Privacy notice - Improving COVID-19 vaccine uptake

Middlesbrough Council provides public health services to our residents and businesses and we have been asked to help our NHS partners to improve the uptake of the COVID-19 vaccine.

We will receive name, address, contact details, date of birth, NHS Patient Number, information about particular vulnerabilities, relevant household member details, and COVID-19 vaccination status from local ‘Primary Care Networks’, which are run by local GPs, and the NHS Test and Trace system. We may also gather information from our existing records where there is a ‘compatible purpose’ such as providing wellbeing support or care, or equal access to services for ‘protected groups’.

When we contact you we may ask you to provide information about: any previously unknown contact details such as email address; if you require a booked appointment, will attend for drop in, or need home visit; any support needs either travelling to an appointment or while you are attending a clinic.

We have legal obligations to use person data for a ‘COVID’ purpose where we believe it will improve the health of the local population. We also use ‘special category’ health data where it is necessary for reasons of public interest in public health. Some of the legislation that requires us to use personal data this way include the National Health Services Act 2006 and the notice given by the Secretary of State for Health and Social Care under the Health Service (Control of Patient Information) Regulations 2002.

We will use the personal data to identify vulnerable groups and households who are eligible for a COVID-19 vaccination and have not taken up that offer. We will contact you to discuss why you and other eligible members of your household, including paid carers, have not accepted a vaccine and how to get one. We also use your information to provide support for travel arrangements and to make sure you are supported at your appointment if you have asked for this.

We also use data to create statistics to help us monitor together with local GPs how effective our work is being. If we have a compatible purpose we will use the data to keep our children’s or adults social care information up to date but only where this is relevant.

On some occasions we will need to share information back with local GPs so that they can make a booking for a home visit or clinic appointment, or where someone is particularly worried about getting their vaccination and needs additional support when they visit a clinic. We may also inform the GPs about any other household members attending with you who want the vaccination. If you have asked for additional travel or other support, we will share your contact information with taxi companies or your carers and any carer organisations who already support you.

Middlesbrough Council completes annual Public Services Code of Connection and NHS Data Security and Protection Toolkit assessments to demonstrate our security compliance. We use the following measures to ensure that your personal data is secure: data protection and security policies, information security incident reporting, data and device encryption, system and data access controls, user accounts and passwords, physical and environmental security, staff vetting practices, staff training and awareness, data back-ups, ICT network penetration testing, and business continuity and disaster recovery plans.

We will store patient data until 30 September 2021 (unless extended). We might keep some data longer for a compatible purpose such as children’s or adult social care services. We detail how long we keep data in our Records Retention and Disposal Schedule which is available on our website.

No, we will not send personal data overseas for the purposes of this project.

We will not use any personal data gathered for this project for any marketing purposes. We provide information to our residents to support vaccine uptake as part of our public health duties.

Your Information Rights are set out in law and, subject to some exceptions, you have the:

• Right to rectification - to ask for information to be corrected
• Right to erasure - to have your personal data deleted
• Right to object - to how your data is used
• Right to restriction - to request limits on how your data is used
• Right to portability - to request that we move your data to another organisation
• Right of subject access - to request a copy of data the Council holds about you

If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.

If you would like to discuss anything in this privacy notice or your information rights, please contact:

The Data Protection Officer
Middlesbrough Council
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Email: dataprotection@middlesbrough.gov.uk