This privacy policy will explain how the national Health Protection Support Team (HPST) uses the personal data we collect from you when we contact you, or when you contact us via email.
National Health Protection Support Team (HPST) is part of Cardiff Council, who is the Data Processor for the purposes of the data collected.
All personal data is processed in accordance with the UK GDPR and Data Protection Act 2018.
The National Health Protection Support Team is a data processor working on behalf of Public Health Wales for the purpose of monitoring and preventing the spread of infectious disease. Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information is:
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. The legislation being: Social Services and Well-Being (Wales) Act 2014, section 162-165.
What data do we collect?
- Personal identification information (Name, address, email address, phone number, employer, job title, NHS number).
We will also ask you to update us on the following information:
- Prescribed medication pertaining only to relevant infectious disease prevention and control
- Places visited whilst possibly under the effects of exposure to the relevant infectious disease
- People you may have come into contact with whilst in the isolation or possible exposure period.
This is collected for the purpose of monitoring and preventing the control of infectious disease.
How do we collect your data?
We receive your data from Public Health Wales (PHW) in the first instance. This may include your name, address, email address, phone number, employer, job title, and NHS number. We will try to contact you be phone or by email. When we make contact, we will ask you to confirm some of this information to ensure we are speaking to the correct person. We will amend or update information if incorrect or out of date. We may phone you or email you to do this.
The lawful basis for processing your data
Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information is:
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
The legislation being: Social Services and Well-Being (Wales) Act 2014, section 162-165.
How will we use your data?
HPST will process your data to support Public Health Wales (PHW) in their monitoring of infectious disease. This may include:
-
Contacting you if you are identified as potentially having come into contact with a person suffering with an infectious disease.
- Contacting you if you are identified as being infected by infectious disease.
- Offering information and useful advice in relation to isolation and medication on behalf of Public Health Wales.
- We will receive your data securely from PHW in order to contact you. We will only share your data back to PHW once our calls have been completed.
- We will update any incorrect information received before sharing back to PHW.
How do we store your data?
HPST securely stores your data Cardiff Council Servers and shares securely back to Public Health Wales once we have completed any actions.
HPST will keep your personal data for up to three months. Once this time period has expired, we will delete the file containing your data using automated retention periods in our secure storage software.
What are your data protection rights?
HPST would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
The right to access
You have the right to request copies of your personal data.
The right to rectification
You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.
The right to erasure
You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing
You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing
You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability
You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us via email.
Privacy policies of other Organisations
Public Health Wales:
Privacy Notice - Public Health Wales
Changes to our privacy policy
Our Company keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 27 January 2024
How to contact us
If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us via email at
dataprotection@cardiff.gov.uk or by post:
Data Protection Officer
Information Governance Team
County Hall
Atlantic Wharf
Cardiff
CF10 4UW
How to contact the appropriate authority
Should you wish to report a complaint or if you feel that Cardiff Council has not addressed your concern in a satisfactory manner, you may contact the
Information Commissioner's Office: 0303 123 1113.