Coronavirus (COVID-19)

This Privacy Notice is designed to help you understand how and why Scarborough Borough Council is processing your personal data in relation to Coronavirus (COVID-19). The following information provides details on how we may collect use and where appropriate share personal information in accordance with the UK General Data Protection Regulations (UK GDPR). It should be read in conjunction with Scarborough Borough Council’s corporate privacy notice document.

Why we collect personal data

Scarborough Borough Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).

Scarborough Borough Council is a Category 1 Emergency Responder as set out by the Civil Contingencies Act (CCA) 2004 and has statutory duties and responsibilities to fulfil as part of this.

The Council processes the data of service users in a variety of different ways; typically the Council will have a privacy notice for the specific team or area informing you of how and why this information is collected and processed. However, as this area of processing data is likely to change rapidly and affect various different services, the Council has developed this privacy notice for processing data related to Coronavirus (COVID-19). This should be read in conjunction with any other relevant privacy notices.

The Council may also need to process personal information to support NHS Test & Trace. As part of NHS Test & Trace, North Yorkshire County Council (NYCC) is gathering information from Public Health Teams, and, where required, Scarborough Borough Council. The sharing of this data between appropriate organisations allows NYCC to verify contact details to ensure they are reaching the correct individual(s). For further information, please see Public Health England’s published privacy information as well as North Yorkshire County Council’s Covid-19 Privacy Notice.

What personal data we collect

The personal data we collect will include:

• Name
• Contact details
• Address or other geographical marker
• Medical Information, age or any other personal information which would mark a vulnerability to the virus
• Recent history of contacts with other individuals or any other personal information which could help prevent or trace transmission of the virus
• Any other personal information which the Council is asked to be collected by the relevant health or government authorities to mitigate the risks associated with Coronavirus (Covid-19).  This includes health risks, economic risks and social risks.

See our Data Protection Policy for details on how we define personal and non-personal data.

We may monitor and record electronic communications (website, email and phone conversations) for a number of reasons such as:

• staff training
• records of conversations
• the detection, investigation and prevention of crime

We will inform you if your call is being recorded or monitored. 

Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our retention periods. If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.

How we use your personal data

We'll only use your personal data in accordance with data protection legislation, and for the purposes stated in this privacy notice.

We'll:

• protect it and make sure nobody has access to it who shouldn’t
• ensure you know if you have a choice about giving us personal data
• only share your personal data with other Scarborough Borough Council departments or with external partners, agencies and contractors involved in delivering services on our behalf, make sure we don’t keep it for longer than is necessary
• delete or destroy it securely when we no longer have a need to keep it

We ask that you:

• give us accurate information
• tell us as soon as possible of any changes

tell us as soon as possible if you notice mistakes in the information we hold about you.

Who we share your personal data with

The Civil Contingencies Act places a duty on Category 1 responders to share information with Category 2 responders and other organisations in order to provide services in response to the pandemic. We may share information with others including, but not limited to, Category 1 and Category 2 responders, such as:

• Other Council services, public bodies and authorities including North Yorkshire County Council and other District Councils within North Yorkshire
• Central Government
• Emergency services
• NHS agencies
• Healthcare organisations
• Utility companies
• Voluntary organisations

Any information we use in presentations or reports will be anonymised and will not identify any individuals. For example, a report on the numbers of contacts traced made will not feature any of your personal data.

Our legal basis for collecting and sharing personal data

There are a number of legal reasons why we need to collect and use your personal information. 

The legal basis the Council relies on will be determined by the specific process. However it is likely that the Council will process this personal data under the legal basis of:

• Article 6(1)(c) - Legal Obligation and;
• Article 6(1)(e) - Public Task.
• Article 6(1)(d) - Vital Interest of the data subject and other people

Article 6(1)(f) - Legitimate Interests of the venue, in order to help maintain a safe operating environment and to help fight any local outbreak of the Coronavirus.

Some of the personal data processed by the Council will be information defined as Special Category Data. In order to lawfully process this type of information, the Council will rely on the following Article 9 conditions:

• Article 9(2)(g) - Reasons of substantial public interest (with a basis in law)
• Article 9(2)(c) - Vital Interest of the data subject where they are physically or legally unable to give consent.

The legislations, policies and guidance that underpin this processing include, but are not limited to:

• Civil Contingencies Act (CCA) 2004 and Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005
• The Local Government Act 1972
• The Local Government Act 2000

How long we keep your personal data

Information will be kept for as long as necessary for the purposes for which it is processed. The Council will destroy or archive information when the risks from Coronavirus (Covid-19) have been appropriately reduced.

We will retain information collected for the purpose of Test and Trace for 21 days from the date of your visit.

We will delete or destroy your personal data securely.

Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

• explain this new use before we start the processing
• set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

See our Data Protection Policy for details about the further processing of personal data.

Your rights relating to your personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

Find information about your rights on our UK GDPR page.

Further information

If you have any questions, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us at dataprotection@scarborough.gov.uk or on 01723 232323 or write to:

Data Protection Officer
Scarborough Borough Council
Town Hall
St Nicholas Street
Scarborough
North Yorkshire
YO11 2HG