Who are we and what do we do?
Middlesbrough Council provides a wide variety of face-to-face public services from our buildings and other locations. We now need to provide these in a different way to meet the Government’s guidance on how to stop the spread of coronavirus (COVID-19).
What type of personal data do we collect and how do we collect it?
We will collect data in person from you such as your name, contact details, the locations you attend, visit, or otherwise access, dates and times of visits, and who you interacted with. Sometimes we receive some of this information in advance from a third party such as the agency that referred you to us or other employers of visitors to our premises. We also collect data from our building access control systems and where necessary from our CCTV systems.
How the Law allows us to use your personal data
We use personal data to help us meet our legal obligations or where there is a clear public interest in public health matters such as serious threats to health.
Some of the laws that require or permit us to use data for these purposes include the Health and Safety at Work Act 1974, Crime and Disorder Act 1998, Data Protection Act 2018, and the Health Protection (Coronavirus, Collection of Contact Details etc and Related Requirements) Regulations 2020.
What is your personal data used for?
We use your personal data to record who attends or visits our premises to allow us to investigate any incident with health and safety issues, to prevent or detect a crime or assist in the apprehension of offenders. At this present time, we also use the information gathered to help stop the spread of COVID-19.
Will your personal data be shared?
We share attendance and visitor logging information with other organisations such as emergency services including police or fire brigade, certain organisations that assist us to prevent or detect fraud or other serious misconduct, and in the current COVID-19 situation, we might share information with the NHS Test and Trace Service. We only share information where it is necessary for the investigation of a health, safety or security incident, to prevent or detect a crime or assist in the apprehension of offenders, or where any other law requires or permits us to do so.
We are required law to provide NHS QR codes, at applicable council venues, to use with your NHS COVID-19 app. We may receive information from the NHS Test and Trace Service, but the council does not receive any information directly via the NHS COVID-19 app.
How do we keep your personal data secure?
We transfer records of attendance and logs to secure electronic systems that are accessed only by those who are authorised. Our staff are required to complete mandatory data protection and security training. Our computer networks are regularly and robustly tested to make sure they are secure and data is encrypted both during transfer and when it is stored.
How long will we keep your personal data?
We only keep attendance and visitor logs as long as is necessary. Not all of the data we collect is held solely for potential tracking and tracing purposes. However, where we only need specific parts of this data for tracking and tracing, we only hold it for 21 days from your visit. For more information, please see the Records Retention Schedule on our website.
Is your personal data processed overseas?
The data gathered for attendance and visitor logging is not transferred overseas.
We will never use the data gathered for attendance and visitor logging for direct marketing unless we have your consent or you are attending an event and have received similar services from us in the past but you would always be given an option to opt-out.
What are your information rights?
Your Information Rights are set out in law and, subject to some exceptions, you have the:
- Right to rectification - to ask for information to be corrected
- Right to erasure - to have your personal data deleted
- Right to object - to how you data is used
- Right to restriction - to request limits on how your data is used
- Right to portability - to request that we move your data to another organisation
You also have the right to request a copy of the personal information that the Council holds about you (subject access request) by visiting the data protection webpage.
Making a complaint
If you have any concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.
If you would like to discuss anything in this privacy notice or your information rights, please contact:
The Data Protection Officer
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Last updated: 03/08/2020