27 March 2020

This privacy notice is in response the Covid-19 (coronavirus) Pandemic and supports our overarching Privacy Notice to explain how Merton Council (as a Data Controller) will collect, use and protect personal data.

The council already holds data regarding residents, employees and stakeholders. You may have provided this information for a specific reason. Normally, the council would seek to inform you that the data provided would be used for a different purpose. Due to the rapidly emerging situation regarding the current pandemic this will not always be possible. If we already hold information regarding vulnerability as defined in the current guidance from the Government and Public Health England, we may share this for emergency planning purposes or to protect your vital interests by sharing with services both inside and outside the council.

We may in this current crisis need to ask you for personal information including sensitive personal information for example your age or if you have any underlying illnesses or are vulnerable, that you have not already supplied. This is so the council can assist and prioritise it's services.

Further information can be found on the ICO's data protection and coronavirus information hub.

Your personal data

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller's possession or likely to come into such possession.  Some of your personal data is classed as 'special category data' because it is the information that is considered to be more sensitive and therefore requires more protection. This includes your medical data.

Legal basis for processing your personal data

How we are processing your personal data will determine the legal basis for processing. The legal bases for processing by the council as a public authority will be:

  1. Where disclosure is in the vital interests of yourself or another person (Article 6(1)(d) and 9(2)(c) GDPR)
  2. Where it is necessary in the public interest (Article 6(1)(e))
  3. Where it is necessary for the reasons of substantial public interest Article 9(2)(g)
  4. Where it is in the interest of public health Article 9(2)(i)

Sharing your personal data

In this current pandemic, and to support Test and Trace we may share your information with other public authorities, emergency services, and other stakeholders as necessary and where it is proportionate to do so.

Changes to this privacy notice

We will keep this privacy notice under regular review and if we make any changes, we will publish the updated version on our website.

Data Protection Officer contact information

Data Protection Officer, Merton Civic Centre, London Road, Morden, SM4 5DX – data.protection@merton.gov.uk