Self-isolation payment privacy notice
On 28 September 2020, the Government passed into law a national Test and Trace Support scheme. From 12 October 2020, a one-off payment of £500 or access to a discretionary fund will be available for eligible individuals. Read more information about this scheme on the GOV.UK website.
The Department of Health and Social Care (DHSC) has commissioned NHS Test and Trace on behalf of the government and is the data controller for the purposes of providing Test and Trace data to Wyre Forest District Council.
Wyre Forest District Council are the data controller for the purposes of assessing eligibility, administering and making payments under the Test and Trace Support scheme.
New package to support self-isolation
If you have been told by the NHS to self-isolate, either because you have tested positive for COVID-19 or you have been in contact with someone who has tested positive, you may be entitled to some financial support during your self-isolation period.
What are self-isolation payments?
People who are eligible will receive:
A £500 one-off Test and Trace Support payment or provision from the discretionary fund to remain at home to help stop the spread of the virus.
Data we collect
The information we collect varies according to the purpose/processing activity but would comprise some or all of the following:
- Full name
- Full residential address
- email address
- mobile telephone number
- home telephone number
- employer name and address
- Proxy applicant details (as above where you may nominate someone else to complete this application on your behalf)
- NHS notification number (the unique reference you will be given by NHS Test and Trace Service to self-isolate)
- bank account details
- National Insurance Number
- proof of self-employment e.g. recent business bank statement (within the last two months), most recent set of accounts or evidence of self-assessment
Source and categories of personal data
We will obtain data from the NHS Test and Trace Service to confirm that you have either tested positive for COVID-19 or you have been in close contact with someone who has tested positive for COVID-19. As this data is related to your health it is referred to as ‘special category data’.
You or your nominated representative will also provide us with additional personal data in relation to your application for a Self-Isolation Payment.
What we use your personal data for
We will carry out checks with the NHS Test and Trace Service and the Department for Work and Pensions (DWP), for verification purposes, Her Majesty’s Revenue and Customs (HMRC), for tax and National Insurance purposes, and potentially with your employer in validating your application. If you are applying because you are losing income due to having to care for a child who has to self-isolate, we will check the details with the child’s education or care setting. Your information will also be checked against our Council Tax database and/or our electoral register to determine residency.
Information relating to your application will also be sent to the DHSC to help understand public health implications, allow us to carry out anti-fraud checks and determine how well the scheme is performing.
We will provide information to HMRC in relation to any payments we make because Self-Isolation Payments are subject to tax and National Insurance contributions. If you are self-employed, you will need to declare the payment on your self-assessment tax return.
Your information may also be shared with third parties including the Police or other public bodies with the responsibility to prevent or detect crime, to protect public funds and to help protect public health. We may also use your information for the purpose of performing any of our statutory enforcement duties and we will make any disclosures required by law.
We will not share this data with other organisations or individuals outside of Wyre Forest District Council for any other purpose.
Our lawful basis for processing the personal data
We must have a legal basis to process your personal data. Our lawful basis in the processing that we’ll undertake in assessing your eligibility for, and in making any self-isolation payment to you, is based on a legal obligation.
Where we use personal information to confirm that someone is eligible for a self-isolation payment, the sections of the law that apply are:
- GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare;
- Data Protection Act 2018 Schedule 1 Part 1 (2) - health or social care purposes
Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information without people’s consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.
This is known as a ‘section 251’ approval and includes, for example, using your test results if you test positive for COVID-19 to start the contact-tracing process.
The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.
Data Processors and other recipients of your data
These are the recipients with which your personal data is shared:
- Her Majesty’s Revenue and Customs (HMRC) for tax and National insurance purposes
- Your employer for verification checks purposes
- Police - if we suspect you are not self-isolating when required to and you have taken receipt of the Test and Trace support payment.
- Education or care settings when checking details of applications regarding children having to self-isolate.
International data transfers and storage
The majority of personal information is stored on local Wyre Forest systems. But there are some occasions where your information may leave the UK especially where it is stored on cloud based servers.
We have additional protections on your information if it leaves the UK ranging from secure ways of transferring data to ensuring we have a robust contract in place with that third party.
We’ll take all practical steps to make sure your personal information is not sent to a country that is not seen as ‘safe’ either by the UK or EU Governments.
If we need to send your information to an ‘unsafe’ location, we’ll always seek advice from the Information Commissioner first.
Personal data disposal and retention
We will only keep your personal data for as long as it is needed for the purposes of the COVID-19 emergency, and for audit and payment purposes.
Your rights as a data subject
By law, you have a number of rights as a data subject and this does not take away or reduce these rights. Your rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.
All information is processed in accordance with Wyre Forest District Council’s data protection policy.
Where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on ‘grounds relating to your particular situation’. We will have to demonstrate why it is appropriate for us to continue to use your personal data.
These rights are:
- Your right to get copies of your information – you have the right to ask for a copy of any information about you that is used.
- Your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected
- Your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used.
- Your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case.
- Your right to get information deleted – this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case.
If you are unhappy or wish to complain about how your personal data is used as part of this programme, you should contact Wyre Forest District Council in the first instance,
If you are still not satisfied, you can complain to the Information Commissioners Office via their website or by post to:
Information Commissioner's Office
We use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level.
Data Protection Officer
Our Data Protection Officer can be contacted by email or by post:
Data Protection Officer
Wyre Forest District Council,
Wyre Forest House,
Alternatively you can contact customer services by email or by calling 01526 732928 between 9am and 5pm Monday to Friday.
Automated decision making or profiling
No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.
Changes to our policy
We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on our website. This privacy notice was last updated on 06 October 2020.