COVID-19 Hub Privacy Notice

This Privacy Notice explains how the council uses the information it collects through the Covid-19 Hub.

The Hub coordinates services to those needing support during the COVID-19 pandemic. Residents may fall into one of two different categories:

  • Those who are ‘shielding’ during the COVID-19 pandemic; and
  • Those who are not shielding but in need of support due to COVID-19 (perhaps because they are self-isolating, their economic circumstances have changed or their usual support arrangements have been disrupted).

The notice explains the purpose for processing this information, categories of personal information and who we may share it with. The general functions are described in the service Fair Processing Notice.

The Hub coordinates a wide range of services for residents affected by COVID-19. The core areas are:

  • Access to food;
  • Support with shopping and other errands;
  • Delivery of medication and prescriptions; and
  • Social support.

The Hub also acts as a first point of contact for all related enquiries and ongoing case management. As such it is a route to a wide range of council support, such as advice on Council Tax, Benefits and financial support.

These services are being provided in line with the wider processing detailed within our corporate fair processing notice. 

In order to provide a quality service, the council must collect, hold and process a considerable amount of information, including personal information relating to personal circumstances and general information relating to service use. It does this to provide services in the most effective and efficient way that it can.


We collect the following information 

Personal information (name, address, contact details and NHS number) for all ‘shielding’ residents has been provided to the council by the government’s Ministry of Housing, Communities and Local Government (MHCLG). We have entered into a Memorandum of Understanding issued by the MHCLG that sets out how the council will ensure your personal information remains secure and is used appropriately.

This information has been provided to the council with the express purpose of ensuring you receive the support you need from the council to ‘shield’ yourselves from COVID-19 for the 12 weeks advised by government.

Personal information (name, address, contact details) is collected for all other residents who are not shielding but contact the COVID-19 Hub for support.

Your personal information is only used for a specified purpose(s) but if we intend to use it for any other new purposes we will normally ask you first. For instance, in some cases, the Council may wish to use your information to improve and develop services, or to prevent or detect fraud. In any event our processing will always have a demonstrable lawful basis. Where practicable and reasonable we will always seek to inform you of any significant proposed changes to how we process or intend to process your personal data, in order to ensure full transparency over how we handle your information.

Personal data is collected and retained to support delivery of services to residents during the Covid19 pandemic. The key services delivered include food provision, shopping, assistance with accessing medication and prescriptions and social support. Personal data collected includes household composition, living circumstances, care arrangements, utility arrangements, dietary requirements, online access, general support requirements as well as support that has been provided. 

How we collect your information

In order to fulfil our legal duties, it is important that we have access to your personal data, as it helps us to deal with your queries and provide services. We collect information in a variety of ways, including:

  • For shielded residents through provision of data by MHCLG.
  • Direct contact from a resident for a service (for example through the Hub or another council service).
  • Via third party referrals (for example voluntary agencies, family representatives).
  • From elected members.

Legal basis for using your personal data

Although access to your data is restricted, there are occasions when we need to share it with others. Some examples are:

  • Where we have a lawful basis to do so, for example in general performance of a contract or service.
  • As part of public task and public duty where appropriate to do so.
  • With regard to service improvement.
  • When we are legally obliged to, for example debt collection or in connection with legal proceedings.
  • For the detection and prevention of fraud.
  • In the event of an emergency or risk of serious harm or threat to life, when the emergency services and other local authorities may need it to assist.

Who else will we send your data to?

We will only share information with any third party where there is an Information Sharing Protocol in place to allow joined up and coordinated support to be provided to individuals affected by COVID-19, whilst safeguarding rights to privacy. This includes:

  • The NHS Volunteer Scheme.
  • Government bodies such as MHCLG/ DEFRA who are involved in service delivery, for oversight purposes.
  • Bodies involved in prevention and detection of crime and fraud (for example: DWP, HMRC).
  • External / Partner Health and social care organisations.

The Council has entered into a data sharing agreement with DEFRA to allow non-shielding vulnerable residents to secure a priority online supermarket delivery slot with either Tesco or Iceland. Any resident wishing to access this service from Tesco will be required to provide their Personal information (full name, email address, contact number, address) and this will be shared with DEFRA and Tesco to facilitate the delivery of this service. Staff will explain this to any resident wishing to use the service and ensure they have their agreement to proceed on that basis.  Residents can request for this information to be updated or deleted by Tesco and DEFRA at any point by contacting the Council. 


How long do we keep your information?

We will only keep your information for as long as is required by law and to provide you with the necessary services in line with our stated retention policy.

We may also anonymise personal data, to allow the Council to effectively target and plan the provision of services. At this point the data would cease to be personal data.

Your rights and access to your information

You have the right to have a copy of the information that we hold about you. The Data Protection Act 2018 also gives you additional rights that refer to how the council holds and uses your information.

Consequently, under certain circumstances, by law you have the right to:

  • Withdraw consent and the right to object and restrict further processing of your data; however, this may affect service delivery to you.
  • Request to have your data deleted where there is no compelling reason for its continued processing and provided that there are no legitimate grounds for retaining it.
  • Request your data to be rectified if it is inaccurate or incomplete.
  • Have your data transferred or copied should you move to another authority.
  • Not be subject to automated decision-making including profiling.

Further information about how to submit a Subject Access Request.

Please visit the Data Protection page for further details on how the council complies with the new Data Protection Act 2018.

If you have any concerns

Please contact us if you would like to know more about the information we hold about you and how we use it at:

You have a right to complain to us if you think we have not complied with our obligation for handling your personal information; please email:

If you are not satisfied with the Council’s response you have a right to complain to the Information Commissioner’s Office (ICO). You can report a concern by visiting the ICO website.