This Privacy Notice has been created in accordance with the Requirements of the General Data Protection Regulation 2016 in order to make it easier for you to understand what personal data Lancashire Constabulary may seek to collect and hold about you in relation to the recent outbreak of coronavirus (COVID-19).
For what purpose(s) is my personal data intended to be processed by Lancashire Constabulary?
Lancashire Constabulary may seek to collect and process your personal data in response to the outbreak of coronavirus (COVID-19), which is above and beyond what would ordinarily be collected by Lancashire Constabulary from its officers, staff and the general public.
Such information will be limited to that which is deemed proportionate and necessary, taking account of the latest guidance issued by the Government and health professionals, in order to manage and contain the virus. It will enable the Chief Constable to effectively keep people safe and feeling safe.
Where Coronavirus related information is to be used for general reporting or statistics, steps will be taken to anonymise the data and general numbers used, wherever possible.
When required Lancashire Constabulary will comply with the NHS Test and Trace programme and provide details of close contacts of individuals who have tested positive with COVID-19.
What are the categories of personal data collected?
Personal data is being collected to enable Forces to identify anyone they come into contact with through their policing tasks who are in any of the high risk categories and would be considered vulnerable and/or infected with Coronavirus.
What is Lancashire Constabulary’s legal basis for processing my personal data?
The General Data Protection Regulation requires specific conditions to be met in order to ensure that the processing of personal data is lawful.
The relevant conditions for the purpose of processing are:
Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
Article 6(1)( e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Section 8 (c ) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law. And the Police Reform and Social Responsibility Act 2011 provides that Chief Constable may do anything which is calculated to facilitate or is conducive or incidental to the exercise of the functions Chief Constable.
Article 9(1) sets out that the processing of special categories of personal data which includes data concerning a persons health require are prohibited unless specific further conditions can be met.
The further relevant condition relating to the processing of health data are:
Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
Schedule 1, Part 2(6) – is necessary for reasons of substantial public interest and for the purpose of a function conferred on a person by an enactment or rule of law; e.g. Health Protection (Coronavirus) Regulations 2020 and Coronavirus Bill 2020
Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England
Am I required to provide my personal data under a statutory or contractual requirement, or a requirement necessary to enter into a contract, or am I obliged to provide it?
Whilst the provision of data cannot be mandated, you are strongly advised that it is in the best interests of all to provide this information to the Force so we are able to take relevant steps to keep you and others safe.
The information will be managed in confidential manner. All information will be held securely and processed on a ‘need to know’ basis by only a limited number of people. If there is a need to disclose outside of this, the minimal amount of personal data will be used.
How long will this personal data be retained by Lancashire Constabulary?
The Force will only keep your information for as long as it is required to be retained, taking account of Government advice and the on-going risk presented by Coronavirus.
Health information provided by you in relation to this outbreak of Coronavirus will not be used for any other purpose.
When the information is no longer needed for this purpose, it will be securely deleted.
Your rights
Amongst other rights, you have a right to request a copy of personal information that Lancashire Constabulary holds about you. Further details of all your rights can be found within the general Privacy Notice referred to above.
If you require further information about how the Force processes your personal data, you can contact the Constabulary’s Data Protection Officer: [email protected]
The Information Commissioner is the independent regulator responsible for enforcing the Data Protection Act and advising on privacy rights.
Further advice and guidance from the ICO on this issue can be found:
https://ico.org.uk/for-organisations/data-protection-and-Coronavirus/