Personal data is used by Worcestershire County Council’s Public Health Team in supporting the discharge of Worcestershire County Council’s statutory duty under the Health and Social Care Act 2012 to improve population health and well-being and have regard to narrowing health inequalities. The Public Health Team also delivers two other statutory duties:

• Community Safety duties detailed in Section 17 of the Crime and Disorder Act 1998 which place an obligation on local authorities to consider and do all that can be reasonably done to prevent: crime and disorder in their area; the misuse of drugs, alcohol and other substances; and re-offending.
• Civil Contingencies duties detailed in the Civil Contingences Act 2004 including ensuring: Emergency Prevention, Preparedness and Response (EPPR) is in place; business continuity mechanisms including advice and assistance to local businesses and voluntary organisations; safety at sports grounds; Control of Major Accident Hazards (COMAH) and mass fatalities planning.

All information accessed, processed and stored by Public Health Team staff will be used to measure the health, mortality or care needs of the population; for planning, evaluating and monitoring health; protecting and improving public health. Personal data processing supports the following mandatory programmes:

• NHS Health Checks
• Comprehensive Sexual Health Services
• The National Child Measurement Programme
• Public Health Advice to the NHS
• Assurance that appropriate steps are being taken to protect the health of local residents
• Oral Health Promotion

Other legal requirements of the local authority that the work of the Public Health Team supports are:

• Joint Strategic Needs Assessment
• Director of Public Health Annual Report
• Pharmaceutical Needs Assessment
• Health and Well-being Board Strategy
• From harm to hope: A 10-year drugs plan to cut crime and save lives
• Due regard to drugs and alcohol services

We are committed to using pseudonymised or anonymised information as much as is practical, and in many cases this will be the default position. Pseudonymisation is a procedure by which the most identifiable fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. There can be a single pseudonym for a collection of replaced fields or a pseudonym per replaced field. The purpose is to render the data record less identifiable and therefore lower customer or patient objections to its use.

Anonymisation is the process of removing identifying particulars or details from (something, especially medical test results) for statistical or other purposes.

Where publication is desirable or necessary all data will be anonymised.

Personal information collected may include:

• personal details e.g., name / age / address / school / and family details
• contact information e.g., telephone numbers / email address
• personal reference numbers e.g., NHS Number / National Insurance
• employment details
• financial details
• lifestyle and social circumstances
• student and pupil records
• visual images, personal appearance and behavior
• IP addresses for online surveys
• community safety/Criminal Justice involvement
• housing information, accommodation type, tenancy information
• safeguarding information
• PREVENT programme and Channel Panel information

We may also process some special category (sensitive) information for specific health and well-being services:

• physical or mental health details
• racial or ethnic origin
• pregnancy
• sex life/sexual orientation

The Public Health Team may have access to the following data:

• Civil Registration Data – Includes record level mortality data (formerly known as the Primary Care Mortality Database) as provided at the time of registration of the death along with additional GP details, geographical indexing and coroner details where applicable. Also included in Civil Registration Data are Births and Vital Statistics Tables – Births files include date of birth, sex, birth weight, address, postcode, place of birth, stillbirth indicators and age of mother. Deaths data includes: deaths broken down by age, sex, area and cause of death sourced from the deaths register. •
• Hospital Episode Data (HES) – Supplied by NHS Digital and contains pseudonymised details of admissions, outpatient appointments and A&E attendances at NHS hospitals in England. This data is collected during a patient’s time at hospital and is submitted to allow hospitals to be paid for the care they deliver. HES data is designed to enable secondary use, that is use for non-clinical purposes
• National Child Measurement Programme (NCMP) – was set up in line with government strategy to annually measure the height and weight of children in reception class (aged 4 to 5) and year 6 (aged 10 to 11), to assess overweight and obesity levels in children within primary schools. NCMP data can be used to support public health initiatives and inform the planning and delivery of services for children. Individual children’s results are not shared with school staff or other pupils, and suppression and disclosure controls are implemented to ensure that individual children cannot be identified.
• Child Health Information System – includes pseudonymised records of “In and Out” movements, Ages and Stages Questionnaires (ASQ), breastfeeding and immunisation records.
• HAPI data – The School Health & Wellbeing Service undertakes health needs assessments of children and young people at various ages across the school-age population. Anonymous information is used in order to inform the planning and delivery of services.
• NHS Health Check is made up of three key components: risk assessment, risk awareness and risk management. During the risk assessment standardised tests are used to measure key risk factors and establish the individual’s risk of developing cardiovascular disease including: Smoking status; Family history of coronary heart disease; Body Mass Index (BMI); Cholesterol level; Blood Pressure including a pulse rhythm check; Diabetes risk assessment; HbA1c or fasting glucose (for those at risk following diabetes filter); Physical activity using GPPAQ; Alcohol use using AUDIT score; Dementia awareness and signposting (for 65-74 years old).
• community safety/criminal justice data relating to safeguarding, serious case reviews/domestic homicide reviews, offender management, serious organised crime, and Channel Panel (PREVENT) referrals

