ITEM 14 Privacy Notice
North Lanarkshire Council · 27 September 2023
Back to Health and Social Care Integration Joint Board — 27 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 REPORT Item No: 14 SUBJECT: Privacy Notice TO: Integration Joint Board Lead Officer for Report: Ross McGuffie, Chief Officer North HSCP Author(s) of Report Stacey Anderson, Support Services, Project Manager DATE: 27 September 2023 1. PURPOSE OF REPORT This paper is coming to the IJB for: For approval ☒ For endorsement ☐ To note ☐ 2. ROUTE TO THE BOARD This paper has been: Prepared By: Stacey Anderson ☒ Reviewed By: Paul Corrigan, Solicitor ☒ Endorsed By: ☐
Page 2
2 3. RECOMMENDATIONS Approve IJB Privacy Notice IJB Privacy Notice to be added to the NL H&SCP Website 4. VARIATIONS TO DIRECTIONS? 5. BACKGROUND/SUMMARY OF KEY ISSUES NL IJB are committed to protecting the privacy and confidentiality of any personal information that we hold. This privacy notice will tell you how we look after your personal information and tell you about your rights. In line with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 a privacy notice for the IJB has been developed to ensure that personal information is kept secure (Appendix 1). This notice is for all members of the community who may receive services from NL HSCP or give support to other persons who receive those services. It covers those who participate in research, consultations, surveys or community events relating to the work of NL IJB and its development of strategic plans. It is also for any person who makes representations directly to NL IJB, whether in the form of general enquires, complaints or formal information requests. It is, finally, for voting and non-voting members of the Integration Joint Board itself, whose own details may be held either by NL IJB or on behalf of NL IJB. 6. CONCLUSIONS As handling personal data is generally unnecessary in order to devise strategies and monitor of services, NL IJB does not process a large amount of personal data and does not generally process sensitive personal information about users of community health and social care services, or any individuals other than its own Board members. NL IJB will tend to rely upon anonymised, aggregated or statistical data provided by the partner agencies (North Lanarkshire Council and NHS Lanarkshire). One or both of these statutory bodies would generally hold the individual personal data about service users from which the general data reported to NL IJB is derived. However the privacy notice provides assurance to the Board and the public that any data collected by the IJB follows legal guidelines. Yes ☐ No ☒ N/A ☐
Page 3
3 7. IMPLICATIONS 7.1 NATIONAL OUTCOMES Link(s) to National Health and Wellbeing Outcomes People are able to look after and improve their own health and wellbeing and live in good health for longer ☐ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonable practicable, independently and at home or in a homely setting in their community ☐ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected ☒ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services ☐ Health and Social Care Services contribute to reducing health inequalities ☐ People who use Health and Social Care Services are safe from harm ☐ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide ☐ Resources are used effectively and efficiently in the provision of Health and Social Care Services ☒ 7.2 ASSOCIATED MEASURE(S) 7.3 FINANCIAL This paper has been reviewed by Finance: 7.4 RISK ASSESSMENT/RISK MANAGEMENT Relevant Risk Register Details Current Risk Level Risk Owner Choose an item. Yes ☐ No ☐ N/A ☒
Page 4
4 7.5 ENGAGEMENT & PARTICPATION Please tick the engagement and participation objectives that link(s) with this piece of work and provide further details regarding the engagement and participation that was undertaken. Objectives Further Details ☐ Involve stakeholders in the development work aimed at achieving the national outcomes ☒ Provide stakeholders with information on how to get involved ☐ Ensure a diverse range of engagement and participation and opportunities are in place to suit different needs ☐ Measure how well we involve community stakeholders in the planning, design and delivery of our services ☐ Provide regular feedback on how stakeholder engagement and participation is shaping and influencing service development and delivery ☐ Provide support to enable stakeholder representatives to participate meaningfully and confidently at meetings ☐ Develop participation guidelines to ensure a common understanding and set of expectations for both stakeholders and partnership staff ☐ Support engagement planning and participation in localities, taking account of other engagement activity and local plans across the Community Planning Partnership 7.6 INEQUALITIES & FAIRER SCOTLAND DUTY EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: EQIA added to website: Yes ☐ No ☐ N/A ☒
Page 5
5 8. BACKGROUND PAPERS None. 9. APPENDICES Appendix 1 – Privacy Notice CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following; Stacey Anderson Stacey.Anderson3@lanarkshire.scot.nhs.uk Yes / Date added ☐ No ☐ N/A ☒
Page 6
6 Direction from North Lanarkshire Integration Joint Board (IJB) 1 Reference Number 2 Report Title 3 Date direction issued by IJB 4 Date from which direction takes effect 5 Direction to: 6 Does this direction supersede, revise or revoke a previous direction – if yes, include reference number(s) 7 Functions covered by direction 8 Full text of direction 9 Budget allocated by Integration Joint Board to carry out direction 10 Performance Management / Governance arrangements 11 Date direction will be reviewed
Page 7
