Public Health privacy notice

This privacy notice covers the Public Health directorate which sits within Strategic Policy, Planning and Performance, a Division of the Cabinet Office.

Strategic Policy, Planning and Performance is registered as a 'Controller' under the Data Protection (Jersey) Law 2018 (the “Data Protection Law”), as we determine the purpose and means of the processing of the personal information collected about you for this service.

Public Health refers to services designed to help the population stay healthy and avoid disease. This covers a range of policy areas, from preventing substance abuse to improving nutrition and delivering vaccinations.

The information collected by the directorate enables us to understand more about the nature and causes of disease and ill health in Jersey by measuring the health, mortality and care needs of the population, as well as the diseases and our way of life. This allows us to plan and evaluate services, and to undertake Public Health surveillance to ensure that services and interventions are effective and working for the benefit of the population by improving or protecting public health.

Public Health is also responsible for delivering several services directly to the public, and commissioning other providers to deliver services on behalf of public health. This includes school age vaccinations and interventions which support healthy approaches to food and nutrition in schools.

As a government directorate, Public Health process and hold your information to provide these public services and meet our statutory obligations. This notice explains in more detail how Public Health use and share your information to provide the services or interventions described below.

For information on how the directorate uses your personal data for other services see States of Jersey privacy policies.

Public Health will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.

How we collect information about you

Information about you will, in most cases, be collected directly from you. This may be done by:

collecting your responses to voluntary surveys either on paper, online (this may also include your IP address), in person or by telephone, or through Government systems and Departmental administrative sources that capture and record personal information
the vaccination teams permit Public Health Intelligence to view a digital record of individuals vaccine history, where they have received a vaccination at a hospital, GP practice, pharmacy or vaccination centre located in Jersey
Primary Care supply data relating to those that have been clinically coded as high risk in order that Public Health can report on the vaccination coverage of those individuals who have been prioritised and invited to book their appointments
the Vaccination Teams collecting information from you in person when providing the vaccination, including consent and any contraindications
the Government’s Health and Community Services Team supply records about cancer registration data. The data includes cancer type, gender, age band at diagnosis
qualitative (non-numerical) data collected though observations, interviews, focus groups, surveys and secondary research (for example, text, video and audio) as Public Health seek to explore and understand opinions and perspectives on a variety of different issues
details on births and deaths events that occur and are then registered in Jersey
extracts as a snapshot in time from the Primary Care Registration database concerning registered patients of Jersey Health and Care system
hospital data including Hospital Episode data (HES) and Secondary Uses Service data (SUS) which cover when a patient is treated in hospital
information received on the heights and weights of pupils from the Jersey Child Measurement Programme (JCMP)
online and paper application forms for referrals to Programmes delivered by Public Health
health protection data for cases and contacts, including personally identifiable information (for example name, address, contact details) where required to protect against onward transmission of infectious disease or infectious agent

Types of information we collect

The types of personal data collected will vary depending on what information you provide and the information Public Health need in each circumstance. The most common categories of information Public Health may collect are:

name, age, date of birth, address, post code and Social Security number
sex or gender expression
demographic data such as race, ethnicity and preferred language
religious or other beliefs of a similar nature
family and household details
employment petails
health
facilitators and barriers to health living
income or any financial support you receive
Hospital Episode Statistics (HES) data, including admissions, outpatient appointments, maternity data and A&E attendances at hospitals
civil registrations data, including deaths, cause of death, births, birth weight, still births and country of birth
child health and maternity data, including smoking cessation in maternity, screening and immunisation uptake and wider health outcomes
birth registration data including the number of live births and stillbirths by sex, live births outside marriage or civil partnership, mean age of mother and live births to non-Jersey born mothers, teen births, cesarean delivery, preterm birth and infant mortality
the cause and circumstances of death, and details to enable cremation and repatriation if required
deaths of individuals using commissioned drug and alcohol treatment services, including the cause of death and any substances involve
suicides, including the method and location of the suicide
deaths of children or young people aged under eighteen including the reason for death
vaccination data including the total number of vaccinations provided in Jersey and information on vaccinations for the current eligible population
interviews captured on audio file, video recordings, online forms, written notes, letters or social media. These are stored in various ways, from notebooks, to online documents, to paper records and data bases
qualitative interviews and surveys help to access the thoughts and feelings of participants, which can enable development of an understanding of the meaning that people ascribe to their experiences
your preferences, questions addressing knowledge, attitudes or intentions regarding behaviours and ctivity.
information to deal with enquires or to investigate a complaint. This may also include information that is received from third parties for example, the Police, Environmental agencies, Government departments, landlords or medical information if investigating an accident, health incident, food poisoning or an infectious disease case
names of organisations which programme participants are associated with, such as the name of the school, sensitive health information such as any medical conditions, allergies, weight, and height, GP's details, details about physical activity including data from Smart Activity Trackers
any voluntary information you may provide to Public Health when you engage with us

Public Health do not collect or process all this personal data for all people all the time, only collecting and processing the personal data that is necessary for a particular task that is being carried out.

