Guidance

Ministry of Defence Police COVID-19 privacy notice

Published 23 April 2020

The purpose of this privacy notice is to provide you with information and make it easier to understand how the Ministry of Defence Police (MDP) may seek to collect and hold information about you, in relation to the unprecedented challenges we are all facing during the coronavirus (COVID-19) pandemic.

The MDP may seek to collect and process your personal data in response to the recent outbreak of coronavirus, which is above and beyond what would ordinarily be collected from its officers, staff and their dependents, to ensure their safety and well-being.

Such information will be limited to what is proportionate and necessary, taking into account latest guidance issued by the government and health professionals, in order to manage and contain the virus. It will enable the MDP to effectively fulfil its functions to keep people safe, put contingency plans in place to safeguard those vulnerable and aid business continuity.

Where the information is to be used to make organisational decisions and for general reporting, wherever possible, steps will be taken to anonymise the data and general numbers used.

What personal data is being collected?

Personal data is being collected to enable MDP to identify any staff (or those closely linked to staff, for example their dependents) who are in any of the high-risk categories and would be considered vulnerable if infected with coronavirus.

What is our lawful basis for processing your personal data?

The General Data Protection Regulation requires that the following specific conditions are met to ensure that the processing of personal data is lawful:

• Article 6(1)(d) is necessary in order to protect the vital interests of the data subject or another natural person.

Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.

• Article 6(1)(e) is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law. The Police Reform and Social Responsibility Act 2011 provides that Chief Constable may do anything which is calculated to facilitate or is conducive or incidental to the exercise of the functions Chief Constable.

The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless the following specific further conditions can be met:

• Article 9(2)(i) is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Schedule 1, Part 1(1) is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, for example the Health and Safety at Work Act 1974.

Schedule 1, Part 1(3) is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. governmental guidance published by Public Health England.

Am I required to provide my personal data under a statutory or contractual requirement, or am I obliged to provide it?

Whilst the provision of data cannot be mandated, you are strongly advised that it is in the best interests of all to provide the information so that the MDP are able to take relevant steps to keep you and others safe.

The information will be managed in a confidential manner. All information will be held securely and processed on a ‘need to know’ basis by only a limited number of people. If there is a need to disclose outside of this, a minimal amount of personal data will be used.

How long will my personal data be retained by the MDP?

The MDP will only keep your information for as long as is necessary, taking into account Government advice and the ongoing risk presented by coronavirus.

Information provided by staff in relation to the outbreak of coronavirus will not be used for any other purpose, including to be held within personnel files ‘just in case’ it may be needed again.

When the information is no longer needed, it will be securely deleted.

Your rights

If you would like to know more about your information rights or how to exercise them, view our full privacy notice.

For information about how we process your personal data, you can contact the MDP Data Protection Advisor: mdp-dpa@mod.gov.uk. Further advice and guidance is available on the ICO website.