Privacy Notice – Staff Mandatory COVID-19 Vaccinations

On 14 November 2021, the Department of Health and Social Care published the Health and Social Care Act 2008 (Regulated Activities) (Amendment) (Coronavirus) Regulations 2021 (SI 2021/891) which began the process of making it a legal requirement for any patient-facing staff working in health and social care settings to be fully vaccinated against COVID-19, unless exempt.

This means that relevant patient-facing staff undertaking CQC related activities will be required to provide evidence that they have been fully vaccinated against COVID-19, subject to specific exemptions, by no later than 01^st April 2022.

These regulations will protect vulnerable people and individual workers in health and social care settings, including hospitals, GP practices, dentists, community services and where care is delivered in a person’s home.

In order to monitor compliance with the new regulations, the Trust must collect information about the vaccination status of eligible staff and/or any medical exemptions that might apply.

Please note that the COVID-19 vaccination effort is fast-moving, and this privacy notice is subject to change.

Controller and Data Protection Officer contact details

Controller – London Ambulance Service NHS Trust

Data Protection Officer – Nicki Maher: [email protected]
What personal data we collect

Your vaccination or exemption status, which will be linked with your existing staff record.
Purpose of the sharing

To comply with The Health and Social Care Act 2008 (Regulated Activities) (Amendment) (Coronavirus) Regulations 2021 and to ensure patient-facing workers are protected against COVID-19 and to reduce the spread of the virus in the health and social care setting, which includes vulnerable individuals at higher risk of COVID-19.
The Lawful conditions for processing

In order to process your personal data, we need a lawful basis to do so. The lawful bases for processing, storing and sharing this data under the General Data Protection Regulation (GDPR) are:

Article 6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 6(1)(e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The basis in law is met by the Health and Social Care Act 2008 (Regulated Activities) (Amendment) (Coronavirus) Regulations 2021.

When we collect data that is classed as special category data, under Article 9 of the UK GDPR we rely on the following conditions:

Article 9(2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment.

Article 9(2)(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

We may also process special category data under:

Article 9(2)(h) the processing is necessary for medical diagnosis, the provision of health treatment and management of a health and social care system.

Article 9(2)(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Furthermore, the Health and Safety at Work Act 1974 obliges employers to take reasonable steps to reduce any workplace risks; this duty gives employers justification for encouraging their employees to be vaccinated to protect themselves and everyone else at the workplace. COVID-19 is also a reportable disease under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (known as RIDDOR) which strengthens employers’ encouragement that employees should agree to vaccination.
Recipient or categories of recipients of the shared data

Your identifiable data will remain within your employing organisation.

If we process your vaccinations, we share this data with the National Immunisation Vaccination Service/National Immunisation Management Service (NIVS/NIMS).
Right to object

Article 21 of the UK GDPR gives individuals the right to object to the processing of their personal data. An objection may be in relation to all of the personal data we hold about you or only to certain information. It may also only relate to data we are processing for a particular purpose.

You should be aware that this is a right to raise an objection, which is not the same as having an absolute right to have your wishes granted in every circumstance.

Please contact our information governance team if you wish to object to the processing of your data. You will need to provide information on your specific circumstances which relate to the reasons you are objecting.
Right to access and correct

You have the right to access any identifiable data that is being shared and have any inaccuracies corrected. To do this please submit a subject access request via [email protected]
Retention period

Your information will be stored in line with the NHS Records Management Code of Practice 2021. In some circumstances, for example where we are legally required to, we may keep your information for a longer period of time.

Information that identifies you will be stored securely and processed in the UK. We will ensure that there are appropriate security safeguards including strong cyber security.
Right to Complain

You have the right to raise a concern if you think the Trust is processing your personal data incorrectly. Please contact your line manager in the first instance.

If you require further information about how we process your personal data, you may also contact our Information Governance team at [email protected]

If you are not satisfied after going through the internal resolution route, you can raise a complaint with the Information Commissioner’s Office, using this link https://ico.org.uk/global/contact-us/ or calling their helpline – Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)