Public Health privacy notice

​​​​​​​This privacy notice covers the Public Health directorate which sits within Strategic Policy, Planning and Performance, a Division of the Cabinet Office.

Strategic Policy, Planning and Performance is registered as a 'Controller' under the Data Protection (Jersey) Law 2018 (the “Data Protection Law”), as we determine the purpose and means of the processing of the personal information collected about you for this service.

Public Health refers to services designed to help the population stay healthy and avoid disease. This covers a range of policy areas, including: 

• ​preventing substance abuse
• improving nutrition
• delivering vaccinations

The information collected by the directorate allows us to understand more about the nature and causes of disease and ill health in Jersey by measuring the health, mortality, and care needs of the population, as well as the diseases and our way of life. 

This allows us to plan and evaluate services, and to undertake Public Health surveillance to ensure that services and interventions are effective and working for the benefit of the population by improving or protecting public health.

Public Health surveillance is the continuous process of collection, analysis and interpretation of data, and the subsequent dissemination of this information to policy makers, healthcare and other professionals, such as the HSC Public Health Agency​.

Public Health is also responsible for delivering several services directly to the public and commissioning other providers to deliver services on behalf of public health. This includes but not limited to school age vaccinations and interventions which support healthy approaches to food and nutrition in schools.

As a government directorate, Public Health process and hold your information to provide these public services and meet our statutory obligations. This notice explains in more detail how Public Health use and share your information to provide the services or interventions. 

For information on how the directorate uses your personal data for other services, see States of Jersey privacy policies. 

Public Health will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.

How we collect information about you​

Information about you will, in most cases, be collected directly from you. This may be done by:

• ​collecting your responses to voluntary surveys either on paper, online (this may also include your IP address), in person or by telephone, or through government systems and Departmental administrative sources that capture and record personal information
• the vaccination teams permit Public Health Intelligence to view a digital record of an individual’s vaccine history, where they have received a vaccination at various locations including hospitals, GP practices, pharmacies, care homes, schools, nurseries or Vaccination Centre’s located in Jersey
• Primary Care supply data relating to those that have been clinically coded as high risk in order that Public Health can report on the vaccination coverage of those individuals who have been prioritised and invited to book their appointments
• the vaccination teams collecting information from you in person when providing vaccination, including your consent and any history of potential contraindications
• the Health Informatics Team and departments within the hospital supply data and information on vaccine eligibility, such as specialist rheumatology, oncology and so on
• the government’s Health and Community Services Team supply records about cancer registration data. The data includes cancer type, gender, age band at diagnosis 
• qualitative (non-numerical) data collected though observations, interviews, focus groups, surveys, and secondary research (for example, text, video, and audio) as Public Health seek to explore and understand opinions and perspectives on a variety of different issues
• details on births and deaths events that occur and are then registered in Jersey
• extracts as a snapshot in time from the Primary Care Registration database concerning registered patients of Jersey Health and Care system
• Hospital data including Hospital Episode data (HES) and Secondary Uses Service data (SUS) which cover when a patient is treated in hospital
• information received on the heights and weights of pupils from the Jersey Child Measurement Programme (JCMP)
• online and paper application forms for referrals to Programmes delivered by Public Health
• registered Medical Practitioners are legally required, to notify the Chief Medical Officer (CMO) of every termination of pregnancy conducted in Jersey. The Public Health team manage the process of capturing the data in respect of a completed paper form
• Health protection data for cases and contacts, including personally identifiable information (for example name, address, contact details) where required, to protect against onward transmission of infectious or notifiable diseases or their agent
• Customer and Local Services (CLS) supply information to support Public Health programmes, for example, shingles vaccine eligibility
• the Child Health Team updates the Health Information system with any developmental checks, immunisations, check-ups, or appointments
• the PFAS Panel invited written submissions from affected Islanders wishing to give evidence about health symptoms they attribute to their PFAS exposure. The information provided was seen only by the PFAS Panel members and a limited number of government officials
• self-reporting of illness and test results through online forms on gov.je, for example, registration of COVID-19 LFT results

Types of information we collect​

The types of personal data collected will vary depending on what information you provide and the information Public Health need in each circumstance. 

