Public Health's privacy notice

​​​​​​​​​​​​​​​​​​​​​Introduction

This privacy notice covers the Public Health directorate which sits within Strategic Policy, Planning and Performance, a division of the Cabinet Office.

Strategic Policy, Planning and Performance is registered as a 'Controller' under the Data Protection (Jersey) Law 2018 (the “Data Protection Law”), as we determine the purpose and means of the processing of the personal information collected about you for this service.

About Public Health

Public Health refers to services designed to help the population stay healthy and avoid disease. This covers a range of policy areas, including: 

• promoting population health through encouraging good nutrition, regular physical activity and wellbeing 
  
• reducing preventable disease, including delivering vaccinations
• responding to health protection incidents
  

The Public Health directorate is also responsible for delivering several services directly to the public and commissioning other providers to deliver services on behalf of public health. This includes, but is not limited to, school age vaccinations and interventions which support healthy approaches to food and nutrition in schools.

​The information collected by us allows us to: 

• understand more about the nature and causes of disease and ill health in Jersey by measuring the health, mortality, and care needs of the population, as well as diseases and our way of life 
• protect against onward transmission of infectious or notifiable diseases or infectious agents
• deliver safe services, by understanding previous history and contraindications* prior to delivering services (*situations where a medicine, should not be used because it may be harmful to individuals in specific circumstances)​
  
• explore and understand Islanders’ opinions and perspectives on a variety of different public health issues
• plan and evaluate services, and to undertake ‘Public Health surveillance’ to ensure that services and interventions are effective and working for the benefit of the population by improving or protecting public health
  

​​​As a government directorate, we process and hold your information to provide these public services and meet our statutory obligations. This notice explains in more detail how we use and share your information so that we can provide our services or interventions. ​

For information on how the wider Strategic Policy, Planning and Performance directorate uses your personal data for other services go to States of Jersey privacy policies. 

Public Health will continually review and update this privacy notice to reflect changes in our services and feedback from our service users, as well as to comply with changes in the law.​

How we collect information about you​

Information about you will, in most cases, be collected directly from you. 

This may be done by:

• ​​collecting your responses to voluntary surveys either on paper, online (this may also include your IP address), in person or by telephone, or through government systems and other departmental administrative sources that capture and record personal information
• collecting your communications with us through audio files, video recordings, online forms, written notes, letters, or social media, for example, your view of health and wellbeing in Jersey
• ​​collecting information in person when you receive services, for example, your consent and any history of potential adverse ​reactions to vaccinations
• recording clinical information when you receive services, for example, vaccination history
• collecting qualitative (non-numerical) data though observations, interviews, focus groups, surveys, and secondary research (for example, text, video, and audio)
• taking anthropometric measurements as part of our school and family food and nutrition services 
• collecting self-reported information and information which has been recorded on a ‘wearable fitness tracker’ from those enrolled in the family and school nutrition programmes 
• accessing Primary Care data relating to those that have been clinically coded as high risk and receiving information from Customer and Local Services (CLS) regarding vaccine eligibility, as appropriate
• accessing information from Health & Community Services (HCS), including information held in the MAXIMS Electronic Patient Record, for example, on relevant medical history, safeguarding issues, vaccine eligibility, and cancer registration data. This includes Hospital Episode data (HES) and Secondary Uses Service data (SUS) which cover when a patient is treated in hospital
• accessing details on births and deaths events that occur and are then registered in Jersey
• accessing extracts as a snapshot in time from the Primary Care Registration database concerning registered patients of Jersey Health and Care system
• receiving information on the heights and weights of pupils from the Jersey Child Measurement Programme (JCMP)
• collating online and paper application forms for referrals to programmes and/or services delivered by Public Health
• capturing data (on a paper form) for every termination of pregnancy conducted in Jersey. Note: registered Medical Practitioners are legally required to notify the Chief Medical Officer (CMO) of this information
• capturing and collating health protection data in the event of an outbreak
• the Child Health Team updates the Health Information system with any developmental checks, immunisations, check-ups, or appointments
• receiving written submissions from affected Islanders wishing to give evidence about health symptoms or conditions they attribute to their PFAS exposure, or evidence relating to their experience. The information will be seen only by the PFAS Panel members and the minimum number of government officials
• collating information regarding self-reporting of illness and test results through online forms on gov.je

• receiving information from other Government of Jersey departments to fulfil international obligations under the Framework Convention on Tobacco Control
  

​Types of information we collect​

The types of personal data collected will vary depending on what information you provide and the information we need in each circumstance. 

