Why we process your information
The UK COVID-19 Inquiry has been set up to examine the UK’s response to and impact of the COVID-19 pandemic. NHS England played a vital role in responding to the pandemic and will need to respond to questions and requests received from the Inquiry.
Further information about the terms of reference and scope of activity of the Inquiry can be found on the UK Covid-19 Inquiry website.
This notice sets out how the NHSBSA will use your personal data as well as your rights. The purposes for using and sharing your data will be:
- Preparing for the questions and requests which the Inquiry may potentially ask us. This may include accessing and reviewing personal data relating to our colleagues in relation to their role in responding to the pandemic.
- Responding to the questions and requests which we receive from the Inquiry. It is likely that we will need to access and review the personal data of our colleagues in relation to their role in responding to the pandemic. We may also need to share personal data relating to colleagues and former colleagues with the Inquiry where necessary to answer questions raised by the Inquiry.
Sharing your information
Your information may be shared with these other organisations by the NHSBSA as required by law:
- the UK COVID-19 Inquiry Legal Team
- our legal support provider
Legal basis for processing
As a public authority, NHSBSA can use your information to perform its public tasks where that use is in the public interest. Those tasks extend to the activities we need to perform to prepare and respond to the requests we may receive from the Inquiry. The NHSBSA can use your personal data to meet its legal obligations. Where we are required to provide evidence to the Inquiry this may include your personal data.
Depending on the questions asked by the Inquiry it could be relevant for us to share sensitive personal data as part of our response, for example, where you were on sick leave. The legal basis for processing any sensitive personal data is that it is necessary for reasons of substantial public interest or to obtain legal advice from our legal support provider.
Your information will not be transferred outside of the UK by the NHSBSA.
Categories and source of personal data
The information we will process for these purposes includes:
- information which identifies you such as your name
- your work-related contact information
- your current contact information for example where you no longer work for the NHSBSA - this could include your home address and personal phone number
- information about your role such as your job title, contract start date and end date
- personal information contained in communications and official documents such as your name and the communications you may have sent or received
The information we share will be based on information the NHSBSA already holds about you from records held. This information may be obtained by asking you to provide it or by searching using eDiscovery. Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence. We may use eDiscovery tools to search for content in mailboxes, OneDrive, SharePoint Online, Microsoft Teams, Microsoft 365 Groups, and Yammer teams and then export the search results. We will limit searches to what is necessary and proportionate by utilising key search terms.
Where necessary, we may need to contact you for further information which may then be shared with the Inquiry.
Keeping your personal information
We will anonymise your personal data from our systems and files 36 months after the end of the Inquiry. Your data may be retained longer where we have another reason to do this for example, where you continue to be an NHSBSA employee. For all staff who leave the NHSBSA, we will initially archive the information contained in your mailboxes, OneDrive, SharePoint Online, Microsoft Teams, Microsoft 365 Groups, and Yammer teams etc. as part of our document preservation. A review will then take place and your accounts deleted where it is not necessary or proportionate to retain them. This decision will be based on how likely it is that information held about you may be relevant to the Inquiry.
Your rights
The information you provided will be managed as required by Data Protection law.
You have the right to:
- receive a copy of the information NHSBSA hold about you
- request your information be changed if you believe it was not correct at the time you provided it
- request that your information be deleted if you believe NHSBSA are processing it for longer than is necessary
- have access to your information restricted when you request your information be changed or use your right to be forgotten in certain circumstances
Find out more about your rights and how we process information.