Personal data
The General Data Protection Regulation as supplemented by the UK Data Protection Act 2018 requires organisations and Data Controllers such as Bury Council to treat individuals' personal data fairly. To help meet this requirement, individuals should be told why their personal data is held, what the organisation will do with the data, and the types of third parties (if any) their personal data may be disclosed to. This information is usually contained within a Privacy Notice.
The General Data Protection Regulation as supplemented by the UK Data Protection Act 2018 gives you the right to request access to your personal information, unless exemptions apply. If you would like to request access to your information you can complete the Subject Access Request Application Form or put your request in writing. In most cases, the Council will respond to a valid subject access request within one month, unless exemptions apply.
The Information Commissioner's Office maintains a register of fee payers that Bury Council is part of. You can search this to find out what personal data is being processed by a particular controller.
Bury Council's registration number is Z5720815.
Summary of Public Health
This privacy notice explains what personal information is collected, what it is used for and who it is provided to. The notice also describes why the Council requires your data, and the legal basis on which it does this.
This privacy notice relates to the Council's Public Health service. It provides additional information that specifically relates to this particular service, and should be read together with our privacy notice, which provides more detail on the questions below.
Public Health in Bury became part of Bury Council when the public health duty moved from the NHS to local authorities in April 2013. We work within a strong and formal partnership between the council and NHS Bury Clinical Commissioning Group. The aim is to improve the health and wellbeing of people in Bury and achieve a sustainable health and social care system across Bury.
What personal information does this service use?
We receive personal information about:
- Residents of Bury
- People receiving health and care services in Bury
- People who work or attend school in Bury
The types of personal information we hold are:
- NHS number
- Date of birth or death
- Date of registration
- Place of birth/death text and postcode
- Postcode of usual residence
- Date of registration
- Maiden name
- Name of certifier
- Name of coroner
- Birth weight
- Cause of death
- Date of A&E attendance/outpatient appointment or admission
- Investigation, diagnosis, treatment and procedure codes
- Body Mass Index (BMI)
- Carer support
- Marital status
This service also uses the following special category personal information:
- ethnic origin
- religion
- health details
- sexual orientation
Only a limited number of authorised staff have access to personal information where it is appropriate to their role and is strictly on a need-to-know basis. All of our staff receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.
What is your personal information used for?
Our overall role is to improve and protect the health and wellbeing of the whole population of Bury, but have five specific responsibilities described by law:
- Helping protect people from the dangers of communicable diseases and environmental threats.
- Organising and paying for sexual health services.
- Providing specialist public health advice to primary care services: for example GPs and community health professionals.
- Organising and paying for height and weight checks for primary school children.
- Organising and paying for regular health checks.
To do the above, we need information about people's health and wellbeing. We use this information for measuring health and care needs of the population, for planning, evaluating and monitoring health, and for protecting and improving public health.
Personal information helps us to:
- Inform what our priorities should be so that we can decide which services we should commission, such as advice and support services on alcohol and drug misuse, help to stop smoking, advice on obesity and diet, promoting physical activity, better nutrition and a healthy lifestyle.
- To coordinate initiatives, such as to improve mental health, and the health of children and young people, and raise awareness about health at work and preventing injuries.
- To assess the performance of local health and care system and to evaluate and develop them.
- To carry out research and intelligence activities to tackle the scale of health inequalities found in Bury.
- To carry out assessments of the health and care needs of the population and to comply with our statutory obligations. For example, the Public Health Annual Report and the Joint Strategic Needs Assessment, use data to help us understand patterns of disease, the outcomes of our residents, and what we can do to improve people health and improve healthy life expectancy.
- To maintain our own accounts and records in order to support and to monitor how we and our partner organisations are providing our services.
What is the lawful basis of processing data
We will only use your personal data where it is necessary in order to perform our public tasks and duties as a Local Authority (Art 6(1)(e) of the UK General Data Protection Regulations, and to meet our statutory obligations to commission health care services, such as under the Care Act 2016 (Art 6(1)(c) of the UK GDPR).
In some cases, we may be required to share your information by law (Art 6(1)(c)) or where it is necessary to protect someone in an emergency (Art 6(1)(d)).
We will only use any special category personal data we hold where it is necessary and because there is a substantial public interest (such as to carry out a legal duty, for the prevention of crime) (Art 9(2)(g)), and where it is necessary to deliver social care services (Art 9(2)(h)).
We may also need to use special category data:
- where it is necessary to protect someone in an emergency (Art 9(2)(c))
- where it is necessary for legal cases (Art 9(2)(f))
- where it is necessary for employment purposes (Art 9(2)(b))
- where it is necessary for archiving, research or statistical purposes (Art 9(2)(j))
The legal basis for Public Health in Bury to receive and process person-identifiable information about births and deaths is provided by Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012).
Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002 provides a legal basis for processing confidential personal information for the purpose of fulfilling our statutory duties in relation to communicable diseases.
Where we obtain your information from?
The Public Health team does not collect personal information directly from citizens. However, the service providers we commission and pay for will usually need to collect personal information in order to provide the service. We will usually require those providers to give us data so we can evaluate the service, ensure we get value for money, and to plan service improvement.
