COVID-19 (Operation Talla)

Revised 30th March 2020
Version 1.3

Specific Privacy Notice

COVID-19 (Operation Talla)

This privacy notice is to make it easier to understand and provide you with more information about how Essex Police may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19). Essex Police may seek to collect and process your personal data, in response to the recent outbreak of COVID-19, which is above and beyond what would ordinarily be collected.

Please note: A specific privacy notice for Essex Police employees only, relating to COVID-19, is available on the Essex Police Information Management intranet page.

Introduction

This Specific Privacy Notice has been created to make it easier for you to understand what personal data Essex Police processes about you, how and why it will be used in connection with the COVID-19 pandemic (Operation Talla). It is a requirement of the Data Protection Act 2018 (DPA).

It is subordinate to, and should be read in conjunction with, the force’s high-level Privacy Notice.

The high-level Privacy Notice provides you with complete details of the rights you have relating to the personal data Essex Police hold about you now and any personal data Essex Police might collect about you in the future.

If you require this Specific Privacy Notice in Braille or in another language please contact the Force’s Data Protection Officer (contact details below).

Privacy Information

Who is the Controller (the person who determines the purpose and means by which your personal data is processed) and what are their contact details?

The Controller is:

Chief Constable of Essex Police
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA

DPA Section 44(1)(a)

What are the contact details of Essex Police’s Data Protection Officer?

Laura Robbins
Data Protection Officer
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA
Email: [email protected]

DPA Section 44(1)(b)

What personal data is being collected?

Personal data is being collected to enable Essex Police to identify anyone they come into contact with through their policing tasks who are in any of the high-risk categories and would be considered vulnerable and/or infected with Coronavirus.

For what purpose(s) is my personal data intended to be processed by Essex Police?

For Law Enforcement Purposes – defined as the prevention, investigation, detection or prosecution of criminal offences, the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or the policing purpose.

Such information will be limited to what is proportionate and necessary, taking into account of the latest guidance issued by the Government and health professionals, in order to manage and contain the virus.  It will enable the Chief Constable of Essex Police to effectively fulfil their functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.

Whilst the provision of data cannot be mandated, you are strongly advised that it is in the best interests of all to provide this information so that Essex Police are able to take relevant steps to keep you and others safe.

The information will be managed in confidential manner.  All information will be held securely and processed on a ‘need to know’ basis by only a limited number of people.  If there is a need to disclose outside of this, the minimal amount of personal data will be used.

DPA Section 44(1)(c)

What are my rights under the DPA?

You have the following rights under the Data Protection Act:

• Right of access to your personal data
• Right of rectification of your personal data
• Right of erasure of your personal data or the restriction of its processing
• Right to lodge a complaint with the Information Commissioner

Sections: 44(1)(d)(i), S.45, 44(1)(d)(ii), 46, 44(1)(d)(iii), 47, 44(1)(e), 51.

Full details of those rights and how to exercise them can be found in Essex Police’s high-level Privacy Notice which can be found on the home page of the Essex Police website. It can also be obtained from:

Data Protection Officer
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA
Email: [email protected]

Is there any other information that is necessary to enable me to exercise any of rights listed at 4 above?

To exercise your rights (as described in section 4) please direct your enquiries to:

Information Rights Team
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA
Rights of Access: [email protected]
Rights of rectification/erasure: [email protected] 

If you are concerned over the way that Essex Police handles your personal data or require further details about the information contained within this Privacy Notice you may contact the Essex Police Data Protection Officer (DPO) as below:

Laura Robbins
Data Protection Officer
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA
Email: [email protected]

You have the right to complain to the Information Commissioner’s Office if you believe that they are or have been adversely affected by the handling of personal data by Essex Police.  Individuals may direct their complaint to the Information Commissioner’s Office:
            
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website:  www.ico.org.uk

DPA Section 44(2)(d) and Section 44(3)(a)

What is Essex Police’s legal basis for processing my personal data?

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful.  These relevant conditions are below:

Article 6(1)(d)

Is necessary in order to protect the vital interests of the data subject or another natural person.

Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.

Article 6(1)(e)

Is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.  The Police Reform and Social Responsibility Act 2011 provides that Chief Constable may do anything which is calculated to facilitate or is conducive or incidental to the exercise of the functions Chief Constable. 

The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:

Article 9(2)(i)

Is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Schedule 1, Part 2(6) – is necessary for reasons of substantial public interest and for the purpose of a function conferred on a person by an enactment or rule of law; e.g. Health Protection (Coronavirus) Regulations 2020 and Coronavirus Bill 2020

Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England

Alternatively, Essex Police’s legal basis for processing your personal data will be based on its Common Law Policing Purpose of protecting life and property, preserving order, preventing the commission of offences, bringing offenders to justice, and any duty or responsibility of the police arising from common or statute law.

In terms of Section 35(2) of the DPA the processing is necessary for the performance of a task carried out for a Law Enforcement purpose by Essex Police or another competent authority.

DPA Section 44(2)(a) and Section 35(2)

How long will my personal data be retained by Essex Police?

The additional personal data provided in relation to this outbreak of COVID-19 (Operation Talla) will be retained by Essex Police for as long as it necessary, whilst taking into account Government advice and the on-going risk presented by COVID-19. This data will be retained for at least the duration of the pandemic. At its conclusion, the Chief Constable will review whether further retention is still required, due to actions arising from the pandemic (e.g. a review of Essex Police conduct).

DPA Section 44(2)(b)

Who could Essex Police disclose my personal data to?

Essex Police may disclose your personal data various categories of recipient where the purpose surrounding the transfer is necessary, and the transfer of information complies with Data Protection legislation, including where there is a lawful basis. Some examples of recipient may be:

• NOMS (National Offender Management Service)
• Healthcare Professionals, including within Essex Police Custody Suites
• Ambulance Service
• NHS Trusts (A&E services, for example)
• County/Borough/Parish Councils
• Other ‘Competent Authorities’
• A ‘Relevant Authority’ – see S.115 Crime and Disorder Act 1998

DPA Section 44(2)(c)