Privacy and the Coronavirus pandemic

Privacy Notice relating to Covid-19

This privacy notice explains how Buckinghamshire Council will use personal data in response to the Coronavirus pandemic.

Processing activity

The purposes for which your data will be used include:

  • To prevent or mitigate the impact of the virus
  • To record people who may be vulnerable to the virus or otherwise require support due to the virus
  • To identify people who may be vulnerable to the virus or otherwise require support due to the virus and targeting support where required
  • To share information with other organisations to allow them to help people who need it
  • To record details of volunteers who are willing to help us
  • To share details of volunteers with other organisations to help with resourcing
  • To share information with other organisations who are allowed to process confidential information in relation to Covid-19 purposes as defined by the Secretary of State
  • To collect, receive and share data with other organisations as part of NHS Test and Trace and as part of monitoring of the virus.
  • For instance, we will collect the name and contact details of customers/visitors to our libraries and this data may be shared with NHS Test and Trace where it is necessary, either because someone who has tested positive for Covid-19 has listed our premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of Covid-19.

Data sharing from Public Health England (PHE):

We receive personal identifiable data, relating to tests for coronavirus, from PHE as part of the national effort to protect the public from a communicable disease. This enables us to locally control and prevent the spread of coronavirus (COVID-19).

The data we receive (which can include name, date of birth, age, gender, telephone number, address, postcode, NHS number, ethnicity) is what we need for our work to help control, understand and prevent the spread of coronavirus and is part of our responsibilities to protect the health of our residents.

More information is available on PHE’s privacy information page.

Data requirements

Depending on the service you are using this data may include: 

  • Name
  • Contact details (e.g. phone number, email address)
  • Address
  • Date of birth
  • Any information which could be used to identify people who are vulnerable to the virus or otherwise require support due to the virus (e.g. health information)

Any information which illustrates a person’s needs (e.g. health information)

Lawful basis for processing

The lawful bases for processing your personal data are:

  • Legal Obligation – we need to process the personal data to comply with a statutory obligation (Article 6(1)(c)) 

The Health Service (Control of Patient Information) Regulations 2002 r3(4)

Health and Safety At Work Act 1974 s2 & s3

The Civil Contingencies Act 2004

  • Public Task – we need to process the personal data in the exercise of official authority (public functions and powers that are set out in law) or to perform a specific task in the public interest that is set out in law (Article 6(1)(e)) as supplemented by DPA2018 s8(c))

The Civil Contingencies Act 2004

The Local Government Act 1972 s139

  • Substantial Public Interest as supplemented by DPA2018 s10(3) and Schedule 1 Part 2 Para 6

The Civil Contingencies Act 2004

  • Consent (Article 6(1)(a))

Data sharing

We may share data with the following:

  • Other Council services, public bodies and authorities
  • Central Government
  • Emergency services
  • NHS agencies, including NHS Test and Trace
  • Healthcare organisations
  • Utility companies
  • Voluntary organisations/Volunteers

Please refer to our Corporate Privacy Policy for further details of how we process your personal data and your rights.