This privacy notice sets out how Bromley adult social care promise to look after your personal information, describes how we collect, use and share your data and informs you of your privacy rights and how the law protects you.
Who we are
Bromley Council is the data controller for the information it holds. This means that we are responsible for deciding how we process - that is collect, hold, use and share - your personal data.
Our address is Bromley Council, Civic Centre, Stockwell Close, Bromley BR1 3UH
The council’s Data Protection Officer (DPO) can be contacted at dataprotection.mailbox@bromley.gov.uk
What we use your personal information for
Our initial response team and the hospital team are the first point of contact for all eligible adults over the age of 18 and their families in need of community care services. We process your personal information to provide the following services:
- Information, advice, guidance and signposting;
- Referral to external agencies i.e. police, GPs, Court of Protection, environmental health etc.
- Support and safeguarding;
- Assessment and review;
- Management of broken equipment
We will also use your personal data to provide and commission services resulting from these assessments including:
- Residential care;
- Supported living;
- Housing with care;
- Domiciliary care;
- Day care;
- Housing;
- Adaptations and equipment;
- Occupational therapy;
- Transport;
- Financial assessments for the services;
- The protection and safeguarding of vulnerable adults;
- Assessing the quality of our services and evaluating and improving our policies and procedures;
- The completion of statutory government returns
You do not have to provide information to us but, if you do not do so, we may not be able to provide services to you.
How the law protects you, the legal basis for processing your information
The Data Protection Act 2018 and the UK General data Protection Regulation (GDPR) safeguard and protect the use of your personal data. There must be a legal basis (or legitimate interest) for us to process your personal information.
We have legal grounds to process this information because it is necessary for the performance of a task carried out in the public interest under the following legislation:
- Care Act 2014
- Mental Health Acts 1983 and 2007
- Mental Capacity Act 2005
- Safeguarding Vulnerable Groups Act 2006
- Housing Grants Construction and Regeneration Act 1996
- Nationality, Immigration and Asylum Act 2002
- Police and Criminal Evidence Act 1984
- Public Interest Disclosure Act 1998
- Department of Health and Social Care - Care and support statutory guidance 2022
We also have legal grounds to process special category data and criminal convictions data where it is in the exercise of a statutory function and it is necessary for reasons in the substantial public interest.
The information we collect and use may include but not limited to
- Name, address and contact details;
- Date of birth;
- Gender;
- National Insurance number;
- NHS number (if appropriate) as it helps to uniquely identify you when sharing information between health and social care;
- Communication needs;
- Social care services and support including social care assessments, mental health assessments, reviews and care and support plans;
- Personal history including educational and employment history;
- Family history and social relationships such as next of kin, attorney and other information as necessary;
- Accommodation and housing needs;
- Financial details if necessary, including income and details of property ownership.
We may also collect information about
- Physical or mental health including details of your disability/medical conditions and mental health and wellbeing;
- Religious beliefs;
- Sexual life or sexual orientation;
- Race or ethnic origin;
- Criminal convictions and offences.
This information is classed as special category data under the UK GDPR. We may only collect and use this type of data when it is necessary. We have legal grounds to process special category data and criminal convictions data where it is in the exercise of a statutory function and it is in the necessary for reasons in the substantial public interest.
Additionally, and where appropriate, we may seek specific consent to use your information in certain ways. This will normally be where the use of the data is not necessary for the above purposes but may be helpful to us to provide services.
Who we share your information with
- Other teams within the council to provide our services to you;
- Lasting Power of Attorney;
- Main carer;
- Housing associations and housing support providers;
- Voluntary sector;
- Government departments (e.g. Department for Work and Pensions, Department of Health, Home Office);
- Health bodies and providers including local GPs, hospitals, mental health trusts, community health & care trusts;
- Education providers including schools, sixth form colleges, higher education colleges and other post 16 educational providers;
- Police;
- Substance misuse agencies;
- Advocacy services;
- Courts and other judicial agencies including Office of the Public Guardian and the Court of Protection;
- Equipment providers and suppliers;
- Approved building contractors;
- Organisations commissioned to provide care and support, such as home care agencies or care homes;
- Adult safeguarding board;
- Quality Care Commission
We will also share your information, subject to contractual and other legal safeguards, with organisations contracted by us to provide a service to us or directly to you. These service providers are known as data processors and have a legal obligation under UK GDPR to look after your personal information and only use it for providing that service.
This privacy notice should be read in conjunction with the Health Information Exchange Privacy Notice
We do not transfer your information to countries outside of the UK.
How long we use your information for:
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information for statistical purposes without further notice to you.
Once you no longer require services from us, we will retain and securely destroy your personal information in accordance with our information retention schedule.
Automated decision making/profiling
We do not use automated decisions nor profiling about you and your family.
What are your rights?
As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it. Under UK Data Protection laws, we need to make you aware of the rights available to you:
- Right of access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
- Right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
- Right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
- Right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
- Right to object to processing - You have the right to object to processing in certain circumstances.
- Right to data portability - This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another.
The National Data Opt-Out
The National Data Opt-Out Policy was introduced to give you a choice about whether you want your confidential patient information to be used just for your individual care and treatment, or also to be used for research or for the planning of health and care services.
Whenever you use a health or care service, such as attending the Adult Social Care Service, important information about you is collected in an NHS record. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:
- improving the quality and standards of care provided
- research into the development of new treatments
- preventing illness and diseases
- monitoring safety
- planning services
All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.
The council must check the NHS National Data Opt-Out system before using your data for research or planning. If you are happy for us to use your data for these purposes, you do not need to do anything. To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters
Your individual care will not be affected if you opt out and you can change your mind about your choice at any time. You can also find more information on how patient data is used at Understanding patient data
Questions or complaints
If you have any questions about this privacy notice or how we handle your personal information, you can write to the Data Protection Officer (DPO) by letter to the DPO, Bromley Council, Civic Centre, Stockwell Close, Bromley BR1 3UH or via email to Data.Protection@bromley.gov.uk
If you are not satisfied with the outcome of the DPO response, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner’s Office (ICO) can be contacted on 0303 123 1113 or 01625 545 745
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
This privacy notice has been produced in compliance with the UK General data Protection Regulation (GDPR) and the Data Protection Act 2018 and will be reviewed and updated to reflect changes in the council’s services, as well as to comply with the changes in the law.
Please note that this privacy notice only applies to Bromley Council’s website and ceases to apply when you leave our pages. If you follow links to other organisations’ websites, even if you follow a link which we have provided, it is suggested you take the time to read the privacy notices on the websites you visit.