We do not collect or process all this personal data for all people all the time. We only collect and process the personal data that is necessary for a particular task that is being carried out.

We commit to using pseudonymised or anonymised information as much as is practical, and in many cases, this will be always be our default position.

Pseudonymisation is a procedure by which data that could identify you is replaced by a fictitious reference. For example, your name could be replaced by a code number, rendering the data record less identifying.

Anonymisation is the process of removing identifying particulars or details from a record for statistical or other purposes.

Below are listed the most common categories of information Public Health may collect about you:

• name and unique identifier, age or date of birth, date of death, gender, address, post code, telephone number, email address, Social Security number
• demographic data such as ethnicity, and preferred language
• religious or other beliefs of a similar nature
• sexual orientation
• disabilities, including learning difficulties
• family and household details such as household makeup, house type, landlord information, vehicle registration number
• employment details, such as employment status, workplace (including location), role, hours worked
• income, whether it is a pension, benefits or salary
• health information, which may include self-perception of health, symptoms and medical diagnoses, medical conditions, allergen information, mental wellbeing and self-esteem
• information on contagious diseases in animals liable to spread to humans
• GP name and address
• information relating to prescriptions containing controlled drugs and the supply of controlled drugs on prescriptions
• information relating to a person whom a doctor considers, or has reasonable grounds to suspect, is addicted to such controlled drugs
• health risk factors such as height and weight, smoking habits and alcohol consumption, records of the food eaten, physical activities undertaken
• contact with animals, contact with other people
• names of organisations which those enrolled in Public Health programmes are associated with, such as their school
• diet, meal preferences, physical activity and food-related behaviours
• weight, height, BMI, waist-to-height ratio, body fat %, muscle mass- kg, BMI z score, BMI centile, visceral fat rating and details about physical activity including data from Smart Activity Trackers and pedometers
• planning, spending, perceptions, and decision-making
• facilitators and barriers to healthy living
• Hospital Episode Statistics (HES) data, including admissions, outpatient appointments, maternity data, and A&E attendances at hospitals
• infectious disease reporting, including symptoms, test status, result status, contacts, potential sources of infection
• self-testing results, for programmes delivered by Public Health
• environmental contaminant exposure (including PFAS), which may include symptoms, morbidities, testing status, result status, affected addresses, potential sources of exposure
• data relating to deaths - cause and circumstances of death, name of death certifier, name of Coroner, Certificates of Registration of Deaths, Certificates of Medical Attendants and Applications for Cremation, details to enable cremation and repatriation if required. Deaths of individuals using drug and alcohol services, including the cause of death and any substances involved. Death by suicide, including the method and location. Deaths and cause of death for children or young people aged under 18
  
• information relating to the storage, removal and use of the body, or relevant material from the body of a deceased person for transplantation, teaching of anatomy, medical education or research and therapeutic purposes; certificate of interment or cremation of such body 
• data relating to births - birth registration, birth weight, country of birth, live births and stillbirths by sex, live births outside marriage or civil partnership, age of mother, live births to non-Jersey born mothers, caesarean delivery, preterm birth, infant mortality
• termination of pregnancy data, including Certificates of Termination of pregnancy, name of practitioner, grounds (opinion for the commencement of treatment), date of birth, gestation, parity, method, complications, sterilisation, or deaths
• child health and maternity data, including smoking cessation in maternity, screening and immunisation uptake and wider health outcomes
• cancer type, gender, age band at diagnosis 
• vaccination uptake and coverage
• requests from any master of the ship regarding the supply of controlled drugs to that ship, and a report of the supply of any controlled drug; any prescription record maintained by a doctor, dentist or nurse independent prescriber
• confirmed and suspected cases of food poisoning
• specific diseases among persons living or working in or about the premises on which the ice-cream is manufactured, stored or sold
• individuals suffering from, or carrying, typhoid, paratyphoid or any other salmonella infection or dysentery or any staphylococcal infection likely to cause food poisoning
  
