Fair Processing Notice – COVID-19

This Fair Processing Notice explains all of the processing that is being undertaken by the various Committees of the States of (“SoG”) in response to the current public health emergency posed by the COVID-19 pandemic. This Fair Processing Notice does not belong to one single Committee (or “controller” - as defined by the Data Protection () Law, 2017 – “the Law”), but belongs to the SoG as a whole. This notice provides information in relation to all of the processing that is being undertaken for the purpose of preventing, controlling and mitigating the impacts of this virus. The notice also provides information about processing that is being undertaken in order to provide financial assistance to local businesses and Islanders due to the ancillary impacts of the virus.

1. The Data Protection Law

The SoG acknowledges its obligations as per the Data Protection Law, which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject and more information in relation to these can be found by visiting www.gov.gg/DP.

The SoG acknowledges that all processing must be lawful, fair and must be undertaken with transparency. The table (Appendix A – please see below) explains all of the processing that is being undertaken by the States of Guernsey for the purpose of preventing, controlling and mitigating this emergency. The table lists all of the circumstances that personal data is collected by the SoG, it outlines which Committee is responsible for collection, what that Committee is doing with the data (including who it is being shared with) and it also explains the purpose of the processing.

All personal data will be retained by each controller for as long as the Medical Officer of Health (MoH) considers necessary in order to prevent, control and mitigate the risks to life and public health posed by the disease COVID-19. It will be erased or kept in a form that does not permit identification of data subjects as soon as MoH considers that it is no longer necessary to retain that data for those purposes or the purpose of any proceedings or potential proceedings (including any legal proceedings, or complaints to or investigations by the Data Protection Authority).

2. Contact Details

The contact details of the controllers listed within this notice are as follows:

The Medical Officer of Health

Le Vauquiedor, Rue Mignot, St. Andrew. Guernsey. GY6 8TW.

Email: [email protected]

The Committee for Health and Social Care

Le Vauquiedor, Rue Mignot, St. Andrew. Guernsey. GY6 8TW.

Email: [email protected]

The Policy & Resources Committee

Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH.

Email: [email protected]

The Committee for Environment & Infrastructure

Raymond Falla House, Longue Rue, St. Martin. Guernsey. GY1 6AF.

Email: [email protected]

The Committee for Economic Development

Market Building, PO Box 451, Fountain Street, St Peter Port. Guernsey. GY1 3GX.

Email: [email protected]

The Chief Officer of Police

Police Headquarters, Hospital Lane, St. Peter Port. Guernsey. GY1 2QN. Email: [email protected]

The Joint Emergency Services Control Centre

Police Headquarters, Hospital Lane, St. Peter Port. Guernsey. GY1 2QN.

Email: [email protected]

The Social Investment Fund

Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH.

The contact details for the SoG Data Protection Team are as follows:

The Data Protection Team

Sir Charles Frossard House, La Charroterie, St. Peter Port. Guernsey. GY1 1FH.

Email: [email protected]

The Committee for Employment & Social Security

Edward T. Wheadon House, Le Truchot, St Peter Port. Guernsey. GY1 3WH.

Email: [email protected]

Appendix A

Controller and Personal Data sharing Purpose of processing Lawful basis for processing processing activity data

Controller: Name, date Customs, Immigration or Police To prevent, control and mitigate The processing is necessary for MoH, Guernsey of birth, Officers stationed at the airport the risks to life and public health MoH to exercise her powers or Border Agency and Bailiwick of upon your arrival, aircraft/ferry posed by the disease COVID-19. perform her duties under the Guernsey Police. Guernsey operators and any others MoH may use the data to: Emergency Powers (Coronavirus) address involved in the collection of this (Bailiwick of Guernsey) Regulations, Processing Activity: where self- data on behalf of MoH or sending Contact individuals immediately 2020; Collection of personal isolation will this data to MoH; upon commencing their data of individuals occur, mandatory self-isolation and for The processing is necessary for arriving into the landline Any other person performing any further period where there reasons of public health and is Bailiwick of Guernsey number of functions under the Coronavirus may be a risk to their health or a carried out with appropriate by Customs, the above Regulations; risk that they have/might have safeguards for the significant Immigration or Police address, contaminated other individuals; interests of data subjects; Officers and agents of the SoG, Officers stationed at mobile States of or Chief Pleas To ensure compliance with self- The processing is necessary for a airports and ports on number, of , and any professional or isolation; law enforcement purpose, behalf of MoH. The email address data is collected data protection advisors, assisting specifically safeguarding against or nationality To assess whether individuals directly from the or advising MoH in connection preventing public threats to and present, or could present, a risk arriving individuals or with her functions; and security; and satisfactory of contaminating others; and from aircraft/ferry proof of Any other person the MoH The processing is necessary to operators or their identity. considers necessary, in order to If necessary, to impose further protect vital interests of the agents and provided prevent, control and mitigate restrictions/requirements or individuals and those who they may to Public Health. risks to life and public health taken any action that MoH pose a risk of contaminating. posed by the diseased COVID-19. considers necessary.

