Introduction
Health and Community Services has an important and vital obligation to protect the ongoing health of islanders and undertake measures to slow the spread of COVID-19. An element of this response is the COVID Vaccination Programme, which aims to vaccinate the population and safeguard islanders from the risk of infection.
In order to support the COVID Vaccination Programme, there is a requirement to process personal and special category data in order to administer the programme, maintain an accurate and complete immunisation record and provision Covid Status Certification demonstrating your vaccination status.
This Privacy Notice outlines and relates specifically to the processing of your personal information to support the COVID-19 Vaccination Programme.
COVID Status Certification privacy policy
Compliance with the Data Protection (Jersey) Law 2018
The COVID-19 Vaccination Programme is subject to the provisions of the Data Protection (Jersey) Law 2018 (the "Law") and must comply with all of the data protection principles, including having a legal basis for processing your information.
The legal basis under which the COVID-19 Vaccination Programme is operating is:
La Sante Publique
The conditions which the
La Sante Publique Law allows for the processing of personal and special category personal are:
For the data collected from care homes and healthcare organisations, and for the data collected from Primary Care, relating to the eligibility criteria in order to prioritise patients at high risk of COVID:
Schedule 2, Part 2, Paragraph (16) of the Law, which permits the processing of special category data for public health;
- The processing is necessary for reasons of public interest in the area of public health, including (but not limited to) protecting against cross border threats to health and ensuring a high standard of quality and safety of health care or social care where they are provided for by law and the processing is carried out with appropriate safeguards for the rights and freedoms of data subjects.
For the Vaccination Administration and for Access to the Jersey Summary Care Record:
Schedule 2, Part 2, Paragraph (15) of the Law, which permits the processing of special category data for medical purposes;
(1) The processing is necessary for medical purposes and is undertaken by –
(a) a health professional; or
(b) a person who in the circumstances owes a duty of confidentiality equivalent to that which would arise if that person were a health professional.
(2) In paragraph (1) "medical purposes" includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment, the management of healthcare services, occupational medicine and the assessment of the working capacity of the employee
The COVID Vaccination Programme remain committed to the ongoing protection of your information and compliance with your data subject rights and will act transparently and only collect the minimum amount of information that is needed to respond to COVID-19.
Why we are processing your personal information
We are processing your information so that we can:
- arrange appointments for vaccinations and administer the programme
- ensure that the COVID Vaccination programme is administered in accordance with the eligibility criteria and that patients are vaccinated as a priority based on the risk of COVID
- invite you to book your appointment and contact you, where necessary
- ensure that there are no contraindications in relation to you receiving the vaccination
- record your vaccination for both dose 1 and dose 2 as well as any 3rd Primary dose or Booster vaccination and make available to your GP
- enable the provision of a single dose certificate
- enable the provision of the multi-jurisdictional certificate
- facilitate the COVID Status Certification Programme so that you can demonstrate your status here and abroad
- contact you, where necessary
Information we process about you
We are processing the following personal and special category personal information in order to administer the COVID Vaccination Programme:
- your contact information, including your full name, mobile telephone number, email address and current residential address
- your demographic information such as your date of birth and gender
- unique identifiers, such as your Social Security number (JY number) and your unique GP identifier
- your primary care record relating to any allergies that may indicate that you may be at risk from the COVID vaccination
- your employer, and job role, as well as if you are a frontline employee, if you are eligible for the COVID vaccination as a health and care employee
- your qualifying tier, if you are clinically coded as high-risk of COVID-19
- information about your health such as your symptoms and underlying health conditions (special category health data)
- your vaccination appointment details
- your consent for the vaccination
- details relating to the vaccination, such as injection site, whether you declined the vaccination and whether you were contraindicated and unable to receive the vaccine
How we will collect your information
Employers across the island's healthcare organisations have been asked to provide details relating to their staff so that the programme can manage appointments, and prepare consent forms, clinic lists and manage the recording of the vaccination into the primary care record.
Primary Care have been asked to supply data relating to those that have been clinically coded as high risk of COVID-19 in order that those individuals can be prioritised and invited to book their appointments.
Those aged 12 to 15 and who are immune-suppressed will be asked to supply information relating to their categorisation directly with the COVID Vaccination Centre Team so that they may be appropriately categorised. No information on why an individual may be categorised as a priority will be shared or recorded within the BATs system. If you do not wish to provide details to the Vaccination Team member to verify your eligibility as a priority, you can request a consultation with a GP, and no information will be recorded.
The BATs booking system will capture data that identifies those individuals that use the portal to book their appointments at the COVID Vaccination Centre.