Public Health do not collect or process all this personal data for all people all the time, only collecting and processing the personal data that is necessary for a particular task that is being carried out.

There is a commitment to using pseudonymised or anonymised information as much as is practical, and in many cases, this will be the default position.

Pseudonymisation is a procedure by which data that could identify an individual is replaced by a fictitious reference. For example, a name could be replaced by a code number, rendering the data record less identifying.

Anonymisation is the process of removing identifying particulars or details from a record for statistical or other purposes.

Below are listed the most common categories of information Public Health may collect about you:

• name, age or date of birth, non-binary or gender expression, address, post code and Social Security number
• demographic data such as race, ethnicity, and preferred language
• religious or other beliefs of a similar nature
• family and household details such as household makeup, house type and so on
• employment details, such as employment status, workplace, role, hours worked
• health, including self-perception of health, long-term conditions
• diet, meal preferences, planning, spending, perceptions, and decision-making
• facilitators and barriers to health living
• income, whether it is a pension, benefits or salary
• Hospital Episode Statistics (HES) data, including admissions, outpatient appointments, maternity data, and A&E attendances at hospitals
• infectious disease reporting, including symptoms, test status, result status, contacts, potential sources of infection
• self-testing results, for example, COVID-19 LFT results
• information on contaminant exposure (including PFAS), which may include symptoms, morbidities, testing status, result status, affected addresses, potential sources of exposure
• civil registrations data, including deaths, cause of death, births, birth weight, still births and country of birth
• termination of pregnancy data, including name of practitioner, grounds (opinion for the commencement of treatment), date of birth, gestation, parity, method, complications, sterilisation, or deaths
• child health and maternity data, including smoking cessation in maternity, screening and immunisation uptake and wider health outcomes
• birth registration data including the number of live births and stillbirths by sex, live births outside marriage or civil partnership, mean age of mother and live births to non-Jersey born mothers, teen births, cesarean delivery, preterm birth, and infant mortality
• the cause and circumstances of death, and details to enable cremation and repatriation if required
• deaths of individuals using commissioned drug and alcohol treatment services, including the cause of death and any substances involved
• death by suicide, including the method and location of the suicide 
• deaths of children or young people aged under eighteen including the reason for death
• vaccination data including the total number of vaccinations provided in Jersey and information on vaccinations for the current eligible population
• interviews captured on audio file, video recordings, online forms, written notes, letters, or social media. These are stored in various ways, from notebooks, to online documents, to paper records and data bases
• qualitative Interviews and surveys help to access the thoughts and feelings of participants, which can enable development of an understanding of the meaning that people ascribe to their experiences
• your preferences, questions addressing knowledge, attitudes or intentions regarding behaviours and activity
• information to deal with enquires or to investigate a complaint. This may also include information that is received from third parties for example, the Police, Environmental agencies, government departments, landlords or medical information if investigating an accident, health incident, food poisoning or an infectious disease case
• names of organisations which programme participants are associated with, such as the name of the school, sensitive health information such as any medical conditions, allergies, weight, and height, GP's details, details about physical activity including data from Smart Activity Trackers
• any voluntary information you may provide to Public Health when you engage with us

How we will use the information about you​

Public Health need to collect and hold information about you from a diverse number of sources, to conduct the functions of Public Health. Our legal basis for processing personal data in most cases is that it is necessary for the exercise of the Public Health function of the States or any public authority (Schedule 2 para 4(c) of the Data Protection Law).

Special category data (such as information about your health) will be only processed on the basis that it is necessary to inform the provision of health or social care or treatment, the management of health or social care systems or to develop services to protect the population’s health and wellbeing. This may include: 

• vaccination data
• prevention measures
• health promotion services
• responses to emergency situations
  

This data could also be used in an anonymised form for reasons of public interest, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

We have set out in further detail below why Public Health use your personal data in each instance.

