Who is the data controller for this processing
Leeds City Council and selected health and care providers are the data controllers for this processing.
The personal information being processed will be sourced through a number of different channels, including but not limited to partner organisations including:
- Voluntary Action Leeds (Doing Good Leeds)
- Leeds GP practices and datasets provided by NHS England and other health partners
- other volunteering initiatives including those delivered by the NHS and Leeds City Council
Whose data are we processing and why
Groups of people defined on medical grounds as requiring shielding
Personal data is being collected to assess and provide support to adults, children and young people who are in high-risk categories and would be considered vulnerable, if they became infected with the coronavirus.
Citizens requiring emergency support and assistance
Personal data is being collected to assess and provide support to adults, children and young people in this category.
Community volunteers
Personal data is being collected in order to co-ordinate the community response to COVID-19.
Please read our summary coronavirus (COVID-19) community volunteer privacy notice for further information.
What personal information do we hold
We only collect and share the minimum amount of personal information required when providing you with assistance and support. This includes but is not limited to the following:
- information about you - this could include your name, address, date of birth
- national identifiers - such as NHS number, National Insurance number
- financial information - such as your benefit entitlement
- information about your family and social circumstances
- physical or mental health details (where appropriate)
- social care support/involvement
We get most of this information from you, but we may also get some of this data from:
- central government agencies
- other local authorities
- health and social care providers
- police and probation services
- members of the public (referrer)
- commissioned partners
- family members
- local charities and other community support groups
Who else might we share your personal information with
Sometimes we may need to share your information, but we will only do so where it is necessary or required by law. We will only share the minimum information for each circumstance.
We may sometimes need to share some of your information with:
- health service providers - including NHS agencies (GPs, hospitals, ambulance, health visitor, mental health services)
- education providers
- care providers - such as day care, domiciliary, residential
- government agencies - such as Department of Health, Department of Work and Pensions
- support groups for people with disabilities
- local government
- prepaid card providers
- Direct Payment Support Services
- housing associations
- technology assistance providers
- Defra - for supermarket priority delivery slot referrals
What is the legal basis for our use of your personal information
This includes but is not limited to the following set out within the UK GDPR:
- Article 6.1(a) – the data subject has given consent
- Article 6.1(b) – processing is necessary for the performance of a contract
- Article 6.1(c) – processing is necessary for compliance with a legal obligation
- Article 6.1(d) – processing is necessary to protect the vital interests of individuals
- Article 6.1(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
For the processing of “special category data” such as someone’s physical and mental health:
Article 9.2(g) of the UK GDPR
Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The processing of special category under Article 9 also requires the following conditions for processing from the Data Protection Act 2018 to be met:
- Schedule 1, Part 2 section 6(a), processing is met under the exercise of a function conferred on a person by an enactment
- Schedule 1, Part 1 section 2(1), this condition is met if the processing is necessary for health and social care purposes
How long will we keep your personal information
We will only use your personal information whilst delivering support and assistance to you, unless the law requires us to keep it for a longer period.
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 30 March 2020.
