The reasons we use your data
The Health Protection team, Leeds City Council, receive anonymised data on COVID-19 and other infectious diseases from a variety of sources including schools, care homes, workplaces, and the Government (see below for full details). The purpose of receiving and using this data is for surveillance, monitoring and reporting of COVID-19 and infectious diseases, to support with proactive outbreak management and the notifying local health protection system. Whilst the Council will always attempt to ensure that personal data received is anonymized, however, in some cases this will not be possible (for example, due to the size of a business being sufficiently small to enable individuals identified).
Why we are allowed to use your data
This includes but is not limited to the following set out within the UK GDPR:
- Article 6.1(a) – the data subject has given consent
- Article 6.1(b) – processing is necessary for the performance of a contract
- Article 6.1(c) – processing is necessary for compliance with a legal obligation
- Article 6.1(d) – processing is necessary to protect the vital interests of individuals
- Article 6.1(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
For the processing of “special category data” such as someone’s physical and mental health:
- Article 9.2(g) of the UK GDPR Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The processing of special category under Article 9 also requires the following conditions for processing from the UK Data Protection Act 2018 to be met:
- Schedule 1, Part 2 section 6(a), processing is met under the exercise of a function conferred on a person by an enactment
- Schedule 1, Part 1 section 2(1), this condition is met if the processing is necessary for health and social care purposes
Who we can share your data with
The Health Protection team receive anonymised data on COVID-19 and other infectious diseases from:
- Schools internally via the Schools team/ DCS
- Early years settings via the Council’s Early Years Alert team
- Care homes via Infection Prevention Control Leeds Community Healthcare team (NHS)
- Workplaces internally via Environmental Health
- Food Safety alerts via Environmental Health and Infection Prevention Control Leeds Community Healthcare team (NHS)
- The UK Health Security Agency – who have direct contact with settings but also share a Common Exposures Report with us, with data from NHS Test & Trace for settings of all kinds
- Universities (directly)
- University private accommodation (directly)
This data is uploaded onto an IT system provided by our data processor Aire Logic.
When your data gets sent to other countries
No data is transferred outside of the UK.
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated 31 January 2022.
