COVID-19 Test and Trace privacy notice
Public Health England (PHE) are providing patient data to Lewisham Council’s Public Health team. You can email the Public Health Team at publichealth@lewisham.gov.uk. The Council’s Data Protection Officer can be emailed at dpo@lewisham.gov.uk.
What information we might collect from you and why
Patient data is being provided to Lewisham by Public Health England in the public interest; in order to enable Lewisham’s Public Health Team to fulfil their responsibilities to take action to manage and mitigate the spread and impact of the current outbreak of Covid-19.
These responsibilities are as set out in the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ dated 20 March 2020 from the Department of Health and Social Care on behalf of the Secretary of State for Health and Social Care. Read the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ on the NHS website.
How we use your information
The data shall be processed for the following Covid-19 Purposes specified in the Regulation 3(4) Notice:
- understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks
- identifying and understanding information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19 and the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19
- understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care
- monitoring and managing the response to Covid-19 by health and social care bodies and the Government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
- delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
- research and planning in relation to Covid-19.
Read the Regulation 3(4) Notice on the Government's website.
Data is processed in accordance with the following relevant articles of the General Data Protection Regulation (GDPR) and Data Protection Act 2018
- GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller by virtue of the Data Protection Act 2018 section 8(c) – function conferred on us by the Public Health Acts;
- GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy by virtue of Data Protection Act 2018 section 10 1(d), and section 3 in Part 1 of Schedule 1 and
- Data Protection Act 2018 Schedule 1 Part 1 (3) ‘public health’.
The patient data that we receive includes categories of personal data that will be processed including direct personal identifiers (including name, address, date of birth, postcode, telephone number), Racial or ethnic origin; and data concerning a natural person's physical or mental health.
The council obtains information from the following sources:
- Public Health England (PHE) - Patient data as described
Lewisham Council does not process your information with third countries outside of the UK or EEA without the safeguards being in place that are equivalent to the Data Protection Act 2018 or the General Data Protection Regulation 2016 (GDPR).
Storing your information
Your information shall be processed for the duration of the pandemic. Following this, it will be kept for such time is required to report on the local impact of the pandemic. Where data is published, it will always be aggregated and anonymised.
Further information
Lewisham Council shall process your information in adherence to your information rights under the Data Protection Act 2018 and the GDPR. You can find information about your rights in our main privacy statement.
If you are dissatisfied with the processing of your information, you can raise your concern with the council’s data protection officer. If you have any concerns or questions about how we look after your personal information, please contact:
The Interim Data Protection Officer
Petra Der Man
020 8314 9928
You also have a right to lodge a complaint with the Information Commissioner’s Office.