There is a commitment to using pseudonymised or anonymised information as much as is practical, and in many cases, this will be the default position.

Pseudonymisation is a procedure by which data that could identify an individual is replaced by a fictitious reference. For example, a name could be replaced by a code number, rendering the data record less identifying.

Anonymisation is the process of removing identifying particulars or details from a record for statistical or other purposes.

How we will use the information about you

Public Health need to collect and hold information about you from a diverse number of sources to conduct the functions of Public Health. Our legal basis for processing personal data in most cases is that it is necessary for the exercise of the Public Health function of the Government of Jersey or any public authority (Schedule 2 para 4(c) of the Data Protection Law).

Special category data (such as information about your health) will be processed on the basis that it is necessary for the provision of health or social care or treatment, the management of health or social care systems and services or the protection of the populations health and wellbeing, including prevention, health promotion and response to emergency situations. This data could be used for reasons of public interest in public health or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

We have set out in further detail below why Public Health use your personal data in each instance.

Data collected	Used for	Legal basis
‘Public Health surveillance’ about the health of Jerseys population	The Director of Public Healths annual report highlights areas of concern for the populations health and to advocate for change to support the health and wellbeing of the population	Loi (1934) sur la Santé Publique (“the 1934 Law”), which provides for the role of the Medical Officer of Health and powers to manage and control the spread of infectious diseases. It is supported by a range of other primary and subordinate legislation dealing with health protection at our borders, in the environment and the community
A rolling programme of Jersey Strategic Needs Assessments (JSNA) undertaken across States Departments, led by the Heath Intelligence Team	Will help to develop an understanding of how the determinants of health, including lifestyle risk factors, contribute to morbidity. It will also provide a clearer picture of the current health status of Islanders and identify and project their health and social care needs Analysis of the data will enable the production of a suite of population health indicators for national and local level comparison and benchmarking	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018
Survey Information (Responses to Surveys) including name, unique identifier, email address, voice, image, opinion, ethnicity, religion, data concerning health, sexual orientation	Allows for the statistical analysis of data so policies and procedures can be amended and adapted. Enables planning for the provision of future services, develop policy and legislation. Produce official statistics in line with the agreed Public Health Release Schedule	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018
Demographic information – for example, name, date of birth, date of death, sex, ethnic group, Health number, Social Security number, occupation, contact details (address, postcode, phone number and email address) and – in specific cases – other data, such as landlord information, your property portfolio details, vehicle registration number, employment information, location history, unique identifying codes and professional qualifications. Health information – for example, information about physical health, mental wellbeing, symptoms and medical diagnoses, and health risk factors such as height and weight, smoking habits and alcohol consumption, records of the food eaten, activities undertaken, contact with animals, contact with other people, cause of death, name of death certifier, name of Coroner. Information relating to prescriptions containing controlled drugs and the supply of controlled drugs on prescriptions. Information relating to a person whom a doctor considers, or has reasonable grounds to suspect, is addicted to such controlled drugs. Details of suspected food poisoning, foreign objects found in food, dirty premises, poor hand hygiene, poor food handling, food with visible signs of mold or decay, food sold past its use-by date, unavailable or incorrect allergen information	Preventing threats to public health. To control clusters and outbreaks of communicable disease by taking action, such as tracing close contacts to provide them with public health advice to prevent infections from spreading. Detecting threats to public health. To undertake laboratory tests to identify if you or others have a communicable disease or disease-causing virus or bacteria such as COVID-19, tuberculosis, or norovirus. Analyzing threats to public health To identify trends and monitor the sources and epidemiology of a wide range of communicable diseases and other risks to public health. Responding to threats to public health - to control cases of communicable disease by providing advice on self-isolation, testing and treatment to prevent infections from spreading to others. To provide public health advice if people have been exposed to chemical, radiological and environmental risks to public health such as water-borne diseases and sources of radiation. To maintain oversight, population perspective and to provide political, public advice re other environmental threats to Health – for example, radiation, water quality, air quality, food safety, statutory nuisance: support to Environment Department including the Director of Environmental Health	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, paragraph 4b)
Certificates of Registration of Deaths, Certificates of Medical Attendants and Applications for Cremation	Director of Public Health has statutory duties regarding end-of-life issues, including certification that bodies meet export requirements	Loi (1934) sur la Santé Publique (“the 1934 Law”), Cremation (Jersey) Regulations 1961
Administrative data	Administrative data are available from a variety of government and private sources and can, in many cases, be combined	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, paragraph 4b)
E-mails	If you email the department, a record of your email address and a copy of the email for record keeping purposes may be kept	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, paragraph 4b)
Telephone calls	Public Health do not record or monitor any phone calls you make to us using recording equipment although if you leave a message on the voicemail system it will be kept until we are able to return your call or make a note of the message. File notes of when and why you called may be kept for record keeping purposes	Public functions: The processing is necessary for the exercise of any function of Crown, the States, or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, paragraph 4b)
Statutory requirements	Provide assurance that strategic decisions are being made in accordance with governance arrangements, relevant legislation with reference to Jersey Laws, statutory requirements and policy and operate within an acceptable level of risk	Loi (1934) sur la Santé Publique, including acting as Inspecteur Médical - Food Safety (Jersey) Law 1966 - Public Health and Safety (Rented Dwellings) (Jersey) Law 2017 - Statutory Nuisances (Jersey) Law 1999 - Public Health (Vessels and Aircraft) (Jersey) Law 1950 - Drainage (Jersey) Law 2005 - Burials and Exhumations (Jersey) Law 2004 – Cremation (Jersey) Regulations 1961 - Health Insurance (Jersey) Law 1967 - Misuse of Drugs (Jersey) Law 1978 - Notifiable Diseases (Amendment No. 2) (Jersey) Order 2020