• any person, or anyone in their household, having access to milk or to churns or other milk receptacles in or about any dairy farm or dairy, who has or has had a notifiable disease liable to case infection to milk
  
• any persons, who have been given leave to enter Jersey, who an immigration officer believes should submit to a test or examination as the MOH may require
  
• insights from Islanders in a number of formats about preferences, questions. addressing knowledge, attitudes or intentions regarding behaviours and activity
  
• information to deal with enquires or to investigate a complaint. This may also include information that is received from third parties, for example, the Police, Environmental agencies, government departments, landlords or medical information if investigating an accident, health incident, food poisoning or an infectious disease case, situation or outbreak,​ any voluntary information you may provide to Public Health when you engage with us
  

How we use your information

We need to collect and hold information about you from a diverse number of sources, to conduct our Public Health functions. Our legal basis for processing personal data in most cases is that it is necessary for the exercise of the Public Health function of the States or any public authority (Schedule 2 para 4(c) of the Data Protection Law).​

Special category data (such as information about your health) will be only processed on the basis that it is necessary to inform the provision of health or social care or treatment, the management of health or social care systems or to develop services to protect the population’s health and wellbeing. This may include: 

• vaccination data
• prevention measures
• health promotion services
• responses to emergency situations
  

This data could also be used in an anonymised form for reasons of public interest, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

We have set out in further detail below why we use your personal data in each instance.

​

Who we share your personal information with

Other Data Controllers

We only share personal identifiable data if it becomes necessary, and will only do so if:

• ​you have provided your consent to do so 
• there is a legal requirement to do so
• there is need to protect children and vulnerable adults (safeguarding)
• there is need to protect the health and safety of others, for example reporting an infectious or notifiable disease or infectious agents
  

In some instances, this data sharing may require us to transfer your personal data outside Jersey, however, we will only do this with the necessary safeguards in place and where it is lawful, because it is necessary and proportionate for the proper discharge of our statutory functions.

Your personal data may be processed on our behalf by certain third parties who provide services to us. Public Health have strict contracts in place with these service providers to ensure they process your data only on our instructions and with appropriate security in place.

We may need to pass your information to other Government of Jersey Departments or the following organisations for the purposes stated above:

• ​the UK Health Security Agency (UKHSA).Office for National Statistics (ONS)
• World Health Organization (WHO)
• National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH)
• MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn, and Infant clinical Outcome Review
• Public Health England National Cancer Registration who collects data on all cases of cancer that occur in people living in Jersey. The data is used to support public health, healthcare, and research. They provide Public Health Jersey with data on new cases of cancer and cancer survival, monitor new cases of cancer in the population and look at trends and geographical patterns so that risk factors and cancer clusters can be detected. Individual patients are not identified using this data, as it is used at a population level only
• UK Government Actuary’s Department
• Family Nursing and Home Care
• HCS (via the MAXIMS Electronic Patient Record)
• Child and Adolescent Mental Health Service (CAMHS)
• Social Services 
• Schools
• JerseySport.com
• Primary Care – GP surgeries and Primary Care doctors (also known as General Practitioners or family doctors) 
• Community pharmacies
• SmartSurvey
• Citizen Space (Delib)
• PFAS Scientific Advisory Panel
• Microsoft Corporation (Office Applications, Cloud, Forms)
• Anonymised statistical information may be published on the Government of Jersey website and through other media.

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.

Data held by us will not be used to make automated decisions. 