​

Who we may share your Personal Information with?

Other Data Controllers

Public Health only shares personal identifiable data if it becomes necessary, and will only do so if:

• ​the individual consents 
• there is a legal requirement to do so
• there is need to protect children and vulnerable adults (safeguarding)
• there is need to protect the health and safety of others, for example reporting an infectious or notifiable disease or their agent

In some instances, this data sharing may require us to transfer your personal data outside Jersey, however, Public Health shall only do this with the necessary safeguards in place and where it is lawful because it is necessary and proportionate for the proper discharge of our statutory functions.

Public Health may need to pass your information to other Government of Jersey Departments or the following organisations for the purposes stated above:

• ​the UK Health Security Agency (UKHSA).Office for National Statistics (ONS)
• World Health Organization (WHO)
• National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH)
• MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn, and Infant clinical Outcome Review
  
• Public Health England National Cancer Registration who collects data on all cases of cancer that occur in people living in Jersey. The data is used to support public health, healthcare, and research. They provide Public Health Jersey with data on new cases of cancer and cancer survival, monitor new cases of cancer in the population and look at trends and geographical patterns so that risk factors and cancer clusters can be detected. Individual patients are not identified using this data, as it is used at a population level only
• UK Government Actuary’s Department
• Family Nursing and Home Care
• JerseySport.com
• Primary Care – GP surgeries and Primary Care doctors (also known as General Practitioners or family doctors) 
• Community pharmacies
• SmartSurvey 
• Citizen Space (Delib)
• PFAS Scientific Advisory Panel
• Microsoft Corporation (Office Applications, Cloud)
• Anonymised statistical information may be published on the Government of Jersey website and through other media

Service Providers

Your personal data may be processed on our behalf by certain third parties who provide services to us. Public Health have strict contracts in place with these service providers to ensure they process your data only on our instructions and with appropriate security in place.

The third parties who may receive your personal data to provide us with a service are:

• ​Office for National Statistics who clinically code Jersey mortality data
• National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH), a project collecting in-depth information on all suicides in the UK
• MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn, and Infant clinical Outcome Review Programme (MNI-CORP) which continues the national programme of work conducting surveillance and investigating the causes of maternal deaths, stillbirths, and infant deaths
• Public Health England National Cancer Registration and Analysis Service
• Family Nursing and Home Care who deliver the Jersey Child Measurement Programme
• JerseySport.com who deliver the Family, Food and Fitness Programme in partnership with Public Health
• Primary Care – GP Practices for immunisations
• Community Pharmacies for immunisations
• Smart Survey, a digital survey solution that helps anyone create surveys, build questionnaires, and analyse the results
• Citizen Space (Delib), an online engagement and consultation platform, used to design, publish, analyse, and feedback

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.

Data held by Public Health will not be used to make automated decisions. 

Publication of your information​

Public Health publishes a series of population-level reports according to a pre-announced publication schedule. 

Public Health will only publish information in a form that does not identify individuals or households.

Public Health will only publish data which has been aggregated (grouped), routinely suppressing (hiding) numbers fewer than five and ensuring that such figures cannot be obtained by differencing (adding and subtracting other figures to work out the missing one).

Records will not be linked in different datasets, for example, hospital and mortality files, unless given express permission to do so.

For Consultation exercises Public Health may publish a summary of responses. This will not include any personal data.

Anonymised statistical information may be published on the Government of Jersey website and through other media where relevant.

We may need to publish your information:

• ​where we are required by law to publicise certain information
• ​in the interests of demonstrating a fair and transparent decision-making process
• where we are required to provide statistical information about a group of people, although your data will be anonymised to protect your identity

Where you have responded to a public consultation, your comments will be anonymised to protect your identity where the contribution is made in a private capacity. However, if it is from a person on behalf of an organisation then the views and connection with the organisation may be attributed.​

Where you have contributed content to the website or Government of Jersey social media channels.