Much of the information we use is in aggregate form, in other words, it is made up of statistics that relate to groups of people rather than to individuals. For example, we use aggregate data to produce statistics to help identify local priorities to improve and protect the health and wellbeing of the communities we serve. Using data that is already based on groups means this information is anonymous, which means it does not identify individuals within these groups.
We sometimes get data that is not already grouped, but where all identifying data (including name, NHS number, and date of birth, date of death, address, and postcode) has been removed so that we can group the data ourselves. For example, we get age in years instead of date of birth, or a code that covers a large geographical areas instead of address or postcode. The data may have a 'pseudonym' (or coded reference) attached to it that links it to a particular individual without that individual being identified. This would allow us to understand, for example, how many people had one, two, three or more admissions to hospital without us knowing who the individual patient is.
Sometimes we do need to use information relating to individuals that could allow individuals to be identified. This personal data could include NHS number, date of birth, date of death, and postcode but would not include direct identifiers such as name and address. When we do this it is often because we need information where different sources of data have been linked together.
Who will we share your personal information with?
Most of the information we produce is in the form of anonymous statistics published through our website and in reports and papers to the Health and Wellbeing Board, the governing bodies and performance boards. We never publish information to the general public that could be used to directly identify an individual.
For example, when we publish data where the numbers of people in a given category are small we would usually suppress those numbers or, where possible, combine categories so the numbers are larger.
We do not routinely share person-identifiable information with other organisations. However, we might need to share personal information (including special category information) in exceptional circumstances, such as an outbreak of a serious infectious disease (we have a lawful basis to share this information under Article 6(1)(d) - where information sharing is necessary to protect someone's life - and Article 9(2)(i)).
On rare occasions the service providers we commission may have a legal duty or power to share information, for example for safeguarding or criminal matters.
How Bury Council manages and shares adult's personal information
All adults have rights as data subjects under the UK General Data Protection Regulation as supplemented by the UK Data Protection Act 2018, including a general right to be given access to personal data held about them by any data controller. Information that you have provided to the Council will be stored securely, and will be used only for the purposes stated when the information was collected.
As of April 2013, The Health and Social Care Act 2012 has given local authorities the power to perform public health functions. As such the Council has "a duty to improve the health of the people and responsibility for commissioning appropriate public health services" and the statutory responsibilities for public health services as clearly set out in the Health and Social Act 2012. If you wish to opt-out of Bury Council receiving or holding your personal identifiable information, please see the final section of this notice.
How Bury Council manages and shares children and young people's personal information
Children and young people have rights as data subjects under the UK General Data Protection Regulation as supplemented by the UK Data Protection Act 2018, including a general right to be given access to personal data held about them by any data controller. The presumption is that, by the age of 13, a child has sufficient maturity to understand their rights and to make an access request themselves if they wish. A parent would normally be expected to make a request on a child's behalf if the child is younger.
Schools - Learning and achievement
To meet the requirements of the UK General Data Protection Regulation as supplemented by the UK Data Protection Act 2018, schools need to issue a Privacy Notice to pupils and/or parents summarising the information held about pupils, why it is held, and the third parties to whom it may be passed on. These statistics are used in such a way that individual pupils cannot be identified from them.
The Privacy Notice covers the provision of information to the Connexions services under the Learning and Skills Act 2000 and the rights of parents or pupils to opt out from this.
Youth Support Services
Bury Council's Children Young People and Culture department consists of numerous services helping to improve outcomes for children and young people. Two of these services are Connexions and the Youth Service.
Connexions provides confidential advice, support and information to children and young people aged 13 to 19 (or up to the age of 25 for those with learning difficulties or disabilities). In order to provide this service, Connexions holds basic demographic and contact information. An opt out option is available for those not wishing to receive Connexions' support.
The Youth Service works to promote the personal and social development of young people between the ages of 11and 25 years to enable them to fulfil their potential as empowered members of society. Young people can take advantage of as few or as many of the service's programmes and activities as they wish. The service stores as much information on a young person as is necessary to facilitate its engagement with the person.
Children in receipt of Social Care Services - Children in care and children in need
The Secretary of State, acting through the Department for Education, collects information on individuals who are looked after by local authorities and on individual children in need from April 2009. The data that will be collected will vary with each collection but will include personal characteristics and the details of services provided to the individuals involved.
The name of the child will not be included in the returns but where a child has a UPN this will be collected enabling the Department for Education to extract education information from the national pupil database. The Department for Education does not use the child's name in processing or analysing information in the returns or the composite data.
How long will we keep your information?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any future legal, accounting, or reporting requirements. Currently this is a maximum of 10 years from last contact.
Objecting and opting out to data collection
You have the right to request that Bury Council stop processing your personal data in relation to any council service. However, if this request is approved this may cause delays or prevent us delivering a service to you. Where possible we will seek to comply with your request but we may need to hold or process information in connection with one or more of the Council's legal functions.
You also have the right to opt out of Bury Council Public Health receiving or holding your personal identifiable information. There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on the specific data is and what programme it relates to. For further information, please contact us.