What assessment has the Minister made of the sharing of data to allow town and community councils to support shielding residents?
The list of people shielding contains personal identifiable information about people who have certain medical conditions, although it does not contain any medical information. As a result, we have treated the data as though it contained information which would be defined as ‘special category’ data under GDPR – the most sensitive information that could cause individuals real harm if it were disclosed incorrectly.
We carefully considered and documented who should have access to the data, and have only shared it where there was a lawful basis to do so under GDPR and UK data protection law, to meet a clear, unambiguous Covid-19 related need, and where no other reasonable alternative to disclosure could be identified.
Local authorities received information only about the people on the list who were resident in their areas. Each local authority is a data controller under GDPR for the data they received in their own right. This means local authorities can determine how they are going to use the data themselves, including whether to share it with other organisations such as community and town councils.
Local authorities would need to undertake their own assessments about whether they have an appropriate lawful basis to disclose and process the data in order to ensure they comply with data protection requirements.