Who we may share your personal information with

Other Data Controllers

Public Health only shares personal identifiable data if it becomes necessary, and will only do so if:

the individual consents
there is a legal requirement to do so
there is need to protect children and vulnerable adults (safeguarding)
there is need to protect the health and safety of others, for example reporting an infectious disease

In some instances, this data sharing may require us to transfer your personal data outside Jersey, however, Public Health shall only do this with the necessary safeguards in place and where it is lawful because it is necessary and proportionate for the proper discharge of our statutory functions.

Public Health may need to pass your information to other Government of Jersey Departments or the following organisations for the purposes stated above:

Office for National Statistics (ONS)
National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH)
MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn and Infant clinical Outcome Review
Public Health England National Cancer Registration who collects data on all cases of cancer that occur in people living in Jersey. The data is used to support public health, healthcare, and research. They provide Public Health Jersey with data on new cases of cancer and cancer survival, monitor new cases of cancer in the population and look at trends and geographical patterns so that risk factors and cancer clusters can be detected. Individual patients are not identified using this data, as it is used at a population level only
Family Nursing and Home Care
UK Government Actuarys Department
Jersey Sport.Com
SmartSurvey, a digital survey solution that helps create surveys, build questionnaires, and analyse the results
Microsoft Corporation (Office Applications, Cloud)

Service providers

Your personal data may be processed on our behalf by certain third parties who provide service to us. Public Health have strict contracts in place with these service providers to ensure they process your data only on our instructions and with appropriate security in place. The third parties who may receive your personal data to provide us with a service are:

Office for National Statistics who clinically code Jersey mortality data
National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH) - a project collecting in-depth information on all suicides in the UK
MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn and Infant clinical Outcome Review Programme (MNI-CORP) which continues the national programme of work conducting surveillance and investigating the causes of maternal deaths, stillbirths and infant deaths
Public Health England National Cancer Registration and Analysis Service
Family Nursing and Home Care who deliver the Jersey Child Measurement Programme
Jersey Sport.com who deliver the Family, Food and Fitness Programme in partnership with Public Health

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.

Data held by Public Health will not be used to make automated decisions.

Publication of your information

Public Health publishes a series of population-level reports according to a pre-announced publication schedule.

Public Health will only publish information in a form that does not identify individuals or households.

Public Health will only publish data which has been aggregated (grouped), routinely suppressing (hiding) numbers fewer than five and ensuring that such figures cannot be obtained by differencing (adding and subtracting other figures to work out the missing one).

Records will not be linked in different datasets for example, hospital and mortality files, unless given express permission to do so.

How long we store your information

Statistical information usually relates to a particular point in time so does not need to be updated.

Public Health will only keep hold of your information for as long as is necessary. This will depend on what the specific information is and the agreed period. The data is permanently disposed of after this period, in line with Public Healths records retention policy or the specific requirements of the relevant data sharing agreement. These arrangements are regularly reviewed as part of Information Governance.

Where we store your information

Government of Jersey systems store data in Jersey, the UK and the European Union. The UK has been granted adequacy status by the European Commission and personal data stored there will be protected to the same standards as personal data held in Jersey and the EU.

Personal confidential data will only be processed by Public Health employees in fulfilment of their public health functions. All staff have contractual obligations of confidentiality and must attend training in Information Governance. Amongst other things, this training makes them understand the importance of confidentiality and security of your personal data and makes clear that they are personally responsible for the security of any information which they are processing. The expectations on staff are set out in the Information Governance Policy.

Relevant organisational and technical measures are taken to ensure the information held is secure, such as using secure locations, restricting access to authorised personnel and protecting personal and confidential information held on computers with encryption. Personal confidential information is only exchanged using secure methods, such as encrypted email or through secure encrypted data file transfers (SEFT).