​Service Providers

Your personal data may be processed on our behalf by certain third parties who provide services to us. Public Health have strict contracts in place with these service providers to ensure they process your data only on our instructions and with appropriate security in place.

The third parties who may receive your personal data to provide us with a service are:

• ​Office for National Statistics who clinically code Jersey mortality data
• National Confidential Inquiry into Suicide and Safety in Mental Health (NCISH), a project collecting in-depth information on all suicides in the UK
• MBRRACE - the collaboration appointed by the Healthcare Quality Improvement Partnership (HQIP) to run the national Maternal, Newborn, and Infant clinical Outcome Review Programme (MNI-CORP) which continues the national programme of work conducting surveillance and investigating the causes of maternal deaths, stillbirths, and infant deaths
• Public Health England National Cancer Registration and Analysis Service
• Family Nursing and Home Care who deliver the Jersey Child Measurement Programme
• JerseySport.com who deliver the Family, Food and Fitness Programme in partnership with Public Health
• Primary Care – GP Practices for immunisations
• Community Pharmacies for immunisations
• Smart Survey, a digital survey solution that helps anyone create surveys, build questionnaires, and analyse the results
• Citizen Space (Delib), an online engagement and consultation platform, used to design, publish, analyse, and feedback

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.

Data held by Public Health will not be used to make automated decisions. 

Publication of your information​

We publish a series of population-level reports according to a pre-announced publication schedule. 

We will only publish information in a form that does not identify individuals or households.

We will only publish data which has been aggregated (grouped), routinely suppressing (hiding) numbers fewer than five and ensuring that such figures cannot be obtained by differencing (adding and subtracting other figures to work out the missing one).

Records will not be linked in different datasets, for example, hospital and mortality files, unless given express permission to do so.

For Consultation exercises Public Health may publish a summary of responses. This will not include any personal data.

Anonymised statistical information may be published on the Government of Jersey website and through other media where relevant.

We may need to publish your information:

• ​where we are required by law to publicise certain information
• ​in the interests of demonstrating a fair and transparent decision-making process
• where we are required to provide statistical information about a group of people, although your data will be anonymised to protect your identity

Where you have responded to a public consultation, your comments will be anonymised to protect your identity where your contribution is made in a private capacity. However, if you have responded on behalf of an organisation then the views and connection with the organisation may be attributed.​

Where you have contributed content to the website or Government of Jersey social media channels, your identity may be publicly available e.g. if you have publicly posted on gov.je using your own profile or account.​

We will not publish any of your sensitive personal information unless there is a requirement for us to do so to carry out our statutory functions.

All of our publications are available on gov.je. 

How long we store your information

Statistical information usually relates to a particular point in time so does not need to be updated. 

We will only keep your information for as long as is necessary. This will depend on what the specifics of the information is and the agreed retention period. The data is permanently disposed of after its retention period, in line with the our records retention policy or the specific requirements of the relevant data sharing agreement. 

These arrangements are regularly reviewed as part of our Information Governance responsibilities.

Where we store your information

Government of Jersey systems store data in Jersey, the UK, and the European Union. The UK has been granted adequacy status by the European Commission and personal data stored there will be protected to the same standards as personal data held in Jersey and the EU. 

Personal confidential data will only be processed by Public Health employees in fulfilment of their public health functions. All staff have contractual obligations of confidentiality and must complete training in Information Governance. Amongst other things, this training makes them understand the importance of confidentiality and security of your personal data and makes clear that they are personally responsible for the security of any information which they are processing. The expectations on staff are set out in the Information Governance Policy.

​Relevant organisational and technical measures are taken to ensure the information held is secure, such as: 

• ​using secure locations
• restricting access to authorised personnel
• protecting personal and confidential information held on computers with encryption

Personal confidential information is only exchanged using secure methods, such as encrypted email or through secure encrypted data file transfers (SEFT). 

Where practical, we will anonymise your data. In this case, it will cease to be personal data and may be retained indefinitely.

Participant data is captured during qualitative interviews. Any personally identifiable information will be redacted from the recording or transcript before being passed to anyone outside the department. This extends to ensuring that no visual personal information from the environment is picked up on photos, or video..

