Privacy notice: Public Health and NHS England

Who we are

Public Health Team
Royal Borough of Windsor and Maidenhead (RBWM) Council
Town Hall
St Ives Road
Maidenhead SL6 1RF

Email: public.health@rbwm.gov.uk 

Lawful basis for processing the information

General Data Protection Regulation Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

Public Health Act 1961
Local Government Act 1972
Local Authority Social Services Act 1970
National Health Service and Community Care Act 1990
NHS Act 2006
Safeguarding Vulnerable Groups Act 2006
Health and Social Care Act 2012

Local Authorities Regulations 2013

Health Service (Control of Patient Information) Regulations 2002 and the Care Act 2014

Our additional legal basis for using your special category information is: 

h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

j)processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

How we collect your personal information

Your personal information is collected from the NHS England Portal which is a controlled, secure system, hosted and audited by NHS England.

What personal information is collected

The type of personal information is necessary for public health analysis and may include the following: 

  • Age
  • Sex
  • Ethnic group
  • Indices of Deprivation i.e., income, employment, education, skills and training, health and disability, Crime, Barriers to Housing and Services, Living Environment.
  • Diagnosis
  • Admission and appointment information.

This information may be processed from the following data sets:

  • Emergency Care (ECDS) 
  • Hospital Episode Statistics (HES) datasets
  • Accident and Emergency (A&E)
  • Admitted Patient Care (APC)
  • Critical Care
  • Outpatient data

How we use the personal information provided

Your personal information may be processed to fulfil statutory public health functions within RBWM Council, for the following purposes; improving public health, supporting health and wellbeing Boards, producing joint strategic needs assessments, joint health and wellbeing strategies, commissioning public health services, providing public health advice, publishing annual (anonymised) public health reports and providing a public health response to licensing applications. 

Who has access to your personal information

RBWM Council internal departments where there is a legal basis to do so, including the Public Health team. 

Who we may share your personal information with

We may share the following personal information with other organisations including:

Record-level data will not be shared with any third parties.

How long we store your personal information

Personal information may be stored for up to ten years of data from the date received.

Record level data is securely destroyed within six weeks of receipt. 

Aggregated data with small numbers suppressed is destroyed after two years.

Does your service utilise automated decision making? – No.