis for using your personal data includes, but is not limited to, the following set out within the GDPR:
- Article 6.1(a) – the data subject has given consent
- Article 6.1(b) – processing is necessary for the performance of a contract
- Article 6.1(c) – processing is necessary for compliance with a legal obligation
- Article 6.1(d) – processing is necessary to protect the vital interests of individuals
- Article 6.1(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
For the processing of “special category data” such as someone’s physical and mental health, it is
- Article 9.2(g) of the GDPR - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
The processing of special category under Article 9 also requires the following conditions for processing from the UK Data Protection Act 2018 to be met:
- Schedule 1, Part 2 section 6(a), processing is met under the exercise of a function conferred on a person by an enactment
- Schedule 1, Part 1 section 2(1), this condition is met if the processing is necessary for health and social care purposes
Sharing personal data
Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. We'll only share the minimum information for each circumstance.
We may sometimes need to share some of your information with:
- health service providers, including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
- education providers
- care providers, such as day care, domiciliary, residential
- government agencies, such as the Department of Health and Social Care and Department for Work and Pensions
- support groups for people with disabilities
- local government
- prepaid card providers
- Direct Payment Support Services
- housing associations
- technology assistance providers
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
Retaining personal data
We'll only use your personal information whilst delivering support and assistance to you, unless the law requires us to keep it for a longer period.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.