Privacy notice for Public Health Services

What do we use the information for?

As a statutory organisation we collect, process and hold your personal information in order to deliver specific services and public health functions effectively. 

• Control infection
• Manage risks to public health
• To inform planning and commissioning of health services
• To organise and support the 0-19 health service and school nursing services
• Public health surveillance
• To support clinical audits
• To undertake equity analysis of trends, particularly for vulnerable groups
• To report summary statistics to national organisations
• To identify patterns and trends in mortality rates, life expectancy and premature death
• To monitor seasonal patterns, and for population projections
• To identify patterns and trends in birth and fertility rates, low birth weight, and still births
• To assess the performance of the local health and care system and to evaluate and develop them
• To inform decisions on the design and commissioning of services
• Identify priorities for action
• Produce assessments of the health and care needs of the population, in particular to support statutory responsibilities.

We publish a range of outputs in relation to public health on the East Riding Intelligence Hub, a website which provides evidence and intelligence to support decision making in the East Riding.

East Riding Intelligence Hub (external council website) 

We recognise that your personal information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously.

What information do we hold and use?

We collect and process the following information:

• Personal information (including full name, full residential address, date of birth, date of death, cause of death)
• Location data (including postcode and telephone number)
• Characteristics (such as ethnicity, sex, religion)
• Unique reference numbers (such as NHS number)
• Medical information
• Academic information 

Birth and Mortality Records

Personal information about births and deaths is supplied to local authorities by NHS Digital.  

For both birth and mortality records, we have a data access agreement with NHS Digital and data are supplied under Section 42(4) of the SRSA (2007) as amended by section 287 of the Health and Social Care Act 2012 and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Hospital Episode Statistics (HES) Data

Information about hospital activity is also supplied to local authorities by NHS Digital. We have a data access agreement with NHS Digital and data are supplied in accordance with section 261 of the Health and Social Care Act 2012, and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002. Data supplied are pseudonymised, a process by which information within a data record that may identify an individual are replaced by artificial identifiers, or pseudonyms which means that individuals are no longer identifiable. 

Further information on the NHS Digital dataset can be found on their website.  

NHS Digital (external website) 

On what grounds do we use the information? 

We process personal data for the following reasons:

• GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We process special category data for the following reasons:

• GDPR Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
• GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products of medicinal devices
• DPA 2018 Schedule 1 Part 1 (2) - health or social care purposes.

How do we collect information?

We may collect information in the following ways:

• Paper, electronic or online forms
• Email
• Telephone 
• Face to face, with one of our employees or one of our partners.

Who do we share your information with?

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation. We may share it with other public service bodies including the NHS, the police, education providers and voluntary, community and social enterprise (VCSE) organisations and other local authorities. 

The reasons why we may share your data with other public bodies are as follows:

• To protect vulnerable adults who may be at risk of harm or abuse
• To improve our understanding of your needs to enable us to inform you of other relevant services
• To support our public health responsibilities as set out in the Health and Social Care Act 2012
• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• Where necessary to protect individuals from the risk of harm or injury
• Where otherwise permitted under the General Data Protection legislation.

We will only disclose your sensitive or confidential information to a third party, if we are legally required to do so, or where we have good reason to believe that failing to share the information would put you or someone else at risk of harm.

We will not pass your personal information to external organisations for marketing or sales purposes or for any commercial use without your prior expressed consent.

How long do we store it and is it secure?

The public health team has retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law.  Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your case.  

For information on how long your information will be held visit the retention page. 

What rights do I have?

The rights that you have depend upon the grounds upon which we collected your information.  All of the rights you could have are outlined on the data protection rights page.   

In most cases, people who have been involved with the Public Health team will have the following rights:

• The right of access - you are entitled to see the information the service holds about you
• The right to rectification - we will amend information accordingly, if any information that the service holds about you is incorrect 
• The right to restrict processing - you may wish to limit how we use your data
• The right to object - in addition to the right to limit the use of your data, you also have a right to object to the use of you data for certain actions.

To exercise any of your above rights, please visit the data protection rights pages for more information.

Where can I find out more?

If you would like to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can contact the Information Commissioner’s Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external website)

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect any changes in our services, feedback from customers, and to comply with any changes in the law. This privacy notice was last updated on 31 August 2022.