Public Health Covid-19 privacy notice

Liverpool City Council is managing and mitigating the spread and impact of Covid-19. This privacy notice is to make it easier for you to understand and provide you with more information about how Liverpool City Council may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the coronavirus pandemic.

At this time, we may seek to collect and process your personal data in response to the recent outbreak of coronavirus, which is above and beyond what would ordinarily be collected in order to ensure your safety and well-being. This includes the processing of personal data for Covid-19 purposes as per the notice issued by the Secretary of State.

It will enable us to effectively fulfil our functions to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.

There are several key groups or purposes we will gather data and information for.

Covid-19 High Risk Groups

Read the separate privacy notice for high risk groups

Covid-19 testing

Liverpool City Council leads on community Covid-19 Testing programmes.  We do not use any identifiable information in the operational delivery of this service, but we will send an automated text message using the Notify system to those of our residents who have a positive result offering support with self-isolation. 

Covid-19 vaccination programme

The NHS leads on the national Covid-19 vaccination programme with support from Public Health at Liverpool City Council. We will use identifiable information to produce amalgamated data which will be used to help attain the maximum vaccination coverage possible in the city and provide support services for those of our residents who need help in getting the vaccine.

Test and Trace

Liverpool City Council is working with Public Health England to provide the local contact tracing service in response to the pandemic. Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected with Covid-19.

Liverpool City Council will receive personal information from Public Health England and NHS Test and Trace for the following reasons:

  • enable contact tracers to call people who have tested positive with Covid-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
  • enable contact tracers to manage the process of tracing these contacts to find out if they have any Covid-19 symptoms and if so, to provide advice on how to seek help
  • enable Test and Trace Community Support Officers to provide door faced support for self-isolation
  • enable the necessary sharing of personal information to third party organisations using minimum data
  • enable the planning, management and containment of local outbreaks

Joint Working with the NHS Clinical Commissioning Group

Liverpool City Council and NHS partners will work closely to combat the spread of Covid-19, achieve the maximum possible vaccination uptake, and where necessary provide essential support to residents who need it. This requires sharing data only where it is deemed necessary. The Secretary of State has issued 4 notices under the Health Service Control of Patient Information Regulations 2002 which allows the sharing of patient level information from the NHS to local authorities to help combat the COVID-19 pandemic. These notices expire on 30 September 2021 and any NHS data will then be deleted.  Health data will only be used by Liverpool City Council in accordance with articles 6 and 9 under UK GDPR Regulations.

NHS data has been used by Liverpool City Council to:

  • Build a Crisis Management System only to be used in the event of a requirement to provide direct support (food, medicine, care) to residents in need.
  • Support Test and Trace in providing valid contact details such as phone number and address to facilitate self-isolation support.
  • Support our Extremely Vulnerable Persons’ cohort during periods of shielding.

What personal data is being collected or legitimately shared?

Only where deemed absolutely necessary in providing a response to the Covid-19 pandemic the following data items can be collected:

  • full name
  • date of birth
  • gender
  • ethnicity
  • NHS number
  • home postcode and house number
  • telephone number and email address
  • occupation and key worker type
  • Covid-19 symptoms, including when they started and their nature
  • vulnerability group
  • shielded status

Who is processing your data?

All personal data held, is processed in accordance with the Data Protection Act 2018 and General Data Protection Regulation

What is your lawful basis for processing your personal data?

The legal basis for processing the data is that it is in the public interest for us to deal with the outbreak of Covid-19.

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:

  • Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
  • Recital 46 adds that 'some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread'.
  • Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law.
  • The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:
  • Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
  • Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.
  • Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England

Who we will share your information with?

We will normally only share your information with other partner organisations as part of the response to the Covid-19 outbreak.

We will not share your information with anyone else unless required to do so under additional legal requirements, for example to assist the government in containing the spread of Covid-19. This may be where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

How long will my personal data be retained by the council?

The council will only keep your information for as long as it necessary, taking into account of Government advice and the on-going risk presented by coronavirus.  At a minimum the information outlined in this privacy notice will be kept for the duration of the Covid-19 response.

Information provided in relation to this outbreak of coronavirus will not be used for any other purpose, including to be held within personnel files ‘just in case’ it may be needed again.

When the information is no longer needed for this purpose, it will be securely deleted.

Your rights

If you are not happy about the way your personal data is being processed you can complain directly to the Council’s Data Protection Officer.

You also have the right to complain to the Information Commissioner’s Office.

  • Website:
  • By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • By email to -
  • Telephone: 0303-123-113

If you require further information about how we process your personal data, you can email the Data Protection Officer at