Coronavirus response privacy notice

The following privacy notice applies to information processed in aid of Northamptonshire County Council’s Covid-19 (coronavirus) response. It should be read in addition to the council’s overall Customer and Service Specific Privacy Notices.

Privacy notice (Last updated: 23 April 2020)

Northamptonshire County Council is the Data Controller for the personal data it collects about you and remains committed to handling your data appropriately, in line with Data Protection legislation.

Northamptonshire County Council has declared a Critical Incident in line with its Constitution in order to contribute to the national and local response to the Covid-19 outbreak. As part of this we are working with partners in an Incident Response structure, which includes a Community Resilience Hub. Please visit the Council’s coronavirus updates page for further details.

Where your personal data is used as part of the Community Resilience Hub and in response to the Shielding List it will only be used for those specific purposes of ensuring you are provided with the food, social support, wellbeing and medication packages in line with the Central Government guidance and subsequent Memoranda of Understanding.

Purpose for processing

The Department of Health and Social Care has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require Northamptonshire County Council to process confidential patient information for purposes set out in Regulation 3(1) COPI.

The council will collect and use your personal information in order to manage and mitigate the spread and impact of the current outbreak of Covid-19:

  • to protect public health
  • to provide public health and social care services to the public
  • to monitor and manage the Covid-19 outbreak and incidents of exposure
  • for the purposes of research Health and social care data, including ‘confidential patient information’ including physical/mental health

Information collected and processed will enable the Council to fulfil our obligations to keep people safe, ensure contingency plans, aid business continuity, and safeguard those considered high risk or vulnerable as a result of the outbreak.

Personal information collected and lawful basis

Your personal information processed will include, but is not limited to:

  • Name
  • DoB
  • Contact information – home address, telephone numbers, email address
  • Personal Reference Numbers – NHS number
  • Dietary requirements
  • Lifestyle and social circumstances
  • Information relevant to your needs during the outbreak or your support needs if you are a carer
  • Car registration used to receive a test at a regional test centre
  • Mobile number given to receive test results by text

Our lawful bases for processing this personal information are as follows:

  • GDPR Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest.

Special Category personal data is processed for the following lawful bases:

  • GDPR Article 9(2)(g) – processing is necessary for reasons of substantial public interest.
  • DPA 2018 Schedule 2 (6) – Statutory and governmental purpose to process and share this data.

The Council also has a statutory requirement to process any such confidential patient information for purposes set out in Regulation 3(1) of the Health Service Control of Patient Information Regulations 2002 (COPI) under the notice dated 20th March 2020 issued to them by the Secretary of State for Health and Social Care under Regulation 3(4) of COPI (the COPI Notice) until 20 September 2020.

Who we may share your information with

We will share information back to providers where we believe they can help us meet your service needs.

We will only share relevant information where necessary to respond to the Covid-19 outbreak. All sharing will be in line with the requirements of the Health Service (Control of Patient Information) Regulations 2002 (COPI) and Data Protection Act 2018.

How long we will hold your information

Your information will be retained only for as long as necessary, for the duration of the Covid-19 outbreak.

Data specifically provided to the Council to provide Community Resilience Hubs in response to the Covid-19 outbreak will be returned to the Government department and deleted from NCC servers in line with Government procedures and Memorandum of Understanding.

Your information rights

Find out how to access your personal information by visiting our general data protection regulation page.

You are entitled to a copy of, or a description of, the personal data we hold that relates to you, subject to lawful restrictions.

You may be entitled to rectification, restriction, objection, and erasure of your personal information depending on the service and lawful basis. Emailed requests should be made direct to the Information Rights team at

See the council’s overall privacy notice for further contact details and if you have a complaint about your information rights. ​