Central London Community Healthcare NHS Trust (the Trust) recognises the importance of protecting and respecting your privacy when you work with the organisation. This privacy notice explains your rights as a Trust employee/locum, how we collect and use information about you, and how we protect your privacy. This notice applies to all substantive, agency and contract staff.
This Privacy Notice is specific to Asymptomatic Testing Programme and supplements our main Privacy Notice published on the Trust website.
What this notice will tell you:
- How data may be processed in response to COVID-19;
- Our purpose for processing your data
- Our legal basis for processing your data;
- The categories of personal data obtained
- Whether you have to provide it to us (source of the personal data);
- Whether there are other recipients of your personal data;
- How long we store it for;
- Whether we intend to transfer it to another country;
- Your rights and freedoms (right to withdraw consent if applicable); and,
- How to lodge a complaint against the Trust to our regulatory body.
Data Processing in response to COVID-19
Following the outbreak of Covid-19, the health and social care system has and is still facing significant pressures. In response to Covid-19, the Secretary of State has required NHS Digital; NHS England and Improvement; Arm’s-Length Bodies (such as Public Health England); to share confidential medical status information relating to staff. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on gov.uk here and some FAQs on this law are available here .
During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs.
Where data is used and shared under these laws your right to have personal data erased will also not apply.
Given the fast-changing, unpredictable nature of the climate in which we are operating, we may be required to amend this privacy notice at any time. We would therefore kindly advise you to review this notice frequently.
Our purpose for processing your data
The purposes for processing your data are as follows:-
- To support the Trust and wider NHS in its infection control risk reduction strategy
- Evaluation of efficacy of lateral flow testing
- Public interest in the area of public health
Our legal basis for processing your data
We exercise our official authority by collecting, using and where applicable sharing your information in order to provide you with care. The lawful bases for processing the data are for the Trust’s compliance with a legal obligation, public health interest and for the provision of health care.
This table shows the legal basis for the different purposes for using your data.
General Data Protection Regulation
Article 6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,
General Data Protection Regulation
Article 6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Provision of health treatment
General Data Protection Regulation
Article 9(2)(h) Processing is necessary for the purposes of the provision of health or social care or treatment.
General Data Protection Regulation Article 5
(1) (b) and (e), Article 6 (1) (e), (f) and Article 9 (2) (g) (i) & (j) taking account of Article 89 safeguards and derogations.
What information we collect from you and and/or whether you will need to provide it to us
We collect information pertaining to your identity, contact information, health status information, diagnoses, and other information which allows us to support and administer healthcare. To minimise additional collation of information, the Trust will utilise information that is already held about you.
For agency and contract staff, the Trust will require some personal information that it does not under normal circumstances process about you. This will be specifically for the purposes outlined above. By accepting the test kit and submitting your personal data, you will be consenting to the Trust processing your personal data for those purposes.
Will the Trust share your data with anyone else?
The Trust always has a legal framework in place to ensure that your data is shared appropriately. We share your data with Public Health England for the purposes stated above. We will not provide researchers with data that identifies you personally, unless you have provided explicit, informed consented to this or there is legal justification to provide this information.
What data about me stored elsewhere is shared with the Trust?
If you are a substantive member of staff, the Trust as your employer holds some personal information about you for employment purposes. Similarly, if you are an agency or contract staff, the Trust holds some information about you for the purposes of your provision of services to the Trust. It is important to note that there is no linkage of your Electronic Staff Records to the submissions made to Public Health England.
How long will the Trust keep the data?
The Records Management Code of Practice for Health and Social Care 2016 sets out what people working with or in NHS organisations in England need to do to manage records correctly. The data will also be retained in line with the Data Protection and the Control of Patient Information (COPI) Regulations.
Your rights and freedoms as the data subject
As the data subject, you have the following rights in relation to your data:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
How can I access the information the Trust holds about me?
By law you are entitled to request a copy of the information we hold about you. This is known as a Subject Access Request. To submit such a request, we ask that you contact the Information Governance Team via:
- Email: firstname.lastname@example.org;
- Phone: 02081025005; or
- Post: Information Governance Department, Christopher Ward, St Charles Centre for Health & Wellbeing, Exmoor Street, London, W10 6DZ
Making a complaint and important contact details
If you have any queries in relation to the processing of your personal data, please contact the Information Governance team via the contact details provided above.
If you have any issues or concerns you can contact the Patient and Liaison Service (PALS) via e-mail email@example.com.
The Trust’s Data Protection Officer is Caroline Law and can be contacted as follows:-
The Trust is registered as a Data Controller with the Information Commissioners Office under registration number Z2416880.
Who can I complain to?
The Information Commissioner’s Office (ICO) is the body that regulates the Trust under Data Protection and Freedom of Information legislation.
You can complain to the ICO at:
Wycliffe House Water Lane Wilmslow Cheshire
Website: www.ico.org.uk/concerns Telephone: 0303 123 1113.