Coronavirus (COVID 19) privacy notice

Read the privacy notice for Coronavirus (COVID 19)

This privacy statement has been developed in response to coronavirus (COVID-19) pandemic and is intended to both inform and reassure you that your information is being shared appropriately and lawfully. This privacy notice explains how we will collect and use your personal data specifically with regard to the COVID-19 pandemic.

Who we are

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed, and what it is used for.

Your personal data - what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

The UK Independent Regulator of data protection law, the Information Commissioner's Office (ICO) has issued specific guidance for the processing of personal data during COVID-19.

What information we collect from you?

You may have already provided personal information to us for a specific reason (for example, applying for Council services, benefits, blue badge etc.) and normally, we would notify you if your information was being used for a different purpose. However, due to the rapidly emerging situation regarding COVID-19, this will not always be possible.

If we already hold information regarding your vulnerability as defined in the current guidance from the Scottish Government and Public Health, we may share this information with services both internal and/or external to us, for emergency planning purposes and/or to protect your health and well-being.

We may need to ask you for personal information, including sensitive personal information (known as special category data) that you have not already supplied - for example, your age or if you have any underlying illnesses or are vulnerable. This is so we can assist you and allow us to provide new services required as a result of the COVID 19 crisis and to allow us to prioritise our existing services.

We always aim to collect the minimum data necessary to achieve the purpose required.

The following information may be collected and shared:

Name and address
Telephone/mobile number/email
Date of Birth
Gender
Next of kin
GP contact details
Unique IDs, for example Community Health Index (CHI) number.

We may ask for and share special category (sensitive) personal data:

Nationality
Religion
Disability
Heath conditions (including medication)

If you are applying for business support grant funding we will ask you for bank details and other financial information. Please click here to view the Business Support Grant (COVID- 19) Privacy Notice.

If you are a volunteer, we use your personal information to enable us to communicate with you and make decisions on how best to utilise your skills to assist in the delivery of food parcels and other vital supplies to the most vulnerable in our communities.

The following information may be collected and shared:

Name and address
Telephone/mobile number/email
Skills, for example HGV license holder

How we will use the information about you?

We will only process the personal data we need in order to provide you with the support and services during the COVID 19 crisis for the following purposes:

Test and protect (Scottish Government Strategy)
Save and protect life
Relieve suffering
Protect public health
Warn and inform
Care for people
Minimise harmful effects
Promote swift restoration of normal life
Support local communities

No new data processing will take place unless is necessary for the compelling public interest in the current health emergency.

What is the legal basis for processing (using) your personal data?

How we are sharing/using your personal data will determine the legal basis the Council is relying on which will be either that:

processing is necessary in order to protect the vital interests of yourself or another person (Article 6(1)(d) of the GDPR);
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (Article 6(1) (f) of the GDPR); or
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller as per article 6 (1) (e) of the GDPR and underpinned by law, namely, the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005

The data protection legislation also allows the processing of special categories data (e.g. health information):

as necessary for "reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health" (Article 9 (2) (i) of the GDPR). The current pandemic is an example of this situation.
as necessary in order to protect the vital interests of yourself or another person (Article 9(2)(c) GDPR);

Current data protection legislation also allows us to process data if it is necessary to comply with the obligations set out in law. We are given many powers in different Acts which can be used in the context of emergency data processing, including the Civil Contingencies Act 2004, the Local Government (Scotland) Act 2003, the NHS (Scotland) Act 1978 and the Public Health (Scotland) Act 2008.

Who we share your information with?

To ensure your safety, health and wellbeing we may share your information with:

Council services
NHS Scotland
Public Health Scotland
Police Scotland
Scottish Fire and Rescue Service
HM Coastguard
Scottish Government
Voluntary organisations and care providers

We want to reassure you that most of the processing of your data during COVID-19 is based on existing protocols we already had in place with partner organisations.

How long do we keep hold of your information?

We will not keep your information for any longer than it is needed once the pandemic is over.

Once the pandemic is over, we will revisit any special arrangements put in place to ensure any unnecessary processing is ended and any data deleted, as appropriate. Please note some data may be retained as it will be part of the service's normal functions.

What are my rights?

There are no fundamental changes to your data protection rights.

However, as a result of the COVID-19 outbreak, we are aware that individuals may experience delays with "subject access requests".

Please note that currently, enquiries submitted by post are likely to be delayed as Council Offices may be closed.

Please also bear in mind that our priority at the moment is the safety and security of the public, resources are stretched and normal processes are disrupted, therefore the length of time taken to respond to any request may take longer than usual. We appreciate your patience and understanding.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above. If you remain dissatisfied, you have the right to complain to the Information Commissioner:

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1113

If you have no internet access

Please contact us at the above postal address or telephone number if you wish to have copies of any of the above information and you do not have access to the internet. We will endeavour to let you have hard copies of the information.