In response to the ongoing Covid-19 pandemic, Ceredigion County Council is required to carry out a wide array of processing of personal data in order to meet its general obligations as a local authority, its particular public health obligations and obligations imposed upon it in respect of legislation passed by central government. This privacy notice is designed to give a general overview of the broad range of processing operations made necessary by the Authority’s duty to respond to the pandemic. Links to more specific information provided by external stakeholders is provided at the end of the notice.

Processing of personal data may be necessary for the following purposes:

  • Understanding Covid-19 and risks to public health, and controlling and preventing the spread of Covid-19


  • Identifying and understanding information about individuals with Covid-19 or those at risk of developing Covid-19


  • Provision of services relating to testing and diagnosis of Covid-19 as well as processing related to Covid-19 related interventions


  • Processing in respect of Covid-19-related access to health and social care services by data subjects.


  • Provision of relevant information to the public


  • Provision of support and delivery of programmes of assistance for those affected by Coronavirus (for example self-isolation payments and supplementary payments to carers)


  • Evaluation and management of the Authority’s response to the pandemic


  • Research and planning in relation to Covid-19.


The lawful basis for the processing is:


Performance of a task in the public interest or in the exercise of official authority

Compliance with a legal obligation

In specific circumstances processing may be necessary in the vital interests of the data subject.


Where special category data is processed, the lawful basis shall be:


UK GDPR Article 9(2)(g) substantial public interest

UK GDPR Article 9(2)(h) the provision of health or social care treatment or the management of health or social care systems or services

UK GDPR Article 9 (2)(i) protection of public health

UK GDPR Article 9 (2)(j) analysis of information for statistical purposes


Where required the substantial public interest processing condition shall be:


Statutory and government purposes


The enactments or rules of law relied upon are:


  • Public Health (Control of Disease) Act 1984
  • The Health Service (Control of Patient Information) Regulations 2002
  • Coronavirus Act 2020
  • The Health Protection (Coronavirus Restrictions) (Wales) Regulations 2020

We may collect the following types of personal data about you to deliver these services, depending on your circumstances:


Unique reference numbers;

Telephone number;

Email address;

Bank/payment details;

Your family composition including household contacts;

Your social circumstances;

Your financial circumstances;

Employment and education details;

Information about your health;

Your information will not be transferred outside the United Kingdom.

We may share your information with the following recipients depending on your circumstances:


Hywel Dda University Health Board

Other local authorities

Welsh Government

Third Sector Organisations (for example, General Practitioners)

Public Health Wales

NHS Digital

NHS England

Relevant local authority departments within Ceredigion County Council if specifically required

 There are also other specific situations where we may be required to disclose information about you, such as:

  • Where the Council is required to provide the information by law:
    • Where disclosing the information is required to prevent or detect a crime
    • Where disclosure is in the vital interests of the person concerned