We will collect information for you in person when providing the vaccination including consent and any contraindications.
Your Primary Care record will be accessed via the Jersey Summary Care Record by Supervising GPs at the point of the vaccination. This is to ensure that you are not at risk of a significant allergic reaction should you have the vaccination.
For those that are deemed 'fully vaccinated' or have met the criteria for a single-dose or multi-jurisdictional certificate, your data will be collated into a data repository to enable its transfer to Mail Mate so that your paper certificate can be produced.
Where your information is kept
Your information, once collected, is retained in the HCS EMIS COVID-19 information system, by your Primary Care provider, and within the BATs booking system.
Data that has been provided by Healthcare organisations, or Primary Care, relating to those patients that are high-risk of COVID-19 will be held in secure Government of Jersey drives, on password protected databases until actioned into EMIS clinics and/or the invitations have been sent out to offer the opportunity to book an appointment, at which point, they will be deleted.
Your data held within the Jersey Summary Care Record is held in Primary Care's EMIS system, and accessible only to Supervising GPs and HCS frontline clinicians.
Your data is held by Mail Mate only for the purpose of producing the certificate and destroyed as soon as the certificate is produced.
All data is hosted in the European Economic Area, in on-island or UK data centres.
Data sharing
Personal and special category data is shared with Jersey's General Practitioners (GPs) to provide them with direct access to your immunisation record.
Personal and special category data is shared with Mail Mate in order that they can facilitate production of the paper certificate.
Aggregated statistical information is shared with Government Senior Officers, health officials and politicians and published on www.gov.je
Your data will not be used for any other purpose and will be destroyed in line with Government of Jersey retention schedules.
Reporting statistics
Information held about you by Health and Community Services will be processed by the Public Health Data Analysts. Statistical information will be made available to relevant Government Health Officials, Senior Officers and Politicians in order to:
Data reported for these purposes will be aggregated and non-identifiable.
Aggregated, non-identifiable statistics will be shared by the Government Communications Team to media outlets, on gov.je and on social media platforms to provide members of the public with insightful information about the Vaccination Programme.
No data held within or accessed through the Jersey Summary Care Record will used for the purpose of statistical analysis or for performance reporting.
How long we keep information about you
Information you provide on the BATs booking system will be retained for as long as the COVID Vaccination Programme is 'live'.
Information recorded in the EMIS Primary Care Record and the Jersey Summary Care Record will be retained in line with Primary Care retention schedules, and maintained as part of your medical record.
Data is retained by Mail Mate only to produce the fully vaccinated, the single dose and the multi-jurisdictional certificate, after which it is deleted.
Telephone calls
Appointments for the vaccination can be made by telephoning 0800 735 5566.
Unless we inform you otherwise, telephone calls made by the Government of Jersey are not recorded. If you leave a message on our voicemail systems, your message will be kept until we are able to return your call or make a note of your message. File notes of when and why you called may be taken for record keeping purposes. We will not pass on the content of your telephone calls, unless is it necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.
Emails
If you email us we may keep a record of your email address and a copy of the email for record keeping purposes. We would suggest that you keep the amount of confidential information you send to us via email to a minimum or use our secure online services where possible or correspond with us by post. We will not share your email address or your email contents unless is it necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.
Your rights
You can ask us to stop processing your information
You have the right to request that we stop processing your personal data in relation to any of our services. Where possible we will seek to comply with your request, but we may be required to continue to process your information for public health or other lawful reasons.
You can withdraw your consent to the processing of your information
Where the collection and processing of your information is carried out on the basis of your consent, you have the right to withdraw your consent to prevent further processing of your personal data.
You can request that the processing of your personal data is restricted
You have the right to request that we restrict the processing of your personal information. You can exercise this right in instances where you believe the information being processed in inaccurate, out of date, or there are no legitimate grounds for the processing. We will always endeavour to consider and comply with your request; however, we may be required to continue to process your information for public health reasons.
You can ask us to correct, amend or erase your information
You have the right to challenge the accuracy of the information we hold about you and request that it is corrected where necessary.
In certain circumstances you can also ask us to erase your information but bear in mind that we may not be able to do this if we have a lawful reason for keeping hold of it.
You can ask us for a copy of the information we hold about you
You are legally entitled to request a list of, or a copy of any information that we hold about you. You can submit a subject access request (SAR) using our online form.
You can complain
To the Government of Jersey Corporate Data Protection Officer by emailing
dpo@gov.je
To the Jersey Office of the Information Commissioner by emailing
enquiries@jerseyoic.org
gov.je