COVID-19 (General) privacy notice

Find out about the COVID-19 (General) privacy notice here.

Who will own my data once I submit it?

Knowsley Metropolitan Borough Council (the Council).

Why do you need my information?

The Council may seek to collect and process your personal data in response to the recent outbreak of Coronavirus (COVID-19), which is above and beyond what would normally be collected. This is to ensure your safety and well-being.

The information collected will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government and health professionals in order to manage and contain the virus.

This data collected will be used to enable the Council to fulfil its functions to keep people safe, put contingency plans into place, safeguard the vulnerable and aid business continuity.

What allows you to use my information?

The legal basis for processing the data is that it is in the public interest for us to deal with the outbreak of COVID-19.

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:

  • Article 6(1)(d) – is necessary to protect the vital interests of the data subject or another natural person.
  • Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance, when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
  • Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Section 8(c) of the Data Protection Act 2018 sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.
  • The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below: 
  • Article 9(2)(i) GDPR – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
  • Schedule 1, Part 1, paragraph 1 – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment ), social security or social protection (e.g. Health and Safety at Work Act 1974.
  • Schedule 1, Part 1, paragraph 2 – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with health

and social care purposes (e.g. provision of health care or treatment or social care regarding COVID-19).

  • Schedule 1, Part 1, paragraph 3 – is necessary for reasons of public interest in the area of public health and is carried out by or under the responsibility of a health professional or by another person who, in the circumstances, owes a duty of confidentiality under an enactment or rule of law, e.g. governmental guidance published by Public Health England.

Who will my information be shared with?

We will only share your information with other partner organisations as part of the response to the COVID-19 outbreak.

We will not share your information with anyone else unless required to do so under additional legal requirements, for example, to assist the government in containing the spread of COVID-19. This may be where we are required to do so by law to safeguard public safety and at risk of harm or emergencies.

Information will not be shared with other parts of the Council for any other non-related purposes.

Any information which is shared will only be shared on a need-to-know basis with appropriate individuals. Only the minimum information suitable for the purpose will be shared.

Do I have to provide this information, and what will happen if I don’t?

The Council may use the information it already holds and may receive information from partner organisations.

The information will be used for the explicit purpose of keeping people safe, putting contingency plans into place, safeguarding the vulnerable and aiding in business continuity. It is, therefore, in everyone’s best interest that this information is gathered and, where necessary, provided to the relevant authorities.

In circumstances such as the current pandemic, where organisations are acting on the guidance or directions of public health authorities or other relevant authorities, Article 9(2)(i) GDPR and Section 10(2) of the Data Protection Act 2018 will permit the processing of personal data, including health data, once suitable safeguards are put in place to protect the data. Such safeguards may include limitations on access to the data, strict time limits for erasure, and other measures such as adequate staff training to protect the data protection rights of individuals.

If you are requesting additional services as a result of COVID-19, the Council will need your data to deliver the service.

How long will you keep this data for and why?

The Council will only keep your information for as long as necessary, considering government advice and the ongoing risk presented by COVID-19. At a minimum, the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.

Information provided about this outbreak of COVID-19 will not be used for any other purpose, including being held within files ‘just in case’ it may be needed again.

When the information is no longer needed for this purpose, it will be securely deleted.

How will my information be stored?

The information you provide will be stored on the Council’s secure servers and will not be accessed by anyone who is not authorised to do so.

What rights do I have when it comes to my data?

If you are not happy about the way your personal data is being processed, or if you require further information about how we process your personal data, you can contact the Council’s Data Protection team by emailing data.protection.officer@knowsley.gov.uk

You also have the right to complain to the Information Commissioner’s Office:-

Further advice and guidance from the ICO on this issue can be found on the ICO website.

Will this information be used to make automated decisions about me?

No automated decision will be made about you based on this data.

Will my data be transferred abroad, and why?

No, there are no requirements to transfer or share in

Chat with us