This section explains how Welwyn Hatfield borough Council may collect, use and protect personal data specifically with regards to the coronavirus pandemic.
This Council already holds data on our residents, employees and stakeholders. Where we already hold information regarding vulnerability, as defined in the current guidance from the Government and Public Health England, we may share this for emergency planning purposes or to protect your vital interests by sharing with services both inside and outside the Council.
We may, in this current crisis, need to ask you for personal data including sensitive personal data that you have not already supplied. This could be your age or if you have any underlying illnesses or are vulnerable. This is so the Council can assist you and prioritise its services.
If we have information indicating that you are vulnerable in the current pandemic, we may contact you to ensure your safety and to assist you where possible. You can view the Council's main Privacy Notice which contains more information on how we collect, use and protect personal data generally, as well as your rights as a data subject.
Virtual-Remote Access Meetings
The Coronavirus Act 2020 provides for 'persons to attend, speak at, vote in, or otherwise participate in, local authority meetings without all of the persons, or without any of the persons, being together in the same place'.
The Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020 provides us with greater flexibility in the conduct of our meetings, including allowing Councillors to attend remotely and for public and press access to those meetings.
We use Microsoft Teams or Zoom conferencing technology for remote attendance at meetings by Councillors, where they can hear and where practicable see, and be similarly heard or seen by:
(a) other Councillors, whether attending in person or in remote attendance; and
(b) any members of the public who are attending remotely to exercise a right to speak at the meeting in accordance with constitutionally adopted procedures; and
(c) any other members of the public and press attending the meeting remotely to observe.
The press and members of the public are able to observe our meetings (held in open session), through https://welhat.public-i.tv/core/portal/home.
Planning Inspectorate Virtual Meetings
The points below explain the personal data that we will be processing specifically for a Virtual Hearing.
Welwyn Hatfield Borough Council's,www.welhat.gov.uk/privacy-notice, and the Planning Inspectorate's, Planning Inspectorate Local Plan Privacy Notice, Privacy Notices are to be read in conjunction with this amendment. The amendment sets out how we will change our data collection and the processing of that data in order to run a Virtual Hearing.
Please note that when joining a Virtual Hearing on certain digital devices or by phone, other parties may be able to see the email address or phone number that you use to join the event. There are some well-established methods that you can use to avoid the un-intended disclosure of your personal information.
What will be collected?
- E-mail address
- Phone number (if a participant joins by phone)
- IP address
- Display Name
- Self-Image - If video is shared
- A video recording of the event will be collected by Welwyn Hatfield Borough Council for this specific event.
Email addresses are not required to be collected to join the meeting. Only the Meeting ID and Password is required for joining. A display name is collected and an image is only used if the user is already logged into a Zoom account of their own, at that point they have already agreed to Zoom's Terms and Conditions.
Phone numbers will be censored so the middle section is not shown, example: 073****4123. The host will replace this with their names when they join, when a list is provided.
How is it collected?
- E-mail address requested in event invite.
- Phone numbers - If the participant joins by phone, then your phone number would be visible to all participants (this can be masked by the individual by turning off Caller ID, generally known as dialling 141) in which case a random number is displayed.
- IP address - Connections to Zoom will capture the IP address of the participant.
- Display Name - This is collected from the participants joining details
- Self-Image - This is collected when the participant activates their camera
- A video recording of the event - This is collected when the participant activates their microphone and/ or camera.
- Welwyn Hatfield Council will be hosting the event using Zoom technology and we will be live streaming the event on the day. An offline copy will be stored on our encoder and the video is available via the microsite for download. It will be archived for 6 months unless it is extended. The microsite is provided by a third-party Public-i. If a memory stick is provided a copy of the MP4 files can be given.
What metadata will be taken from joining?
https://zoom.us/privacy provides details of the personal data processed and how it is used, and the legal basis justification. For guest participants, the device type and IP address of the user is collected which is required for operations.
Where will it be stored?
Back-office and live video/audio is handled by Zoom's own (In our case European) servers and is also supported by Oracle Cloud. Welwyn Hatfield Borough Council has limited the account to Europe. Users can confirm what region they are connected to by clicking the "i" icon in the top right of the meeting. Zoom previously used Amazon AWS to store data, however they have since moved to their own Private Cloud infrastructure by Oracle Cloud more information on their GDPR policy is here:
· Welwyn Hatfield Borough Council does not use any of our own technology or storage for the creation and presentation, or collection of cookies or web-beacon analytics. These will not be collected during this event.
