What this privacy notice is for

Our core data protection obligations and commitments are set out in the council’s primary privacy notice at:

• Data Protection - web page

This privacy notice is to supplement all the information we currently make available about how we process your personal data. Its’ aim is to make it easier to understand and provide you with more information about how, our organisation may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

We are committed to protecting your personal data and ensuring that it is processed fairly and lawfully. Information you provide to us will be processed in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA 2018) and subsequent legislation.

Updating our privacy notices

We may update or revise our privacy notices at any time so please refer to the version published on our website for the most up to date details.

What we use your information for

We may seek to collect, process and share your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be done so, about our staff, their dependents and the general public, to ensure their safety and well-being.

Such information will be limited to what is legal, proportionate and necessary, taking into account of the latest guidance issued by the Government and health professionals, in order to provide the necessary support to those most vulnerable and in need and also to manage and contain the virus.

This will include collecting data about visitors to any of our public facing facilities and our offices. This information will be shared to support the NHS Track and Trace where requested to help identify individual who may have been exposed to the virus.

A lot of what we will do with your personal data will be covered by existing powers in current laws and you can find a more information about how we process your information here.

What categories of personal information we use

Personal information can be anything that identifies and relates to a living person. This can include information that when linked with other information, allows a person to be uniquely identified. For example, this could be your name and contact details.

The law treats some types of personal information as ‘special’ because the information requires more protection due to its sensitivity. This information consists of:

• Racial or ethnic origin
• Sexuality and sexual life
• Religious or philosophical beliefs
• Trade union membership
• Political opinions
• Genetic and bio-metric data
• Physical or mental health
• Criminal convictions and offences

In order to carry out these purposes we collect and process personal information which includes both personal and special category data.

Legal basis for processing

The legal basis for data processing we are relying on comes from Article 6 of the General Data Protection Regulations (GDPR). The following sections apply:

• Article 6(1)(c) Legal Obligation - Processing is necessary for compliance with a legal obligation to which the controller is subject;
• Article 6(1)(d) Vital interest - the processing is necessary to protect someone’s life;
• Article 6(1)(e) Public task -the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

Special category data:

• It is necessary to share sensitive information for the purposes of carrying out the obligations and exercising specific rights in the field of social protection law, for the provision of health or social care treatment or the management of health or social care systems. (Article 9 2(h) GDPR).
• Public health processing- it is necessary for reasons of public interest in the area of public health (Article 9 2 (i) GDPR)

The Emergency Planning Service deliver the Local Authority’s statutory responsibilities and duties as a Category 1 Emergency Responder as set out by the Civil Contingencies Act 2004.

The local authority must plan for, respond to and recover from major incidents in the Greater Manchester area.

The statutory duties placed on the local authority as a Category 1 responder includes the anticipation and assessment of risks, production of plans for the purpose of controlling and/or mitigating the impact of emergency incidents and business disruptions as well as effectively responding to, and recovering from, an emergency.

The processing of personal information is necessary for compliance with the statutory requirements of the Civil Contingencies Act 2004.

Regulation 8 of the Local Authorities (Public Health Functions and Entry to Premises by Local Healthwatch Representatives) requires local authorities to produce local health protection arrangements made for the purpose of protecting individuals in the area of the authority from events or occurrences which threaten, or are liable to threaten, their health, which includes arrangements to deal with infectious disease and epidemiological surveillance.

Information sharing/recipients

The Civil Contingencies Act 2004 places a duty on Category 1 and 2 responders to share information upon request. To help us provide emergency response services appropriate to your needs both during an incident and throughout the longer-term recovery period, we may share information with others including, but not limited to, Category 1 and Category 2 responders, such as:

• Other Council Services
• Emergency Services
• NHS agencies
• Health providers
• Utility companies
• Voluntary organisations

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, we will share information with NHS Test and Trace where requested, to help identify people who may have been exposed to the Coronavirus.

Data Transfers beyond European Economic Area

We do not transfer any of your personal information outside the European Economic Area (‘EEA’).

How long we keep your data

We will only keep your personal information for as long as the law specifies or where the law does not specify this, for the length of time determined by our business requirements.

Where can I get advice

More information on how to seek advice in order to exercise your rights, raise a concern or complain about the handling of your personal information by the council can be found in the council’s privacy notice which can be found at:

• Data Protection - web page