7 Appendix 1 Privacy Notice 1. North Lanarkshire Integrated Joint Board In North Lanarkshire, NHS Lanarkshire and North Lanarkshire Council have integrated the planning and delivery of all community health and social care services. This work is led and directed by the North Lanarkshire Integration Joint Board (NL IJB), with the council and health board working together to deliver those health and social car services through its Health and Social Care Partnership, Health & Social Care North Lanarkshire. The main functions of the NL IJB is to strategically plan and commission the services delegated to it by the two partner bodies. NL IJB is a statutory body established under the Public Bodies (Joint Working) (Scotland) Act 2014. The NL IJB is based at NHS Lanarkshire Head Quarters, Kirklands, Fallside Road, Bothwell, G71 8BB. North Lanarkshire Council is the data controller and responsible for your personal information. North Lanarkshire Council head office is at Civic Centre, Windmillhill Street, Motherwell, ML1 1AB. 2. Commitment to Privacy NL IJB are committed to protecting the privacy and confidentiality of any personal information that we hold. This privacy notice will tell you how we look after your personal information and tell you about your rights. NL IJB will ensure that your personal information is kept secure, in line with the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018. We will only collect the minimum information necessary to fulfil a particular purpose; when we don't have a need to keep information about you, it will be disposed of in a secure manner. 2.1 Information Commissioner’s Office
Page 8
8 You have the right to make a complaint at any time to the Information Commissioner’s Office, the UK data protection regulator who can be contacted via the contact details below, however, we would welcome the opportunity to discuss your concerns with you before you do so: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Phone: 0303 123 1113 (local rate) or 01625 545 745 or visit their: website 3. Data Protection Officer The appointed data protection officer (DPO) within North Lanarkshire Council has also been appointed as the data officer for NL IJB and is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, you can contact the DPO via the contact details below: Data Protection Officer Email: DataProtection@northlan.gov.uk North Lanarkshire Council Telephone: 01698 302554 Civic Centre Windmillhill Street Motherwell ML1 1AB 4. The Personal Information We Hold About You and What We Do with It. This notice is for all members of the community who engage with the IJB, covering those who participate in research, consultations, surveys or community events relating to the work of NL IJB and its development of strategic plans. It is also for any person who make representations directly to NL IJB, whether in the form of general enquires, complaints or formal information requests. It is finally for voting and non- voting members of the Integration Joint Board itself, whose own details may be held either by NL IJB or on behalf of NL IJB.
Page 9
9 As handling personal data is generally unnecessary in order to devise strategies and monitor of services, NL IJB does not process a large amount of personal data and does not generally process sensitive personal information about users of community health and social care services, or any individuals other than its own Board members. NL IJB will tend to rely upon anonymised, aggregated or statistical data provided by the partner agencies (North Lanarkshire Council and NHS Lanarkshire). One or both of these statutory bodies would generally hold the individual personal data about service users from which the general data reported to NL IJB is derived. On any occasion when NL IJB does process limited personal information relating to a limited number of individuals to conduct NL IJB business (e.g. responding to representations made directly to NL IJB by members of the community, consulting or liaising with partner organisations and individuals to plan and deliver services). NL IJB will use information relating to NL IJB board members and partner organisations and individuals with whom we work with in order to ensure the effective administration of the business of the IJB. NL IJB will also use information to verify the identity of enquires where requires, contact relevant individuals by post, email or telephone, maintain our records and to demonstrate to internal auditors and external regulators that NL IJB are providing proper services in accordance with the law. Your personal information may also be used: • for the prevention and detection of crime • for the apprehension or prosecution of offenders • for the assessment or collection of taxes or duties • to prevent or detect unlawful acts • to protect the public against dishonesty, malpractice or other seriously improper conduct • to prevent fraud (including data matching under local and national fraud initiatives and the Housing Benefit Matching Service). 5. Legal Basis for Using Your Information
Page 10