Public Health will not publish any of your sensitive personal information unless there is a requirement for us to do so to carry out our statutory functions.

All Public Health publications are available on gov.je. 

How long do we store the information about you?

Statistical information usually relates to a particular point in time so does not need to be updated. 

Public Health will only keep hold of your information for as long as is necessary. This will depend on what the specific information is and the agreed period. The data is permanently disposed of after this period, in line with the Strategic Policy, Planning and Performance Department’s records retention policy or the specific requirements of the relevant data sharing agreement. 

These arrangements are regularly reviewed as part of Information Governance.

Where do we store the information about you?

Government of Jersey systems store data in Jersey, the UK, and the European Union. The UK has been granted adequacy status by the European Commission and personal data stored there will be protected to the same standards as personal data held in Jersey and the EU. 

Personal confidential data will only be processed by Public Health employees in fulfilment of their public health functions. All staff have contractual obligations of confidentiality and must complete training in Information Governance. Amongst other things, this training makes them understand the importance of confidentiality and security of your personal data and makes clear that they are personally responsible for the security of any information which they are processing. The expectations on staff are set out in the Information Governance Policy.

​Relevant organisational and technical measures are taken to ensure the information held is secure, such as: 

• ​using secure locations
• restricting access to authorised personnel
• protecting personal and confidential information held on computers with encryption

Personal confidential information is only exchanged using secure methods, such as encrypted email or through secure encrypted data file transfers (SEFT). 

Where practical, Public Health will anonymise your data. In this case, it will cease to be personal data and may be retained indefinitely.

During qualitative interviews, participant data is captured during the discussions. Any personally identifiable information will be redacted from the recording or transcript before being passed to anyone outside the department. This extends to ensuring that no visual personal information from the environment is picked up on photos, or video.

All data storage is encrypted and secure. Access is limited to password holders and scheduled to end on a specified date. The location of all data relating to individual participants is required to be logged, and a deletion date set, including emails arranging the face-to-face interviews or focus group.

Analysts may utilise Nvivo, a qualitative data analysis (QDA) computer software package. NVivo helps organise, analyse, and find insights in unstructured or qualitative data like interviews, open-ended survey responses, journal articles, social media, and web content, where deep levels of analysis on small or large volumes of data are required. 

All identifiable, pseudonymised and sensitive datasets from this software are stored electronically on secure Government of Jersey servers which can only be accessed by public health professionals.

SmartSurvey servers are based in the UK. No one will access your data unless they have the credentials to access your account, Public Health publish the data, or SmartSurvey staff for the purposes of providing support or fixing a technical issue. SmartSurvey staff are all UK based.

Citizen Space (Delib) servers are based in the UK and the European Economic Area (EEA). This site is managed by the controlling organisation (Government of Jersey). 

When you access and use this site, the personal information you have submitted to these activities will go to the organisation. Delib will not access personal information unless requested to do so by the organisation, and only for the purposes of assisting them with the administration of this site.

The information provided by your computer when you use this website is collected by Delib. For example, your: 

• ​browser type
• IP address
• language preference
• referring site and the date and time

The purpose for collecting this information is to maintain the security of the website and for operating and improving the software.

Cookies and gov.je

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. 

You can find more information on Cookies policy​.

Statutory or contractual obligations to provide personal data

Public Health are responsible for planning, preventing, and responding to external health threats. Personal information is collected to fulfil the remit from the Government of Jersey, including the statutory functions of Public Health.

