Public health privacy notice

City and Hackney public health is a joint service shared between both Hackney Council and Corporation of London and hosted by Hackney Council. 

On behalf of both authorities as joint data controllers the public health service collects and processes personal data in order to meet the Council’s  legal obligations, and fulfil its public task to improve the health and wellbeing of everyone in Hackney. 

This privacy notice sets out how we use your data to deliver public health services, and comply with data protection legislation. The council-wide privacy notice and Corporation of London privacy notice has more information on your rights, and who to contact if you have a concern about how the council uses your data.

 

Why do we collect and process your data?

We may collect and process your data where:

• we have a legal obligation, in connection with services we offer or commission
• we have a public task to improve the health and wellbeing of people in Hackney and / or the City of London

Data about people’s health is defined as “special category data” by the General Data Protection Regulation 2016 (‘GDPR’) and Data Protection Act 2018 (‘DPA’). Data about criminal convictions is also treated as sensitive. In either case, unlawful access to the data could have a serious impact on individuals and communities. There are several reasons why we may need to process this data:

• for the purposes of preventive medicine, helping to protect people from the dangers of communicable diseases and environmental threats, the provision and management of health and social care
• public interest in the area of public health
• statistical purposes

What legally allows us to collect and process your data?

Depending on the particular service, we process personal data in accordance with either section 6c (legal obligation) or 6e (public task) of the GDPR.

Our use of special category data is justified by section 9h (provision and/or management of health or social care), or 9i (public interest in the area of public health), or 9j (statistical purposes), according to the particular service or Public Health function.

We are legally obliged to provide certain services

The Council and Corporation are legally obliged to provide certain public health services:

• protection from, and advice about, communicable diseases and environmental threats
• sexual health services
• a health visitor review service for pregnant women, and children aged 0-5 years 
• height and weight checks for primary school children
• health checks for adults living in Hackney and / or the City of London
• public health advice to National Health Service commissioners 

We provide a range of other services designed to improve health and wellbeing in Hackney

The Council and Corporation receives an annual public health grant from the Department of Health, subject to provision of certain services, including:

• stop smoking 
• recovery from alcohol and / or drug misuse
• activities to promote exercise, healthy eating, and a healthy environment

Other public health services delivered or commissioned by the Council and Corporation, to meet the general duty to improve the health of people in Hackney and the City of London, include:

• support for women at risk of domestic abuse
• care coordination for people with complex health and social needs
• preventive health services

We need data about your health and demographics to ensure you get the most from the services provided, to give you feedback on your progress, and to measure the service provider’s performance.

We may get personal data from you, or from someone else involved in your care (for example, if you’ve been referred by a doctor).

We carry out research, statistical analysis and strategic planning to ensure effective public health services

The joint specialist public health service has a duty to assess future local health and care needs in Hackney and the City of London, and special category data may be used for statistical analysis in connection with:

• joint strategic needs assessment, identifying local health priorities and responses
• The Director of Public Health’s annual report
• the local health and wellbeing strategy
• responding to communicable disease outbreaks or environmental threats
• commissioning and performance management of public health services

We receive data from a wide range of sources including national government departments, the Office for National Statistics, NHS Digital, GP practices, police authorities, hospitals and social care services. 

Our data access agreement (‘DAA’) with NHS Digital gives us access to special category data. This allows us to understand more about the causes of disease and ill health in the local population.

• births and vital statistics
• primary care mortality database
• hospital episode statistics

Only those specialist public health service staff named in the DAA have access to such data, and it is published in such a way that individuals cannot be identified and in accordance with our pseudonymisation and anonymisation of data policy.

We also receive data that allow us to analyse public health needs and trends at an individual, small area and population level. This data is either: 

• anonymised – personal identifiers are removed, and data cannot be linked. This kind of data gives us a ‘snapshot’ of local health and care needs 
• pseudonymised – personal identifiers are replaced with a reference number. Data can be linked, and this allows us to look at long-term trends.

In either case, access to this data is tightly-controlled, and extra security measures are in place to keep it safe.

We also use data from service providers and service user surveys to develop effective and appropriate services, to measure service providers’ performance, and to ensure that the council gets best value for the money it spends. The data we get from service providers for these purposes does not allow us to identify individual people.

What data do we collect and/or process?

We will use the minimum amount of personal and special category data possible in order to fulfil our public health function. 

We will only use personal data for the purposes stated when we ask for the data from you, or receive it from another source, in connection with a public health service.

The data we get from NHS Digital and providers of health and social care include details of individuals’ identity (“identifiers”).

Identifiers included in data relating to births are: name, address and usual residence of mother, place of birth, NHS number of child, date of birth.

The identifiers included in data relating to deaths are: name and address of the deceased, place of death, NHS number, date of birth, date of death, maiden name, name of certifier, name of coroner, and cause of death.

We receive this data by secure file transfer, it is encrypted and password-protected, and identifiable data are only accessible to staff named in the DAA.

If we use identifiable data from any other source for any secondary analysis – for example, to look at health across Hackney and / or the City of London – any personal identifiers are removed, and the data will be ‘aggregated’ such that individuals cannot be identified.

Data sharing

Your data may be shared between different service providers, to ensure that you get the most appropriate service. You will be told when this could apply to your personal data. Our service agreements with service providers include protocols on data sharing, as well as the Council’s and Corporation’s requirements regarding confidential and safe handling of people’s data.

There are limited circumstances in which we may be legally required to share your data without your knowledge: safeguarding the wellbeing of children and vulnerable adults, to prevent serious crime, or following a court order.

How long we keep your data

If you have given us your data in connection with a public health service, we will follow the Council’s and Corporation’s data retention schedule to ensure that your data is not kept longer than necessary.

In some cases, for example, where you are also receiving health or social care services, the length of time a record may be kept will be in accordance with the prevailing records management code of practice for health and social care.

If we contact you in connection with your past use of a public health service, we will review any personal information that we already hold to ensure that it is accurate and up-to-date.

If you want to know more about your rights in respect of your data, please visit the Council’s main privacy notice or the Corporation of London main privacy notice.