Where practical, Public Health will anonymise your data. In this case, it will cease to be personal data and may be retained indefinitely.

During qualitative interviews, participant data is captured during the discussions. Any personally Identifiable Information will be redacted from the recording or transcript before being passed to anyone outside the department. This extends to ensuring that no visual personal information from the environment is picked up on photos, or video.

All data storage is encrypted and secure. Access is limited to password holders and scheduled to end on a specified date. The location of all data relating to individual participants is required to be logged, and a deletion date set, including emails arranging the face to face interviews or focus group.

Analysts utilise Nvivo, a qualitative data analysis (QDA) computer software package. NVivo helps organise, analyse and find insights in unstructured or qualitative data like interviews, open-ended survey responses, journal articles, social media and web content, where deep levels of analysis on small or large volumes of data are required. All identifiable, pseudonymised and sensitive datasets from this software are stored electronically on secure government of Jersey servers which can only be accessed by public health professionals.

SmartSurvey servers are based in the UK. No one will access your data unless they have the credentials to access your account, Public Health publish the data, or SmartSurvey staff for the purposes of providing support or fixing a technical issue. SmartSurvey staff are all UK based.

Cookies and the gov.je website

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. See the gov.je privacy notice for details of the cookies used on gov.je websites.

Statutory or contractual obligations to provide personal data

Public Health are responsible for planning, preventing and responding to external health threats. Personal information is collected to fulfil the remit from the government, including the statutory functions of Public Health.

The main purposes for processing personal information are to:

adhere to statutory or contractual obligations to provide personal data
prevention, by anticipating threats to health and help build Jerseys readiness, defenses, and health security
detect, by using environmental and biological surveillance to proactively detect and monitor infectious diseases and threats to health
analyse, by using data analytics to assess and continually monitor threats to health, identifying how best to control and mitigate the risks
respond, by taking rapid, collaborative and effective actions nationally and locally to mitigate threats to health when they materialise.
lead, byleading partnerships designed to save lives, protect Jersey from public health threats, and reduce inequalities

In addition, Public Health is responsible for delivery directly (or indirectly) a range of services to the public including vaccinations, health promotion activity, health improvements in schools and other community settings to meet the purposes identified.

Public Health collect personal information in 3 main ways: directly from you, from the providers of health and care services, and from other organisations supporting the health and care system in Jersey. We may also collect information from other organisations if this is necessary and proportionate to enable us to fulfil our remit.

There will be times when we need to collect your personal information. If this is necessary, we will only use the minimum we need.

Your rights

See Your personal data rights for details of your rights under the Data Protection Law and how to exercise them.

Withdrawal of consent

You have the right to withdraw consent for any personal data that is collected by Public Health by contacting the government as detailed below, or you have the right to request that your personal confidential information is not used beyond your own care and treatment and withdraw consent (opt-out) to the processing or sharing of your information with others (unless there is a legal reason that requires otherwise).

You can ask us to stop processing your information

You have the right to request that Public Health stop processing your personal data in relation to any of our services. Where possible we will seek to comply with your request, but we may be required to continue to process your information for public health or other lawful reasons.

You can withdraw your consent to the processing of your information

Where the collection and processing of your information is conducted on the basis of your consent, you have the right to withdraw your consent to prevent further processing of your personal data.

You can request that the processing of your personal data is restricted

You have the right to request that we restrict the processing of your personal information. You can exercise this right in instances where you believe the information being processed in inaccurate, out of date, or there are no legitimate grounds for the processing. We will always endeavor to consider and comply with your request, however, we may be required to continue to process your information for public health reasons.

You can ask us to correct, amend or erase your information

You have the right to challenge the accuracy of the information we hold about you and request that it is corrected where necessary.

In certain circumstances you can also ask us to erase your information but bear in mind that we may not be able to do this if we have a lawful reason for keeping hold of it.

You can ask us for a copy of the information we hold about you

You are legally entitled to request a list of, or a copy of any information that we hold about you. You can submit a subject access request (SAR) using our online form.

Complaints

If you have an enquiry or concern regarding processing your personal data you can contact the Data Governance Officer at r.young3@gov.je.

If you wish to make a complaint about how your personal data is processed, you can contact the Governments Data Protection Officer at DPO@gov.je.

If you believe that Public Health has contravened the Data Protection Law and the contravention affects your data protection rights, you have the right to make a complaint at any time to the Jersey Office of the Information Commissioner (JOIC).

We would, however, appreciate the chance to deal with your concerns before you approach the JOIC, so please contact us in the first instance.

Changes to this notice

We may, from time to time, revise this privacy policy to ensure it remains up to date. It is advisable to check it regularly to keep aware of any changes.

This version was last updated on 5 March 2023