Covid-19 Privacy Notice

In order to assist our region's local authorities with their response to the effects of the Covid-19 pandemic, the West Yorkshire Combined Authority will be receiving data from Public Health England (PHE) in relation to infection rates across the region.

As part of our response to the effects of the Covid-19 pandemic in our region, the West Yorkshire Combined Authority will as a data controller receive data from Public Health England (PHE) as detailed below. This is the minimum amount of information required to fulfil our responsibilities for the purposes described below.

Field name Description
Record ID Unique record identifier
Sex Patient sex
Age Patient age in years
Postcode Patient place of residence postcode
Ethnic Group Patient ethnic group
Occupation Patient occupational group
Key Worker Patient key worker status
Test Date Date of Covid-19 test or specimen test
Pillar Covid-19 test location type (laboratory, mobile testing station, home test)

 

The data shall be processed for the purpose of carrying out key analyses to support our region’s Local Authorities in responding to the economic, environmental and social effects of the Covid-19 pandemic Our legal bases for processing this data are:

Article 6.1.(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Article 9.2. (g) – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

The processing of special category data under Article 9.2 (g) also requires one of the 23 specific substantial public interest conditions (as set out in Schedule 1 of the Data Protection Act 2018) to be met.

In this instance, the condition of ‘Statutory and Government purposes’ is satisfied as the processing is necessary for the exercise of a function conferred on a person by an enactment or rule of law. The Combined Authority is supporting our region’s Local Authorities pursuant to general powers set out in in section 113A of the Local Democracy, Economic Development and Construction Act 2009.

Article 9.2.(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

In this instance, the public interest is satisfied by the requirement to respond to the Covid-19 pandemic.

The processing of special category data under Article 9.2 (i) also requires the following conditions for processing from the UK Data Protection Act 2018 to be met:

The processing must be carried out either:

  • by, or under the responsibility of, a health professional; or
  • by someone else who in the circumstances owes a legal duty of confidentiality.

All persons processing this data are subject to a legally binding duty of confidentiality.

The legal gateway under which this data is shared is Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002 in accordance with the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020, in particular research and planning in relation to Covid-19.

The data will be processed by the Combined Authority until 31 March 2021 or until such time as the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 29 July 2020 is extended.

We will not onwardly share this data with any other organisation or third party with the exception of our region’s Local Authorities. There may be other circumstances in which we may share or use certain information about you, which are:

  1. if we have a legal obligation to do so or if we are required or requested to do so by a competent authority such as the police or a court;
  2. if we need to use or disclose your information to obtain legal advice or in connection with legal proceedings;
  3. if we need to share your information to protect your vital interests if you are unable to give us consent or it is unreasonable for us to ask for your consent in the circumstances (e.g. if you are injured).

For more information on your rights as a data subject or to contact us about making a request, please refer to the privacy notice on our website