Privacy notice for Adult Social Care

What do we use the information for?

Adult social care collect, process and hold your personal information in order to provide our services effectively. 

• To undertake assessment of needs
  
• For provision of services
  
• To assess the financial eligibility for services
  
• To deliver a range of preventative services, information and signposting
  
• To inform market development
  
• Statistical analysis
  
• Mandatory returns
  
• To ensure we are delivering care to the right people
  
• To ensure service quality. 

The adults performance team accesses and processes personal information that is collected and held by adult services and business management and commissioning services in order to provide performance information to those services and complete mandatory returns to Government agencies. 

We also use information to improve our services so that they are more appropriate to people’s requirements. We recognise that your personal information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously.

What information do we hold and use?

Adults social care collects and processes the following information:

• Personal information (including full name, full residential address and date of birth)
  
• Characteristics (such as ethnicity, language, religion)
  
• Personal circumstances, to enable assessment of eligibility for services
  
• Care needs
  
• Hazards/risk information about and individual or their household
  
• Financial information
• Unique reference numbers (such as NHS number).. 

The adults performance team does not collect or hold your personal information however, it does access: 

• Personal information (including full name, full residential address)
• Contact details (such as email address)
• Identifiable information (including NI number and NHS number)
• Characteristics (such as ethnicity, sex, religion) 
• Social care needs and some health related information 
• Financial information.

On what grounds do we use the information?

Adults social care collect and lawfully process your personal information under the following: 

• Care Act 2014
• Mental Health Act 1983
• Mental Capacity Act 2015.

We process personal data for the following reasons:

• GDPR Article 6(1)(a) – the data subject has given consent to the processing of personal data for one or more specific purposes
• GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the East Riding of Yorkshire Council is subject
• GDPR Article 6(1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person
• GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• GDPR Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

We process special category data for the following reasons:

• GDPR Article 9(2)(a) - the data subject  has given explicit consent to the processing of those personal data for one or more specified purposes
• GDPR Article 9(2)(c) - processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent
• GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject 
  
• GDPR Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
• DPA 2018 Schedule 1 Part 1 (2) - health or social care purposes.

Please note that the adults performance team does not collect or hold personal information in their own right, however it does access and process personal information that is collected and held by adult services and business management and commissioning services.  The legal basis for processing will be whatever the legal basis is for the service holding the information.  

How do we collect this information?

Adult social care may collect information in the following ways:

• Telephone
• Paper, electronic or online forms
• Email
• Face-to-face, with one of our employees, or one of our partners
• From third-party sources who have a duty to share information to enable us to meet statutory obligations. 

The adults performance team does not collect your personal information however, the team accesses personal information that has been collected by other council services. 

Who do we share your information with?

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation. Adults social care may share it with other public service bodies including private and independent providers, charities, community groups, the police, health care agencies, Local Government Ombudsman and other local authorities. The adults performance team may also share it with other public service bodies including NHS Digital and Skills for Care.

NHS Digital (external website)

Skills for Care (external website)

The reasons why we may share your data with other public bodies are as follows:

• To protect vulnerable adults who may be at risk of harm or abuse
• To improve our understanding of your needs to enable us to inform you of other relevant safeguarding services
• To support our duties under the Care Act 2014 to improve health and wellbeing
• Under specific information sharing agreements which specify the type and purpose of the information sharing
  
• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• To provide health and social care professionals, directly involved in your care, access to up-to-date information about you
• Where necessary to protect individuals from the risk of harm or injury 
• Where otherwise permitted under the General Data Protection legislation.

We will only disclose your sensitive or confidential information, such as medical details to a third party, if we are legally required to do so, or where we have good reason to believe that failing to share the information would put you or someone else at risk of harm.

We will not pass your personal information to external organisations for marketing or sales purposes or for any commercial use without your prior expressed consent.

How long do we store it and is it secure?

The council has retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law.  Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your care. 

For information on how long your information will be held visit the retention page.

What rights do you have?

The rights that you have depend upon the grounds upon which we collected your information. All of the rights you could have are outlined on the data protection rights page. 

In most cases, people who have been involved with adult social care services and the adults performance team will have the following rights:

• The right of access - you are entitled to see the information the service holds about you
• The right to rectification - we will amend information accordingly, if any information that the service holds about you is incorrect 
• The right to restrict processing - you may wish to limit how we use your data 
• The right to object - in addition to the right to limit the use of your data, you also have a right to object to the use of your data for certain actions 
• The right to erasure/right to be forgotten - in certain circumstances, you may be able to ask for some of the information we hold to be deleted. The services have determined that all requests to permanently delete a service user record will be dealt with on an individual basis.

To exercise any of your above rights, please visit the data protection rights page for more information.

Where can I find out more?

If you want to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external website)

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect changes in our services, feedback from customers, and to comply with any changes in the law. This privacy notice was last updated on 1 June 2021.