Controller and processing Personal data Data sharing Purpose of processing Lawful basis for processing activity

Controller: Full name, full name of proxy (if used), As above. As above. As above. MoH. date of birth, gender, address, landline and mobile telephone number, symptoms Processing activity: experienced, healthcare treatment Personal data collected information, information regarding directly from individuals employment/school/ day care/nursery, confirmed to have name/age of other individuals living in the Coronavirus. household and symptoms/travel history of anyone else in the household or any visitors of the household.

Controller: Full name, gender, date of birth, As above. As above. As above. MoH. nationality, address, landline and mobile telephone number, email address, Processing activity: relationship to confirmed case, public Personal data collected transport information and details of any from individuals who have other travel, details of employment, been in contact with the medical history and any signs/symptoms. confirmed case whilst the confirmed case was symptomatic and 24 hours prior to the confirmed case being symptomatic. Controller and processing Personal data Data sharing Purpose of processing Lawful basis for processing activity

Controller: Full name, gender, As above. To share information about contacts of As above. MoH. date of birth, known cases with other jurisdictions; and residency, recent Processing activity: travel information, To submit case information to the WHO Case reports provided to MoH medical history via the Public Health England UK Overseas by World Health Organisation and any Territories link as a formal registration of (WHO), Public Health – France signs/symptoms. cases and outcomes. and Public Health – UK.

Controller: Health data. As above; and As above. As above. MoH. PHE Colindale UK Processing activity: (test laboratory). COVID-19 Testing.

Controller: Address of States Trading To ensure that vulnerable members of the The processing is necessary HSC. vulnerable and Supervisory public are prioritized for essential utility to protect vital interests of members of the Board and local and fuel services. data subject or any other Processing activity: public. utility and fuel individual. Sharing of personal data companies. regarding vulnerable individuals.

Controller and processing Personal data Data sharing Purpose of processing Lawful basis activity for processing

Controller: Full name and any other MoH and officers To prevent, control and mitigate the risks As above. Guernsey Police and Guernsey details provided by working directly to the to life and public health posed by the Border Agency (Customs & members of the public in MoH. disease COVID-19. Guernsey Police and Excise and Immigration & relation to reported Guernsey Border Agency (Customs & Nationality Service). breaches of self-isolation Excise and Immigration & Nationality orders. Service) may use the data to ensure Processing activity: Investigation compliance with self-isolation. of reported breaches of self- isolation orders.

Controller: Full name, email address, MoH and officers To assist MoH in establishing and The data P&R/MoH. landline and mobile working directly to the maintaining a strong understanding of subject has telephone number, MoH and any others how COVID-19 is affecting the Bailiwick given explicit Processing activity: Collection of postcode, age, involved in the collection and its inhabitants. consent to the data via gov.gg online forms employment status, of this data on behalf of processing of directly from individuals who information relating to MoH or sending this data To provide MoH with information the personal are self-isolating. reported challenges to MoH (including, but regarding people who are self-isolating data for the faced by individuals self- not limited to, the SoG at any given time and the challenges purpose for isolating and health data. Data and Analysis individuals are facing during their period which it is Service). of isolation, with the potential to offer processed. support to those in need. Controller and Personal data Data sharing Purpose of Lawful basis for processing processing activity processing

Controller: Names, dates of births, Guernsey Police, Guernsey To provide The processing is necessary for MoH to Committee for contact details and Border Agency and Public additional contact exercise her powers or perform her Environment and addresses of individuals Health. details in duties under the Emergency Powers Infrastructure. and others present at the circumstances (Coronavirus) (Bailiwick of Guernsey) same residential address. where MoH are Regulations, 2020; and Processing Activity: unable to contact Provision of contact the person of The processing is necessary for reasons details for contact tracing interest in of public health and is carried out with purposes. relation to appropriate safeguards for the contact tracing. significant interests of data subjects.