The legal bases for processing this personal information are:

• data subject’s consent (UK GDPR Article 6(1)(a)*
• legal obligation (UK GDPR Article 6(1)(c)
• public task – processing is necessary of performance of a task in the public interest or to exercise our official authority (UK GDPR Article 6(1)(e)

The special category condition for processing is:

• data subject’s explicit consent (UK GDPR Article 9(2)(a)*
• necessary for the provision of health and social care treatment, or the management of health and social care systems and services or necessary for reasons of public health in the case of service user health related data (UK GDPR Article 9(2)(h) and Data Protection Act 2018 Schedule 1, part 1, paragraph 3 - Public Health

*Some services may use videos/photographs with the explicit consent of the subject for analysis of the service.



In all cases the Public Health Team will comply with data protection principals which include minimising the data collected to that which is necessary in relation to the purpose for which it is processed.

Occasionally, we may need to share the personal information you have given to us or we’ve collected about you with partner organisations. These include but are not limited to:

• Police and National Probation Service and Community Rehabilitation Companies, Youth Justice Service
• Health Services – Worcestershire Health and Care NHS Trust, GPs, Dental Practices, Opticians, Ambulance Services, Hospitals, Clinical Commissioning Groups (CCGs)
• Regulatory inspection regimes – Care Quality Commission, Ofsted
• NHS Digital
• schools/colleges
• housing agencies and providers
• Worcestershire District Councils and other Local Authorities
• care home and other social care providers
• representatives who will act on your behalf should you lack the capacity to make decisions regarding your care. Including but not limited to:
  • Independent Mental Capacity Advocate (IMCA)
  • those with Power of Attorney
  • Court Appointed Deputy
  • nominated personal representative
  • Court of Protection
• Adult Safeguarding Board
• Children's Safeguarding Board
• appropriate adult/children’s social care team(s)
• other Worcestershire County Council services as appropriate including Legal Services Local Government & Social Care Ombudsman
• authorised commissioned and contracted services

Information will only ever be shared when it is strictly necessary to help us provide effective services and you may have the right to refuse. We will not pass it onto any other parties unless required to do so by law or in all reasonable circumstances the disclosure is fair and warranted for the purposes of processing or subject to a data protection exemption.

We have specific data sharing agreements in place with local agencies and sometimes the law requires that we may have to pass your details on to a third party, for example, to prevent crime.

The standard record retention for Public Health records is the current year plus 6 further years. However, providers of services have a range of other retention periods affecting different types of information and service needs and these range from 1 year to 6 years depending on the type of information and service. More information about our retention periods can be found in our summary Disposal Schedule.

Please note stated retention periods may be subject to any legal holds imposed under the Inquiries Act 2005 that may concern the information and override standard retention periods

You are entitled to a copy, or a description, of the personal data we hold that relates to you, subject to lawful restrictions. Please go to our Make a Data Protection Request page to find out how to make a request.

You may be entitled to rectification, restriction, objection, and erasure of your personal information depending on the service and legal basis. Please in the first instance contact the Property Services Terrier and Data Administrator to exercise these Information Rights or call the main Worcestershire County Council contact telephone number of 01905 765765.

Please see our overarching Privacy Notice for further contact details and if you have a complaint about your information rights.