Handling your data during the coronavirus crisis
The council routinely processes the personal data of its residents, employees and stakeholders. This information will have been provided for a specific reason. Normally, the council would seek to inform you that the data provided would be used for a different purpose, however, due to the rapidly emerging situation regarding the current pandemic this will not normally be possible. If we already hold information regarding vulnerability as defined in the current guidance from the Government and Public Health England, we may share this with other council departments, other public bodies and with key partners for emergency planning and response purposes.
We may need to ask you for personal information that you have not already supplied, including sensitive personal information, for example if you have any underlying illnesses or are vulnerable. This is so the council can assist and prioritise its support services to those who need them the most.
Lawful basis for processing your personal data
The lawful bases for processing personal data in response to the coronavirus crisis will be:
- Processing is necessary for the performance of a task carried out in the public interest (Article 6 (1)(e))
- Disclosure is in the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR)
- Where it is necessary for the reasons of substantial public interest Article 9(2)(g)
- Where it is in the interest of public health Article 9(2)(i)
Sharing your personal data
In this current pandemic we may share your information with other public authorities, emergency services, and other stakeholders where it is necessary and proportionate to do so. This includes with community groups delivering COVID-19 response services in your local area.
How long we keep your personal data
We will only keep your personal data for as long as is necessary for the purpose for which we are processing it, unless we have a legitimate reason for keeping it, for example, any legal requirement to keep the data for a set time period. At this stage it is not known how long data relating to the management of the pandemic will be retained, although as a guide the standard retention period for many council services is 6 years. We will ensure that we follow any published guidance in this respect as it becomes available.
Where possible we will anonymise this data so that you cannot be identified and when we do not need to continue to process your personal data, it will be securely destroyed.
Complaints or queries
We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about data protection very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. To make a complaint please contact the Data Protection Officer at DPO@mendip.gov.uk.
If, having exhausted the complaint process, you are not content that your request or review has been dealt with correctly, you can complain to the Information Commissioner's Office to investigate the matter further by writing to:
Information Commissioner's Office Wycliffe House
Water Lane Wilmslow Cheshire SK9 5AF
We will keep this privacy notice under regular review and if we make any changes we will publish the updated version on our website.