Staff Vaccination Privacy Notice

Part of the national response to the coronavirus (COVID-19) pandemic is the need to record the details of staff who have been vaccinated against COVID-19. Vaccinations are normally undertaken in GP practice or community settings, as well as on Trust Premises. With COVID-19 vaccinations, this will be undertaken in a variety of care settings and for the majority of health and care staff, vaccinations will be managed by 'lead providers' on behalf of local health and care organisations.

The 'Notice' issued by the Secretary of State for Health sets aside the requirements of Common Law Duty of Confidentially for COVID-19 purposes, Regulation 4 Health Service Control of Patient Information Regulations 2002 provides that ‘information may be processed in accordance with these Regulations, notwithstanding any common law obligation of confidence’, meaning that identifiable patient data can be shared with other organisations where it is 'necessary' for a COVID-19 purpose.

Northampton General NHS Trust
Cliftonville
Northampton,
NN1 5BD

Data Protection Officer contact details
Sally Shocklidge
ngh-tr.dpo@nhs.net

The purpose of the processing along the data flows is to effectively deliver and document the administration of COVID-19 vaccinations to staff members within health and care organisations.

Under the General Data Protection Regulation (GDPR), the lawful basis for processing this data is found at articles:

 6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,

 6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

 and

 9(2)h processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

In addition, with the COVID-19 vaccination, we have an obligation to let your employer know that you have been vaccinated to support their obligation to safety in the workplace. The lawful basis for this processing is found at articles:

6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,

6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

 and

 9(2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment

9(2)(h)Preventative or Occupational Medicine – assessing the working capacity of our employees

9(2)(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health

View the Coronavirus (COVID-19): notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 ON THE GOV.UK website.

 

The data will be retained in line with the law and national guidance.

Records Management Code of Practice - NHSX

You have the right to complain to the Information Commissioner's Office (ICO). Register a complaint on the Information Commissioner's Office website. 

You can also call the helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate).