advertisement

Public Health

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the Data Controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the Data Protection Officer

  • Our Data Protection Officer is Paul Bond. You can contact him at DPO@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Local authorities have a duty to improve the health of the population they serve. To help with this, our Public Health Intelligence team in Business Intelligence use data and information from a range of sources, including information collected at the registration of a birth or a death and users of provider services commissioned by Lancashire County Council.

We use this data and information to fulfil our statutory public health functions. This helps us to understand more about the health and care needs of our local population. By using the data to measure the health, mortality, morbidity and care requirements of our population we are able to effectively plan public health initiatives in order to protect and improve the health of the citizens of Lancashire.

We act as a data processor and as a data controller. This means that we collect and process personal information and data. We also comply with the NHS Digital information governance standards allow us access to NHS digital services.

Types of information we use

We work with many types of data to be able to promote health and support improvements in the delivery of health and care services in Lancashire. This includes the processing of:

Personal data: information relating to a living, identifiable individual

Identifiable data: data that can identify individuals, but which does not meet the definition of 'personal data', as defined in Article 4 (1) UK GDPR, in that the data relates to deceased individuals

Pseudonymised data: personal identifiable data is replaced with artificial identifiers in order for Public Health staff to use the information without being able to identify any individuals.

Anonymised data: information about individuals that has all identifying details removed

Aggregated data: this is where all anonymised data is grouped together and it is not possible to identify individuals

We hold the following data collections that contain various types of data about individuals and populations:

Hospital Episode Statistics (HES)

HES data is accessed via the NHS Digital Data Access Environment (DAE) and does not contain person identifiable data. Aggregation of HES data is usually performed in the DAE. Any downloaded pseudonymised data is stored on Lancashire County Council's secure network and access is restricted to two named members of staff. We do not hold identifiable hospital data.

Primary Care Mortality Database (PCMD)

The PCMD provides access to identifiable mortality data as provided at the time of the registration of the death, along with the additional general practice details, geographical indexing and coroner details where applicable. Access to the PCMD is based upon geographical boundaries as an Upper Tier Local Authority and Clinical Commissioning Group within Lancashire. The mortality data is managed by NHS Digital and downloaded through NHS Digital's Secure Electronic File Transfer System.

Births dataset

This dataset provides access to identifiable data about the number of births that occur within the geographical boundary as an Upper Tier Local Authority and Clinical Commissioning Group within Lancashire. Individual records of births contain only the NHS number and date of birth of the baby and usual address and postcode of mother. Names of mothers and babies are not recorded.

This data is supplied to Lancashire County Council by NHS Digital under strict licence and data disclosure controls. The births data is downloaded through NHS Digital's Secure Electronic File Transfer System.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

Official authority is vested in the controller by virtue of:

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by Section 287 of the Health and Social Care Act (2012); and

Regulation 3 of the Health Service (Control of Patient Information) Regulations (2002)

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.

Official authority is vested in the controller by virtue of:

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by Section 287 of the Health and Social Care Act (2012); and

Regulation 3 of the Health Service (Control of Patient Information) Regulations (2002)

Recipients of the data

Record level data is not shared with any other organisation. Only analysis based on aggregated data is shared with organisations who require deaths and births data for statistical purposes.

Information we share

N.B. Lancashire County Council does not process personal data by automated means.

Personal data (information relating to a living, identifiable individual)

  • Name
  • Date of birth
  • Address/Postcode
  • Next of Kin
  • NHS Number
  • Name of certifier

Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Health /Medical diagnosis data

Any transfers to another country

No

Retention periods 

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File Type Description  Security Retention Period
Database Hospital Episode Statistics (HES) Any downloaded pseudonymised data is stored on Lancashire County Council's secure network and access is restricted to two approved users agreed with NHS Digital. All data is destroyed upon completion of the analysis. Where downloaded aggregated data is suppressed in line with the HES analysis guide, such data may be retained beyond the period of the agreement.
Database Public Health Mortality Database (PCMD) Stored securely on LCC network and accessible only by 2 named officers Held locally until no longer required and then securely deleted. Data is only retained with an extant DSA with NHS Digital in place.
Dataset Births dataset Stored securely on LCC network and accessible only by 2 named officers Held locally until no longer required and then securely deleted. Data is only retained with an extant DSA with NHS Digital in place

Your rights

Can I opt out of Public Health datasets?

You have the right to opt out of Lancashire County Council Public Health receiving your information from the NHS and processing your personal and identifiable information.

There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on what the specific data is and what programme it relates to. You can choose not to have information about you shared or used for any purpose beyond providing your own treatment or care.

You can contact your GP for further information about registering an opt-out or to end an opt-out you have already registered. The NHS website explains how your personal information is held, accessed and shared with organisations, such as Lancashire County Council.

You have certain rights under the General Data Protection Regulation (GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ 

Or email: dataprotection@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific project then please contact:

Public Health Intelligence
Business Intelligence
PO Box 78
County Hall
Preston
PR1 8XJ 

Email: BusinessIntelligence.publichealth@lancashire.gov.uk

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).