Public health privacy notice

What Public Health covers

All local authorities have a duty to improve the health of the population they serve. To help us do this, we use data and information from a range of sources including the Office for National Statistics, Health and Social Care Information Centre, Clinical Commissioning Groups and hospitals to understand more about the nature and causes of disease and ill health in Leeds.

Who the data controller is for the information we collect

This Privacy Notice is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) to explain how we process your personal data in delivering public health service.

Leeds City Council is the data controller for the purposes of the Data Protection Act 2018 and other regulations including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. Our contact details are Leeds City Council, Merrion House, 110 Merrion Way, Leeds, LS2 8BB.

The data we will collect

We only collect and use the minimum amount of personal information required when delivering public health services. We will use all or some of the personal information below:

  • name
  • phone number
  • email address
  • age
  • area of Leeds
  • sex
  • gender identity
  • ethnicity
  • sexual orientation
  • religion

Leeds City Council may also make recordings, videos, short film or webpage during engagement events. The imagery created during these events may be used in the report and in future events, marketing and promotional activities.

The above applies to use:

  • on authorised internet pages
  • in information leaflets
  • in guidance booklets
  • in social media (Twitter, Facebook, YouTube, Instagram)
  • in corporate publications
  • on CD ROM or in electronic-based documents
  • in promotional films
  • in news media and press releases, on approval by Leeds City Council

How we collect information about you

We collect information about you from you directly (by asking you to complete one of our forms).

All local authorities have. To help us in our duty to improve the health of the population we serve and to understand more about the nature and causes of disease and ill health in Leeds, we use data and information from a range of sources including:

  • the Office for National Statistics
  • NHE England
  • West Yorkshire Integrated Care Board
  • health and care providers accessed by Leeds GP's
  • Leeds residents

We may also obtain information about you from other sources, for example if somebody made a complaint about you or other statutory agencies, some of these are listed below:

  • members of the public
  • internal council departments
  • other public authorities
  • DEFRA
  • West Yorkshire Police
  • West Yorkshire Trading Standards
  • veterinary practices
  • NHS Trusts and other
  • payment information

Why we process your data

We use your information for the purpose of:

  • statutory service provision
  • service planning
  • investigation of statutory offences

All the data collected will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). The data provided by you will only be used for the purpose(s) specified.

Lawful basis for processing

We will process your data in accordance with UK GDPR Article 6(1). The processing shall be lawful only if and to the extent that the following applies:

  • Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes; For example, extract data from GP surgeries, evaluation of focus groups, participation in surveys and stake holder consultation.
  • Article 6(1)(c) processing is necessary for compliance with a legal obligation and
  • Article 6(1)(e) the processing is necessary for the performance of a public task. The production of the Annual DPH report is a statutory requirement under the Health and Social Care Act (2012) which sets out a statutory requirement for all Directors of Public Health to provide an annual independent report on the health of the local population and for the local authority to publish it.

This guidance is published under section 73A(7) of the NHS Act 2006 and local authorities must have regard to (https://www.fph.org.uk/media/1264/dph-roles-and-responsibilities-dh.pdf).

We will process special category data as follows:

  • in accordance with UK GDPR Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
  • Article 9(2)(i) – the processing is necessary for reasons of public interest in the area of public health
  • Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.

The following statutory gateways apply:

  • The Health & Social Care Act 2012
  • The Statistics and Registration Service Act (2007) as amended by Section 287 of the Health and Social Care Act (2012)
  • Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002
  • The Equality Act 2010

The processing is supported by the following Schedule 1 Part 1 conditions of the Data Protection Act 2018:

  • public health monitoring and statistics
  • responding to new threats to public health (e.g. epidemics, pandemics or new research findings)

All the listed conditions require an Appropriate Policy Document to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. The council’s Appropriate Policy Document provides further information about this processing and supplements this privacy notice.

Data retention, storage and destruction

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention. This means that information you provided will be kept in accordance with discharge of our legal duties and then will be deleted. The Director of Public Health annual report will remain archived and in the public domain beyond this point.

Withdrawing your consent

You have the right to withdraw your consent from participating in the project at any time. If you decide that you no longer wish to participate in the scheme, please contact:

rebecca.jefferies@leeds.gov.uk

Please note that we may not be able to remove the information provided by you if it was already included in the research.

Who we can share your data with

We share your data with organisations and agencies some of which are shown below as follows:

  • partner agencies in the health and social sector
  • adult social care
  • NHS provider trusts
  • voluntary sector
  • Department of Health
  • Office for Health Improvement and Disparities

We are bound by a number of information sharing agreements which are drawn up to ensure information is received from and shared with the organisations in a way that complies with relevant legislation. This information will be held securely and will not be disclosed to anyone other than those stated above without your permission, unless we have a legal or statutory reason to do so, for example disclosure is necessary to protect a person from suffering significant harm or necessary for crime prevention or detection purposes, as listed below:

  • where such disclosure is necessary for compliance with a legal obligation to which we are subject
  • in order to protect your vital interests or the vital interests of another natural person (for example, to communicable disease outbreak control)
  • for the purposes of security and prevention of fraud and other criminal activity
  • where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

Automated decision making

Your data will not be used for any automated decision making, including profiling.

Your rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

The following data rights are available under the UK GDPR:

  • the right to access - you can ask for copies of your personal data
  • the right to rectification - you can ask us to rectify inaccurate personal data and to complete incomplete personal data the
  • the right to erasure (where you can ask us to erase your personal data)
  • the right to restrict processing - you can ask us to restrict the processing of your personal data
  • the right to data portability (where you can ask that we transfer your personal data to another organisation or to you
  • the right to object to processing (where you can object to the processing of your personal data) and
  • the right to complain to a supervisory authority - you can complain about our processing of your personal data the right to
  • withdraw consent (to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.

All data rights apply where we process your information based on your consent.

Where we process your data under the public task basis, the following data rights do not apply - the right to erasure, the right to portability and the right to withdraw consent.

Where we process your information under legal obligation certain rights to do not apply, such as erasure, data portability, objection to processing and the right to withdraw consent.

All the rights are subject to certain limitations and exceptions. You can learn more about your rights through the ‘Your individual rights and how to exercise them’,  and the Information Commissioner's Office site. You may exercise any of the above rights in relation to your personal data by writing to us, using the contact details provided below.

When your data gets sent to other countries

The information you provide will not be transferred to another country outside of the UK.

Contact us

Any queries in relation to this Privacy Notice should be forwarded to:

Email: PHI.Requests@leeds.gov.uk

Data Protection Officer

Aaron Linden
Head of Information Management and Governance - Data Protection Officer
Leeds City Council
Merrion House
110 Merrion Way
Leeds
LS2 8BB

Email: DPO@leeds.gov.uk

The Council privacy notice is available to view here.

Complaints

If you are unhappy with the way in which your information has been handled, you should speak with the specific service in the first instance.

Any data protection complaints about how the council has processed your personal data, will be handled in accordance with the council’s Complaints Policy. You can find out how to submit a complaint by visiting this link.

If we cannot resolve your complaint, you can refer to the Information Commissioner if you consider that there has been an infringement of data protection legislation. Further details can be found on the Information Commissioner’s website.

Changes to this notice

We keep our privacy notice under regular review. We will notify you of significant changes to this notice by email or other means as appropriate. This privacy notice was last updated March 2025.