All data storage is encrypted and secure. Access is limited to password holders and scheduled to end on a specified date. The location of all data relating to individual participants is required to be logged, and a deletion date set, including emails arranging the face-to-face interviews or focus groups.

Analysts may utilise Nvivo, a qualitative data analysis (QDA) computer software package. NVivo helps organise, analyse, and find insights in unstructured or qualitative data like interviews, open-ended survey responses, journal articles, social media, and web content, where deep levels of analysis on small or large volumes of data are required. 

All identifiable, pseudonymised and sensitive datasets from this software are stored electronically on secure Government of Jersey servers which can only be accessed by public health professionals.

SmartSurvey servers are based in the UK. No one will access your data unless they have the credentials to access your account, Public Health publish the data, or SmartSurvey staff for the purposes of providing support or fixing a technical issue. SmartSurvey staff are all UK based.

Citizen Space (Delib) servers are based in the UK and the European Economic Area (EEA). This site is managed by the controlling organisation (Government of Jersey). 

When you access and use this site, the personal information you have submitted to these activities will go to the organisation. Delib will not access personal information unless requested to do so by the organisation, and only for the purposes of assisting them with the administration of this site.

The information provided by your computer when you use this website is collected by Delib. For example, your: 

• ​browser type
• IP address
• language preference
• referring site and the date and time

The purpose for collecting this information is to maintain the security of the website and for operating and improving the software.

Cookies and gov.je

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. 

You can find more information on Cookies policy​.

Statutory or contractual obligations to provide personal data

Public Health are responsible for planning, preventing, and responding to external health threats. Personal information is collected to fulfil the remit from the Government of Jersey, including the statutory functions of Public Health.

The main purposes for processing personal information are to:​

• ​prevent, by anticipating threats to health and help build Jerseys readiness, defences and health security
• detect, by using environmental and biological surveillance to proactively detect and monitor infectious diseases and threats to health
• analyse, by using data analytics to assess and continually monitor threats to health, identifying how best to control and mitigate the risks
• respond, by taking rapid, collaborative, and effective actions nationally and locally to mitigate threats to health when they materialise
• lead, by leading partnerships designed to save lives, protect Jersey from public health threats, and reduce inequalities

In addition, we are responsible for the delivery directly (or indirectly) of a range of services to the public including: 

Public Health collect personal information in 3 main ways:

• ​directly from you
• from the providers of health and care services
• from other organisations supporting the health and care system in Jersey
  

We may also collect information from other organisations if this is necessary and proportionate to enable us to fulfil our funtions.

There will be times when we need to collect your personal information. If this is necessary, we will only use the minimum we need.

Your rights​

You can find information on the details of your rights under the Data Protection Law and how to exercise them on the Your personal data rights webpage. 

Withdrawal of consent

You have the right to withdraw consent for any personal data that is collected by Public Health by contacting the government as detailed below. Alternatively, you have the right to request that your personal confidential information is not used beyond your own care and treatment and withdraw consent (opt-out) to the processing or sharing of your information with others, unless there is a legal reason that requires otherwise. 

You can withdraw your consent by contacting our Data Protection Officer at publichealth@gov.je

Complaints

If you have an enquiry or concern regarding processing your personal data you can contact publichealth@gov.je or alternatively the Data Governance Officer at SP3PH-DP@gov.je​

If you wish to make a complaint about how your personal data is processed, you can contact the Government of Jersey Data Protection Officer at DPO@gov.je.

If you believe that Public Health has contravened the Data Protection Law and the contravention affects your data protection rights, you have the right to make a complaint at any time to the Jersey Office of the Information Commissioner (JOIC)​. 

We would, however, appreciate the chance to deal with your concerns before you approach the JOIC, so contact us in the first instance.

Changes to this notice​

​We may, from time to time, revise this privacy to ensure it remains up to date. It is advisable to check it regularly to keep aware of any changes.

This version was last updated on 04/09/2024