Public health privacy notice
The council’s specialist public health service collects and processes personal data in order to meet the council’s legal obligations, and fulfil its public task to improve the health and wellbeing of everyone in Hackney.
This Privacy Notice sets out how we use your data to deliver public health services, and comply with data protection legislation. The council-wide privacy notice has more information on your rights, and who to contact if you have a concern about how the council uses your data.
Why do we collect and process your data?
We may collect and process your data where:
- we have a legal obligation, in connection with services we are required to offer
- we have a public task to improve the health and wellbeing of people in Hackney
Data about people’s health is defined as “special category data” by the General Data Protection Regulation 2016 (‘GDPR’) and Data Protection Act 2018 (‘DPA’). Data about criminal convictions is also treated as sensitive. In either case, unlawful access to the data could have a serious impact on individuals and communities. There are several reasons why we may need to process this data:
- for the purposes of preventive medicine, the provision and management of health and social care
- public interest in the area of public health
- statistical purposes
What legally allows us to collect and process your data?
Depending on the particular service, we process personal data in accordance with either section 6c (legal obligation) or 6e (public task) of the GDPR. Our use of special category data is justified by section 9h (provision and/or management of health or social care), or 9i (public interest in the area of public health), or 9j (statistical purposes), according to the particular service or Public Health function.
We are legally obliged to provide certain services
The council is legally obliged to provide certain public health services:
- protection from, and advice about, communicable diseases and environmental threats
- sexual health services
- a health visitor review service for pregnant women, and children aged 0-5 years
- height and weight checks for primary school children
- health checks for adults living in Hackney
- public health advice to National Health Service commissioners
We provide a range of services designed to improve health and wellbeing in Hackney
The council receives an annual public health rant from the Department of Health, subject to provision of certain services, including:
- stop smoking
- recovery from alcohol and / or drug misuse
- activities to promote exercise, healthy eating, and a healthy environment
Other public health services delivered by the council, in order to meet its general duty to improve the health of people in Hackney, include:
- support for women at risk of domestic abuse
- care coordination for people with complex health and social needs
We need data about your health to ensure you get the most from the services provided, to give you feedback on your progress, and to measure the service provider’s performance. We may get personal data from you, or from someone else involved in your care (for example, if you’ve been referred by a doctor).
We carry out research, statistical analysis and strategic planning to ensure effective public health services
The specialist public health service has a duty to assess future local health and care needs in Hackney, and special category data may be used for statistical analysis in connection with:
- joint strategic needs assessment, identifying local health priorities and responses
- The Director of Public Health’s annual report
- the local health and wellbeing strategy
We receive data from sources including the Office for National Statistics, NHS Digital, GP practices, hospitals and social care services.
Our data access agreement (‘DAA’) with NHS Digital gives us access to special category data. This allows us to understand more about the causes of disease and ill health in the local population.
- births and vital statistics
- primary care mortality database
- hospital episode statistics
Only those specialist public health service staff named in the DAA have access to such data, and it is published in such a way that individuals cannot be identified.
We also receive data that allow us to analyse public health needs and trends at a population level. These data are either:
- anonymised – personal identifiers are removed, and data cannot be linked. This kind of data gives us a ‘snapshot’ of local health and care needs
- pseudonymised – personal identifiers are replaced with a reference number. Data can be linked, and this allows us to look at long-term trends.
In either case, access to this data is tightly-controlled, and extra security measures are in place to keep it safe.
We also use data from service providers and service user surveys to develop effective and appropriate services, to measure service providers’ performance, and to ensure that the council gets best value for the money it spends. The data we get from service providers for these purposes does not allow us to identify individual people.
What data do we collect and/or process?
We will use the minimum amount of personal and special category data possible in order to fulfil our public health function.
We will only use personal data for the purposes stated when we ask for the data from you, or receive it from another source, in connection with a public health service.
The data we get from NHS Digital include details of individuals’ identity (“identifiers”).
Identifiers included in data relating to births are: name, address and usual residence of mother, place of birth, NHS number of child, date of birth.
The identifiers included in data relating to deaths are: name and address of the deceased, place of death, NHS number, date of birth, date of death, maiden name, name of certifier, name of coroner, and cause of death.
We receive this data by secure file transfer, it is encrypted and password-protected, and identifiable data are only accessible to staff named in the DAA.
If we use identifiable data from any other source for any secondary analysis – for example, to look at health across Hackney – any personal identifiers are removed, and the data will be ‘aggregated’ such that individuals cannot be identified.
Your data may be shared between different service providers, to ensure that you get the most appropriate service. You will be told when this could apply to your personal data. Our service agreements with service providers include protocols on data sharing, as well as the council’s requirements regarding confidential and safe handling of people’s data.
There are limited circumstances in which we may be legally-required to share your data without your knowledge: safeguarding the wellbeing of children and vulnerable adults, to prevent serious crime, or following a court order.
How long we keep your data
If you have given us your data in connection with a public health service, we will follow the council’s Data Retention schedule to ensure that your data is not kept longer than necessary. In some cases, for example where you are also receiving social care services, this may extend to eight years after your last contact with us.
If we contact you in connection with your past use of a public health service, we will review any personal information that we already hold to ensure that it is accurate and up-to-date.
If you want to know more about your rights in respect of your data, please visit the council’s main privacy notice.