Introduction
Health and Community Services has an important and vital obligation to protect the ongoing health of islanders and respond to the regulatory environment due to COVID-19. An element of this response is 'Covid Status Certification', which enables islanders to demonstrate their COVID-19 status, as and when required.
In order to support the COVID Status Certification Programme, there is a requirement to process personal and special category data in order to administer the programme, and provision COVID Status Certificates. There is no obligation for you to provide your data. However we will not be able to provide you with a COVID Status Certificate if you do not.
This Privacy Notice outlines and relates specifically to the processing of your personal information to support the provision of COVID Status Certificates.
Compliance with the Data Protection (Jersey) Law 2018
The COVID Status Certificates Programme is subject to the provisions of the Data Protection (Jersey) Law 2018 (the "Law") and must comply with all of the data protection principles, including having a legal basis for processing your information.
The legal basis under which the COVID Status Certificates Programme is operating is:
La Sante Publique
The conditions which the Law allows for the processing of personal and special category personal are:
Schedule 2, Part 2, Paragraph (16) of the Law, which permits the processing of special category data for public health;
The processing is necessary for reasons of public interest in the area of public health, including (but not limited to) protecting against cross border threats to health and ensuring a high standard of quality and safety of health care or social care where they are provided for by law and the processing is carried out with appropriate safeguards for the rights and freedoms of data subjects.
The COVID Status Certification Programme remain committed to the ongoing protection of your information and compliance with your data subject rights and will act transparently and only collect the minimum amount of information that is needed to respond to COVID-19.
Why we are processing your personal information
We are processing your information so that we can:
- verify your identity
- make available a view of your vaccination record (first dose, second dose, third dose and booster dose)
- provide customer service in the event of an issue with the data or the provision of your status
- enable the delivery of your vaccination record by email in the form of a QR code
- contact you, where necessary
Information we process about you
We are processing the following personal and special category personal information in order to administer the COVID Status Certification Programme:
- identifying information, such as your name, date of birth, SSN / JY number, EMIS number
- contact information, such as your email address
- your vaccination record, including the first dose and second dose, including date of vaccination event, manufacturer and batch details
How we will collect your information
Your information will be processed only on request and only after the verification of your identity using your Digital ID.
We will collect your identifying information and contact information through the online form on gov.je/CovidSafe (the COVID Status Certificate Portal) when you request your vaccination status certificate. This information will be fed into covidsafe.gov.je in order to retrieve your vaccination event record. Your request for a vaccination certificate, will trigger the collection of the relevant vaccine data from your HCS EMIS care record. Once you have confirmed your record, and submitted your request for a certificate, your data will be transferred via an NHSx API to produce your QR code. You will be asked to provide your email address for onward delivery of your vaccination status QR code.
Where your information is kept
Your vaccination event record is retained in the HCS EMIS COVID-19 information system.
The NHSx API does not retain any information relating to your vaccination events, but does retain an anonymised dataset. This is so that your status can be verified by authorities who have adopted the 'EU Gateway' verification platform.
The COVID Status Certificate Portal does not retain the information relating to your vaccination events, but does retain information relating to your request.
All data is hosted in the European Economic Area, in on-island or UK data centres.
Data sharing
Personal and special category data is processed by the Modernisation and Digital Department, Microsoft and the NHSx (UK Department of Health and Social Care) in order facilitate your request and to provide technical support.
Your data will also be processed by Customer and Local Services (CLS) to provide customer support, enable requests for those unable to verify their identity using your Digital ID, or for those unable to access online services. CLS will also liaise with the HCS Vaccination Programme Team in the event of data quality issues.
Your data will not be used for any other purpose and will be destroyed in line with Health and Community Services retention schedules.
Reporting statistics
Information held about you by Health and Community Services, will be processed by the Public Health Data Analysts. Statistical information will be made available to relevant Government Health Officials, Senior Officers and Politicians in order to:
- report on the performance of the programme
- report on the take up of the COVID Status Certificate Programme
- inform future planning and policy development.
Data reported for these purposes will be aggregated and non-identifiable.
Aggregated, non-identifiable statistics will be shared by the Government Communications Team to media outlets, on gov.je and on social media platforms to provide members of the public with insightful information about the COVID Status Certification.
How long we keep information about you
Information you provide on the COVID Status Certificate Portal will be retained for as long as the COVID Status Certification Programme is 'live'.
Information recorded in the HCS EMIS information system will be retained in line with HCS retention schedules, and maintained as part of your medical record.
Telephone calls
Requests for your COVID Status Certification can also be made by telephoning +44 (0) 1534 445566.
Unless we inform you otherwise, telephone calls made by the Government of Jersey are not recorded. If you leave a message on our voicemail systems, your message will be kept until we are able to return your call or make a note of your message. File notes of when and why you called may be taken for record keeping purposes. We will not pass on the content of your telephone calls, unless is it necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.
Emails
If you email us we may keep a record of your email address and a copy of the email for record keeping purposes. We would also suggest that you keep the amount of confidential information you send to us via email to a minimum or use our secure online services where possible or correspond with us by post. We will not share your email address or your email contents unless is it necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.
Your rights
You can ask us to stop processing your information
You have the right to request that we stop processing your personal data in relation to any of our services. Where possible we will seek to comply with your request, but we may be required to continue to process your information for public health or other lawful reasons.
You can withdraw your consent to the processing of your information
Where the collection and processing of your information is carried out on the basis of your consent, you have the right to withdraw your consent to prevent further processing of your personal data.
You can request that the processing of your personal data is restricted
You have the right to request that we restrict the processing of your personal information. You can exercise this right in instances where you believe the information being processed in inaccurate, out of date, or there are no legitimate grounds for the processing. We will always endeavour to consider and comply with your request; however, we may be required to continue to process your information for public health reasons.
You can ask us to correct, amend or erase your information
You have the right to challenge the accuracy of the information we hold about you and request that it is corrected where necessary.
In certain circumstances you can also ask us to erase your information but bear in mind that we may not be able to do this if we have a lawful reason for keeping hold of it.
You can ask us for a copy of the information we hold about you
You are legally entitled to request a list of, or a copy of any information that we hold about you. You can submit a subject access request (SAR) using our online form.
You have the right to complain about the processing of your information
You can do this by contacting the Corporate Data Protection Officer by emailing dpo@gov.je or by contacting Jersey Office of the Information Commissioner on +44 (0) 1534 716350 or by emailing enquiries@jerseyoic.org
gov.je