Fair Processing Notice – COVID-19
Total Page:16
File Type:pdf, Size:1020Kb
Fair Processing Notice – COVID-19 This Fair Processing Notice explains all of the processing that is being undertaken by the various Committees of the States of Guernsey (“SoG”) in response to the current public health emergency posed by the COVID-19 pandemic. This Fair Processing Notice does not belong to one single Committee (or “controller” - as defined by the Data Protection (Bailiwick of Guernsey) Law, 2017 – “the Law”), but belongs to the SoG as a whole. This notice provides information in relation to all of the processing that is being undertaken for the purpose of preventing, controlling and mitigating the impacts of this virus. The notice also provides information about processing that is being undertaken in order to provide financial assistance to local businesses and Islanders due to the ancillary impacts of the virus. 1. The Data Protection Law The SoG acknowledges its obligations as per the Data Protection Law, which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject and more information in relation to these can be found by visiting www.gov.gg/DP. The SoG acknowledges that all processing must be lawful, fair and must be undertaken with transparency. The table (Appendix A – please see below) explains all of the processing that is being undertaken by the States of Guernsey for the purpose of preventing, controlling and mitigating this emergency. The table lists all of the circumstances that personal data is collected by the SoG, it outlines which Committee is responsible for collection, what that Committee is doing with the data (including who it is being shared with) and it also explains the purpose of the processing. All personal data will be retained by each controller for as long as the Medical Officer of Health (MoH) considers necessary in order to prevent, control and mitigate the risks to life and public health posed by the disease COVID-19. It will be erased or kept in a form that does not permit identification of data subjects as soon as MoH considers that it is no longer necessary to retain that data for those purposes or the purpose of any proceedings or potential proceedings (including any legal proceedings, or complaints to or investigations by the Data Protection Authority). 2. Contact Details The contact details of the controllers listed within this notice are as follows: The Medical Officer of Health Le Vauquiedor, Rue Mignot, St. Andrew. Guernsey. GY6 8TW. Email: [email protected] The Committee for Health and Social Care Le Vauquiedor, Rue Mignot, St. Andrew. Guernsey. GY6 8TW. Email: [email protected] The Policy & Resources Committee Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH. Email: [email protected] The Committee for Environment & Infrastructure Raymond Falla House, Longue Rue, St. Martin. Guernsey. GY1 6AF. Email: [email protected] The Committee for Economic Development Market Building, PO Box 451, Fountain Street, St Peter Port. Guernsey. GY1 3GX. Email: [email protected] The Chief Officer of Police Police Headquarters, Hospital Lane, St. Peter Port. Guernsey. GY1 2QN. Email: [email protected] The Joint Emergency Services Control Centre Police Headquarters, Hospital Lane, St. Peter Port. Guernsey. GY1 2QN. Email: [email protected] The Social Investment Fund Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH. The contact details for the SoG Data Protection Team are as follows: The Data Protection Team Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH. Email: [email protected] The Committee for Employment & Social Security Edward T. Wheadon House, Le Truchot, St Peter Port. Guernsey. GY1 3WH. Email: [email protected] Appendix A Controller and Personal Data sharing Purpose of processing Lawful basis for processing processing activity data Controller: Name, date Customs, Immigration or Police To prevent, control and mitigate The processing is necessary for MoH, Guernsey of birth, Officers stationed at the airport the risks to life and public health MoH to exercise her powers or Border Agency and Bailiwick of upon your arrival, aircraft/ferry posed by the disease COVID-19. perform her duties under the Guernsey Police. Guernsey operators and any others MoH may use the data to: Emergency Powers (Coronavirus) address involved in the collection of this (Bailiwick of Guernsey) Regulations, Processing Activity: where self- data on behalf of MoH or sending Contact individuals immediately 2020; Collection of personal isolation will this data to MoH; upon commencing their data of individuals occur, mandatory self-isolation and for The processing is necessary for arriving into the landline Any other person performing any further period where there reasons of public health and is Bailiwick of Guernsey number of functions under the Coronavirus may be a risk to their health or a carried out with appropriate by Customs, the above Regulations; risk that they have/might have safeguards for the significant Immigration or Police address, contaminated other individuals; interests of data subjects; Officers and agents of the SoG, Officers stationed at mobile States of Alderney or Chief Pleas To ensure compliance with self- The processing is necessary for a airports and ports on number, of Sark, and any professional or isolation; law enforcement purpose, behalf of MoH. The email address data is collected data protection advisors, assisting specifically safeguarding against or nationality To assess whether individuals directly from the or advising MoH in connection preventing public threats to and present, or could present, a risk arriving individuals or with her functions; and security; and satisfactory of contaminating others; and from aircraft/ferry proof of Any other person the MoH The processing is necessary to operators or their identity. considers necessary, in order to If necessary, to impose further protect vital interests of the agents and provided prevent, control and mitigate restrictions/requirements or individuals and those who they may to Public Health. risks to life and public health taken any action that MoH pose a risk of contaminating. posed by the diseased COVID-19. considers necessary. Controller and processing Personal data Data sharing Purpose of processing Lawful basis for processing activity Controller: Full name, full name of proxy (if used), As above. As above. As above. MoH. date of birth, gender, address, landline and mobile telephone number, symptoms Processing activity: experienced, healthcare treatment Personal data collected information, information regarding directly from individuals employment/school/ day care/nursery, confirmed to have name/age of other individuals living in the Coronavirus. household and symptoms/travel history of anyone else in the household or any visitors of the household. Controller: Full name, gender, date of birth, As above. As above. As above. MoH. nationality, address, landline and mobile telephone number, email address, Processing activity: relationship to confirmed case, public Personal data collected transport information and details of any from individuals who have other travel, details of employment, been in contact with the medical history and any signs/symptoms. confirmed case whilst the confirmed case was symptomatic and 24 hours prior to the confirmed case being symptomatic. Controller and processing Personal data Data sharing Purpose of processing Lawful basis for processing activity Controller: Full name, gender, As above. To share information about contacts of As above. MoH. date of birth, known cases with other jurisdictions; and residency, recent Processing activity: travel information, To submit case information to the WHO Case reports provided to MoH medical history via the Public Health England UK Overseas by World Health Organisation and any Territories link as a formal registration of (WHO), Public Health – France cases and outcomes. signs/symptoms. and Public Health – UK. Controller: Health data. As above; and As above. As above. MoH. PHE Colindale UK Processing activity: (test laboratory). COVID-19 Testing. Controller: Address of States Trading To ensure that vulnerable members of the The processing is necessary HSC. vulnerable and Supervisory public are prioritized for essential utility to protect vital interests of members of the Board and local and fuel services. data subject or any other Processing activity: public. utility and fuel individual. Sharing of personal data companies. regarding vulnerable individuals. Controller and processing Personal data Data sharing Purpose of processing Lawful basis activity for processing Controller: Full name and any other MoH and officers To prevent, control and mitigate the risks As above. Guernsey Police and Guernsey details provided by working directly to the to life and public health posed by the Border Agency (Customs & members of the public in MoH. disease COVID-19. Guernsey Police and Excise and Immigration & relation to reported Guernsey Border Agency (Customs & Nationality Service). breaches of self-isolation Excise and Immigration & Nationality orders. Service) may use the data to ensure Processing activity: Investigation compliance with self-isolation. of reported breaches of self- isolation orders. Controller: Full name, email address, MoH and officers To assist