The main purposes for processing personal information are to:​

• ​prevent, by anticipating threats to health and help build Jerseys readiness, defences and health security
• detect, by using environmental and biological surveillance to proactively detect and monitor infectious diseases and threats to health
• analyse, by using data analytics to assess and continually monitor threats to health, identifying how best to control and mitigate the risks
• respond, by taking rapid, collaborative, and effective actions nationally and locally to mitigate threats to health when they materialise
• lead, by leading partnerships designed to save lives, protect Jersey from public health threats, and reduce inequalities

In addition, Public Health is responsible for delivery directly (or indirectly) a range of services to the public including: 

• ​vaccinations
• health promotion activity
• health improvements in schools
• other community settings to meet the purposes identified

Public Health collect personal information in 3 main ways:

• ​directly from you
• from the providers of health and care services
• from other organisations supporting the health and care system in Jersey
  

We may also collect information from other organisations if this is necessary and proportionate to enable us to fulfil our remit.

There will be times when we need to collect your personal information. If this is necessary, we will only use the minimum we need.

Your rights​

You can find information on the details of your rights under the Data Protection Law and how to exercise them on the Your personal data rights webpage. 

Withdrawal of Consent

You have the right to withdraw consent for any personal data that is collected by Public Health by contacting the government as detailed below. Alternatively, you have the right to request that your personal confidential information is not used beyond your own care and treatment and withdraw consent (opt-out) to the processing or sharing of your information with others, unless there is a legal reason that requires otherwise. 

You can withdraw your consent by contacting our Data Protection Officer at publichealth@gov.je

You can ask us to stop processing your information

You have the right to request that Public Health stop processing your personal data in relation to any of our services. Where possible we will seek to comply with your request, but we may be required to continue to process your information for public health or other lawful reasons.

You can withdraw your consent to the processing of your information

Where the collection and processing of your information is conducted based on your consent, you have the right to withdraw your consent to prevent further processing of your personal data.

However, this may cause delays or prevent us delivering a service to you. We will always seek to comply with your request, but we may be required to hold or process your information to comply with a legal requirement.

You can request that the processing of your personal data is restricted​

You have the right to request that we restrict the processing of your personal information. You can exercise this right in instances where you believe the information being processed in inaccurate, out of date, or there are no legitimate grounds for the processing. 

We will always endeavour to consider and comply with your request, however we may be required to continue to process your information for public health reasons.

You can ask us to correct, amend or erase your information

You have the right to challenge the accuracy of the information we hold about you and request that it is corrected where necessary.​

In certain circumstances you can also ask us to erase your information but bear in mind that we may not be able to do this if we have a lawful reason for keeping hold of it.

If you choose to email or post us information, we may keep a record of details including your email address, a copy of the email or letter for record keeping purposes. For security reasons we will not include any confidential information about you in any email we send to you.

We would also suggest that you keep the amount of confidential information you send to us by email or post to a minimum, or only offering information we have requested. We will not share your contact details unless is it necessary for us to do so, either to fulfil your request for a service or comply with a legal obligation, or where permitted under other legislation.​

To withdraw data submitted through an online survey, you must provide your unique ID given at the end of the survey. 

If you want to withdraw data from a focus group that has started, we will be unable to delete your pseudonymised responses from the transcription, this also applies to data provided in interviews, email’s or by post.

You can ask us for a copy of the information we hold about you

You are legally entitled to request a list of, or a copy of any information that we hold about you. You can submit a subject access request (SAR) using our online form.

Complaints

If you have an enquiry or concern regarding processing your personal data you can contact publichealth@gov.je or alternatively the Data Governance Officer at r.young3@gov.je.

If you wish to make a complaint about how your personal data is processed, you can contact the Government of Jersey Data Protection Officer at DPO@gov.je.

If you believe that Public Health has contravened the Data Protection Law and the contravention affects your data protection rights, you have the right to make a complaint at any time to the Jersey Office of the Information Commissioner (JOIC)​. 

We would, however, appreciate the chance to deal with your concerns before you approach the JOIC, so contact us in the first instance.

Changes to this Notice

​We may, from time to time, revise this privacy to ensure it remains up to date. It is advisable to check it regularly to keep aware of any changes.

This version was last updated on 18 December 2023.