10 NL IJB will use the information referred to above to deliver the functions described in the North Lanarkshire Integration Scheme which has been developed as directed by The Public Bodies (Joint Working) (Scotland) Act in 2014. There are additionally specific statutory requirements in relation to responding to complaints, Freedom of Information requests and Subject Access Requests. The policies on these matters and their legal basis are set out on the website of NL HSCP: Health and Social Care North Lanarkshire (hscnl.org.uk). When personal information is processed, it is because this is necessary for the performance of tasks carried out in the public interest by NL IJB, as set out in the policies and legislations referred to above. In the case of specific enquires requiring responses, if you do not provide the NL IJB with particular information that they have asked for then the NL IJB may not be able to provide these services to you. NL IJB will only process more sensitive personal information about you were absolutely necessary for the purpose of the effective planning and oversight of social care services and the management of health and social care systems as set out in the Data Protection Act 2018. As above, this will seldom be necessary, as personal information will mainly be held by the partner agencies (North Lanarkshire Council or NHS Lanarkshire). NL IJB will not usually ask for sensitive personal data about any identifiable individuals to be submitted directly to them. 6. Keeping Your Information up to Date It is important that the personal information NL IJB hold about you is accurate and current. Please keep NL IJB informed if your personal information changes during your relationship with us. NL IJB don't rent or trade email lists with other organisations and businesses. 7. Purposes for Which NL IJB Will Use Your Personal Data NL IJB will only use your personal information when it is lawful to do so. NL IJB will use your personal information to comply with our legal responsibilities and [insert particular activity to which the privacy notice relates]. 7.1 Change of Purpose
Page 11
11 NL IJB will only use your personal information for the purposes for which we collected it, unless NL IJB reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If NL IJB need to use your personal information for an unrelated purpose, NL IJB will notify you and will explain the legal basis which allows them to do so. Please note that NL IJB may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 8. Sharing your Personal Information As per the guidance for public bodies in Scotland, NL IJB will generally comply with requests for specific information from regulatory and law enforcement bodies where this is necessary and appropriate. However, the main agencies with whom NL IJB will share information are the partner agencies (North Lanarkshire Council and NHS Lanarkshire). This information sharing is covered by a data sharing agreement created by the Lanarkshire Data Sharing Partnership which is publically available: Lanarkshire Data Sharing Partnership North Lanarkshire Council currently holds and processes records on behalf of NL IJB, as set out in the NL IJB Records Management Plan, under the terms of the memorandum of understanding. This means that if enquires or information requests submitted to NL IJB, or work with NL IJB in respect of consultations and development of strategic plans, then contact details of the enquirer and any other relevant information will be held on the North Lanarkshire Council information system on behalf on NL IJB. This Records Management Plan has been approved in terms of the Public Records (Scotland) Act 2011. This data sharing will be done in accordance with the terms of this privacy statement and the specific terms set out in the Data Sharing Agreement and Records Management Plan referred to above. 9. How Long Will We Hold Your Information? NL IJB will only retain your personal information for as long as necessary to fulfil the purposes of which they collected the information for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, NL IJB consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which NL IJB process your personal information and whether those purposes can be achieved through other means, and the applicable legal requirements.
Page 12
12 Because of the special arrangements for records management between NL IJB and North Lanarkshire Council, the records retention and disposal schedule for NL IJB records is part of the retention schedule of North Lanarkshire Council. Details of retention schedules [665kb] for different aspects of your personal information are available to download. In some circumstances NL IJB may anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you. 10. Your Legal Rights Under certain circumstances, you have rights under data protection laws in relation to your personal information. You have the right to: • Request access to your personal information (known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. • Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Page 13
13 • Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. • Not be subject to a decision based on solely automated processing if that produces a legal effect concerning you or similarly significantly affects you. Note that this right does not apply if the decision is (i) necessary for entering into, or performance of, a contract between us and you; (ii) authorised by law; or (ii) based on your explicit consent • Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent. If you wish to exercise any of the rights set out above, please contact NL IJB or the DPO. 11.No Fee Usually Required You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, NL IJB may refuse to comply with your request in these circumstances. 12. What May Be Needed from You NL IJB may need to request specific information from you to help confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. NL IJB may also contact you to ask you for further information in relation to your request to speed up our response. 13. Time Limit to Respond NL IJB try to respond to all legitimate requests within one month. Occasionally it may take longer than a month if your request is particularly complex or you have made a number of requests. In this case, you will be notified and kept updated.