This privacy notice is currently under review to ensure compliance with new data protection legislation.


​Merton Borough Council is a data controller for the purposes of the Data Protection Act and is registered as a ‘Data Controller’ (Reg. No. Z4606899). The Public Health team of Merton Borough Council also have a legal status allowing the processing of Personal Confidential Data for certain Public Health purposes. The use of such data will be restricted so that the principles contained in the Data Protection Act 1998 are fully adhered to. The legal basis is section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

The Public Health service of Merton Council is responsible for protecting and improving the health of the population of Merton. To help with this, we use data and information from a range of sources, including data collected at the registration of a birth or death, to understand more about the health and care needs in the area. Public Health teams within Local Authorities are also required to commission and manage services for their population.


​​The data collected in Merton Borough Council Public Health

We hold and collect personal identifiable information for Public Health purposes about:

  • residents of Merton
  • people receiving health and care services in Merton, and
  • people who work or attend school in Merton



Keeping the information secure

We are required to comply with the Data Protection Act to ensure information is managed securely and this is reviewed every year as part of our NHS Information Governance Toolkit assessment.

Any personal identifiable data is sent or received using secure email. All data is stored electronically on encrypted equipment and is managed using the principles of medical confidentiality and data protection. The number of staff accessing and handling such data is limited to only those key professionals named on relevant signed information sharing agreements (where applicable), all who undertake regular training about data protection and managing personal information.

In relation to births and deaths, the data will only be processed by Local Authority employees in fulfilment of their Public Health function, and will not be transferred, shared, or otherwise made available to any third party, including any organisations processing data on behalf of the Local Authority or in connection with their legal function.

We only keep hold of information for as long as is necessary. This will depend on what the specific information is and the agreed period of time.


Sharing information

These datasets will not be disclosed to anyone other than those stated above without permission, unless we have a legal reason to do so, for example disclosure is necessary to protect a person from suffering significant harm or necessary for crime prevention or detection purposes.

Confidential public health data will only be shared with other areas of the NHS, local authorities or care organisations with the permission of the Caldicott Guardian, once the necessary legal basis has been established and data protection safeguards have been verified, so that the data is managed and used under the same restrictions. Anyone who receives information from Merton Borough Council Public Health is also under a legal duty to keep it confidential.


To opt out

You have the right to opt out of Merton Borough Council Public Health receiving or holding your personal identifiable information.

There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues.

The process for opting out will depend on what the specific data is and what programme it relates to. For further information, please contact the Public Health team by email at: or in writing to: Public Health, Merton Borough Council, Merton Civic Centre, London Road, Morden, Surrey, SM4 5DX.


Further information

More information about how the Council uses your information is available from our website at:

If you have concerns about the use of your personal data, the Information

Commissioner's Office is an independent body set up to uphold information rights in the UK.  They can be contacted through their website:, through their helpline (0303 123 1113) or in writing to their head office: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.


May 2017