Controller: Full name, contact details Committee for Employment For the purpose The processing is necessary for the Committee for Economic (home/work/email & Social Security (Social of providing a conclusion or performance of a Development. address/contact number), Security); small business contract; and bank account details, grant or for Processing activity: occupation, employee Policy and Resources inclusion on the The processing is necessary for the To process personal data details (names, numbers, Committee (Shared payroll co-funding exercise or performance by a public for the purpose of salary information) and Transaction Services); and scheme. authority of a task carried out in the providing Coronavirus Income Tax and Social public interest. Revenue Service. Business Support. Insurance Number.

Controller and Personal data Data Purpose of processing Lawful basis processing activity sharing for processing

Controller: Applicant’s full name, whether a loan or P&R and A Loan Guarantee Scheme (‘the Scheme’) as The processing P&R. overdraft, loan/ overdraft amount, amount of lending part of a number of financial measures that is necessary for existing borrowing facilities, repayment term, companies are being put in place in order to provide the exercise or Processing activity: details of any security taken against the new financial assistance to local individuals and performance Loan Guarantee borrowing, confirmation that payments are up businesses that have been affected by the by a public Scheme. to date, details of any arrears or holiday period COVID-19 pandemic. authority of a granted and any revised terms during the life of task carried the loan. Personal data belonging to employees out in the of applicants and their professional advisors or public interest. Lenders and their professional advisors.

Joint Controllers: Name, email address, mobile telephone Between The Clinical Self-Isolation & Accommodation The processing Joint Emergency number, date of birth and home address. the joint Support Scheme is being offered as part of a is necessary for Services Control controllers number of measures to provide assistance to the conclusion Center (JESCC), listed Bailiwick residents who have been affected or P&R and MoH by the COVID-19 pandemic. The Scheme is performance (JESCC, being run by the Integrated Community Cell of a contract; Processing Activity: P&R and on behalf of MoH, the primary point of and Clinical Self- MoH). contact for scheme participants will be the Isolation & JESCC and payment responsibilities will be The processing Accomodation managed by the Policy & Resources is necessary for Support Scheme. Committee. Further detail can be found on reasons of the dedicated FPN for this scheme here. public health. Controller and Personal Data Purpose of processing Lawful basis for processing processing activity data sharing

Controller: Name and N/A This personal data is collected and processed in accordance with The data subject has requested bank details the COVID-19 Response Appeal which was launched by the States or given consent to the P&R of Guernsey in response to the COVID-19 pandemic. processing of the personal data for the purpose for which it is Processing Activity: The personal data is collected and processed by P&R when a processed. donation is made to the appeal, either by bank transfer, card COVID-19 donation or cheque. The processing is necessary for a Response Appeal Law Enforcement Purpose. The donor’s personal data will also be processed for anti-money laundering purposes.

Joint Controllers: Name, P&R and This personal data is collected and processed in accordance with The data subject has requested contact the SIF the COVID-19 Community Charity Appeal which was launched by or given consent to the P&R details and the States of Guernsey and the SIF in response to the COVID-19 processing of the personal data bank details pandemic. The personal data is collected and processed by P&R for the purpose for which it is The Social when a donation is made to the appeal, either by bank transfer, processed. Investment Fund card donation or cheque. (‘the SIF’) The processing is necessary for a Personal data will be shared with the SIF for the purpose of Law Enforcement Purpose. Processing Activity: checking ‘promised’ donations which are received and for COVID-19 thanking the donor for their donation. Personal data will also be Community shared with the SIF and subsequently processed for anti-money Charity Appeal laundering purposes.

Controller and processing Personal data Data sharing Purpose of Lawful basis for processing activity processing

Controller: Full name, email ESS To provide The data subject has requested or given consent to the ESS. address, landline and departments financial processing for the purpose for which it is processed. mobile telephone currently assistance Processing activity: number, postcode, for The processing is necessary for the exercise or The Hardship fund dob, employment applicants. performance by a public authority of a task carried out in administration. To provide status and financial the public interest. financial assistance for applicants status. experiencing financial hardship as The processing is necessary for the controller to exercise a result of COVID 19. any right or power, or perform or comply with any duty, conferred or imposed on the controller by an enactment.

Controller: Full name, email ESS To The data subject has requested or given consent to the ESS. address, landline and departments providing processing for the purpose for which it is processed. mobile telephone currently. financial Processing activity: number, postcode, assistance The processing is necessary for the exercise or The Urgent Temporary age, employment for performance by a task carried out in the public interest. Accommodation scheme. To status, information applicants. provide urgent temporary The processing is necessary for the controller to exercise regarding why accommodation to lodgers and any right or power, or perform or comply with any duty, accommodation is tenants with immediate housing conferred or imposed on the controller by an enactment. issues as a result of COVID 19. sort.