Self-Isolation Payment Privacy Notice
On 28 September 2020, the Government passed into law a national Test and Trace Support scheme. From 12 October, a one-off payment of £500 or access to a discretionary fund will be available for eligible individuals. More information about this scheme can be found on gov.uk.
If you apply, we will need to process your personal data to assess whether you are eligible to receive financial support, and if so, to provide a payment to you. This Privacy Notice sets out what personal data we will use, how we will use it, and why we need to, when an applicant applies for this support.
The Department of Health and Social Care (DHSC) has commissioned NHS Test and Trace on behalf of the government and is the data controller for the purposes of providing Test and Trace data to Welwyn Hatfield Borough Council.
Welwyn Hatfield Borough Council are the data controller for the purposes of assessing eligibility, administering and making payments under the Test and Trace Support scheme.
Categories of personal data we collect and process
We collect and process the personal data that you provide to us when completing your application for a self-isolation support payment, which may include:
Full residential address;
Mobile telephone number;
Home telephone number;
Proxy applicant details (as above where you may nominate someone else to complete this application on your behalf);
Employer name and address;
NHS notification number (the unique reference you will be given by NHS Test and Trace Service to self-isolate);
Bank account details;
Your National Insurance Number;
Proof of self-employment e.g. recent business bank statement (within the last two months), most recent set of accounts or evidence of self-assessment
Source and categories of personal data
We will obtain data from the NHS Test and Trace Service to confirm that you have either tested positive for COVID-19 or you have been in close contact with someone who has tested positive for COVID-19. As this data is related to your health it is referred to as 'special category data'.
You or your nominated representative will also provide us with additional personal data in relation to your application for a Self-Isolation Payment.
What we use your personal data for
We will carry out checks with the NHS Test and Trace Service and the Department for Work and Pensions (DWP), for verification purposes, Her Majesty's Revenue and Customs (HMRC), for tax and National Insurance purposes, and potentially with your employer in validating your application.
Information relating to your application will also be sent to the DHSC to help understand public health implications, allow us to carry out anti-fraud checks and determine how well the scheme is performing.
We will not share this data with other organisations or individuals outside of Welwyn Borough Hatfield Council for any other purpose.
We will provide information to HMRC in relation to any payments we make because Self-Isolation Payments are subject to tax and National Insurance contributions. If you are self-employed, you will need to declare the payment on your self-assessment tax return.
Our lawful basis for processing the personal data
We must have a legal basis to process your personal data. Our lawful basis in the processing that we'll undertake in assessing your eligibility for, and in making any self-isolation payment to you, is based on a legal obligation.
Where we use personal information to confirm that someone is eligible for a self-isolation payment, the sections of the law that apply are:
- GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- GDPR Article 9(2)(i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare;
- Data Protection Act 2018 (DPA) Schedule 1 Part 1 (2) - health or social care purposes
Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information without people's consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.
This is known as a 'section 251' approval and includes, for example, using your test results if you test positive for COVID-19 to start the contact-tracing process.
The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.
You can find more information on this via the NHS Contact Tracing Privacy Notice .
Data Processors and other recipients of your data
These are the recipients with which your personal data is shared:
Her Majesty's Revenue and Customs (HMRC) for tax and National insurance purposes;
Your employer for verification checks purposes;
The Council may also need to share your personal data with other service providers and partners who are contracted to carry out this service on our behalf. These providers are obliged to keep your personal details secure in line with GDPR and DPA and Council policies, and use them only to fulfil your service request.
International Data Transfers and Storage
Your data will not be transferred outside the UK, EEA or to third countries.
Personal data disposal and retention
We will only keep your personal data for as long as it is needed for the purposes of the COVID-19 emergency, and for audit and payment purposes.
Welwyn Hatfield Borough Council is committed to protecting your privacy when you use our services. All the personal information on our residents and customers is securely held and our staff and partners process data in a manner that ensures appropriate security of the personal data we handle. Our full Privacy notice explains how we use information about you.