Dudley Council
Dudley Skyline

Public Health Service Healthy Ageing Team - Privacy Notice

We are committed to protecting your personal data and ensuring that it is processed fairly and lawfully. Information you provide to us will be processed in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA 2018) and subsequent legislation.   See the Council's Corporate Privacy Notice


The following information relates specifically for services provided by the Dudley Council Public Health – Healthy Ageing Team.

Purpose of processing

Dudley Council Public Health team has a legal duty to protect and improve the health and wellbeing of people in the Dudley Borough. The processing is necessary for the performance of this task carried out in the public interest and for compliance with a legal obligation as set out in the Health and Social Care Act 2012.  This meets the requirements of Article 6(1)(e) of the GDPR (Lawfulness of processing) and Section 8 of Part 2, Chapter 2 of the DPA 2018 (information processed for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority). To support this, we use data from a range of sources. We use this data to:

  • provide services to meet your needs 
  • provide you with signposting, relevant advice and information and onward referral
    monitor, plan, and evaluate our services
  • measure the health, wellbeing and care needs of specific geographical areas and population groups
  • understand more about the nature, causes and outcomes of disease

Information we process

To provide you with our services we need to record and hold information that includes personal and sensitive characteristics such as:

  • your name, address, date of birth, and contact details
  • your religion, racial or your ethnic background
  • your gender or sexuality
  • your reasons for needing a service including health and lifestyle information
  • service monitoring and observations about you and your needs

Where “Special Category” information is being processed (in bold above) Article 9(2)(i) of the GDPR requires it to be necessary for reasons of public interest in the area of public health.  This is further supported by Schedule 1, paragraph 3 of the DPA 2018.

A policy document is in place in accordance with Article 5 of the GDPR explaining how we process and look after this type of data.

Information we receive

To help us fulfil our legal obligations, we receive information from NHS Digital and Public Health England. Civil Registrations (Births and Deaths) data includes:

  • postcode of usual residence
  • place of birth text and postcode, postcode of place of death
  • NHS number Version 2 14/06/2018
  • date of birth, date of death, date of registration
  • maiden name, name of certifier, name of coroner
  • birth weight, cause of death

We collect and process births and deaths data in order to measure and monitor the health, wellbeing or care needs of the population and to protect the health of the local population. The legal basis for the use of this data is section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Dudley Council uses particular identifiers such as pin numbers and NHS numbers in order to carry out its functions. Pin numbers enable the council to process and distribute data in government statutory returns without identifying individuals.

Minimising the personal data we use about you

Wherever possible we ensure that you cannot be identified in the data unless it is necessary.

Details, such as name or date of birth, are removed to prevent identification of you or your personal information is adapted to remove any obvious means of identifying you and replaced with an identification number (e.g. your NHS number is replaced with a unique identifier). This process allows you to be distinguished within a dataset without revealing your identity.

Sharing your information

The information you provide to access our services will be shared with other relevant organisations and agencies for the purposes of onward referral but in this case we will make this clear to you at that time, tell you who we will share it with and ensure that we have your consent before it is shared. Information will not be shared with any other third parties unless required by law. You can refuse permission for us to share your information, however, this may limit how much we may be able to support you.

Amount of time we will hold your information

The information provided will be kept in accordance with our retention policy.  Details of this are available by contacting information.governance@dudley.gov.uk

Keeping your information secure

We are committed to protecting personal data and have data policies and procedures in place to ensure that it is safeguarded.

Any personal identifiable data is sent or received using secure email. All data is stored electronically on encrypted equipment and is managed using the principles of confidentiality and data protection. The number of staff accessing and handling such data is limited to only those key professionals named on relevant signed information sharing agreements (where applicable), all undertake regular training about data protection and managing personal information. In relation to births and deaths, the data will only be processed by Dudley Council employees in fulfilment of the public health function, and will not be transferred, shared, or otherwise made available to any third party, including any organisations processing data on behalf of Dudley Council or in connection with their legal function.

Opting out of the use of your information

You have the right to opt out of Dudley Council, Public Health receiving or holding your personal identifiable information. There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on what the specific data is and what programme it relates to.
If you would like further information about opting out of the use of your information, please contact Healthy Ageing Team on 01384 816437 or email SMP@dudley.gov.uk

National data opt-out

National Data Opt-Out and use of NHS data.


Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a Care or Patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

•  improving the quality and standards of care provided
•  research into the development of new treatments
•  preventing illness and diseases
•  monitoring safety
•  planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.
To find out more or to register your choice to opt out, please visit Your NHS Data Matters. On this web page you will:
•  See what is meant by confidential patient information
•  Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
•  Find out more about the benefits of sharing data
•  Understand more about who uses the data
•  Find out how your data is protected
•  Be able to access the system to view, set or change your opt-out setting
•  Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
•  See the situations where the opt-out will not apply

You can also find out more about how patient information is used at:
NHS UK Information About Patients (which covers health and care research); and
Understanding Patient Data What You Need to Know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations have until March 2021 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care.

Your Rights

Your rights are detailed in the Council’s Corporate Privacy Notice 

Should you wish to raise any concerns about how we have processed your personal data you can contact the data protection officer, email information.governance@dudley.gov.uk

You also have the right to contact the Information Commissioner.

If you would like a copy of this information in a different format, please email information.governance@dudley.gov.uk