This privacy notice covers the Vaccine Damage Payment Scheme (VDPS), delivered by Strategic Policy, Planning and Performance, a division of the Cabinet Office in the Government of Jersey..
Strategic Policy, Planning and Performance is registered as a 'Controller' under the Data Protection (Jersey) Law 2018 (the “Data Protection Law”), as we determine the purpose and means of the processing of the personal information collected about you for this service.
The Vaccine Damages Payment Scheme (VDPS), administered by the NHS Business Services Authority (NHSBSA) is a ‘Processor’ under the Data Protection (Jersey) Law 2018 and will carry out data processing on behalf of the Government of Jersey to deliver the scheme.
Strategic Policy, Planning and Performance generally processes and holds your information in order to provide public services and meet our statutory obligations. This notice explains in more detail how we use and share your information in order to provide the service described above.
Find information on how the Department uses your personal data for other services on the
States of Jersey privacy policies.
We will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.
How we collect information about you
The Government of Jersey
Information about you will, in most cases, be collected directly from you. The types of personal data collected will vary depending on what information you volunteer and the information we need in each circumstance.
For the purposes of the scheme, the Government of Jersey will collect the following information about you:
- contact details provided by you or your representative on your claim form
- any information you or your representative provides to us regarding your claim
- a medical assessment report provided by an independent medical assessor, following your application to the VDPS
- financial information. In the event that your claim is awarded, we will request bank details from you in order to make payment
- identity documents. Prior to making payment, we will perform an identity check by requesting a copy of your passport or driving license and a recent utility bill
- voluntary information, such as unsolicited information you may provide to us when you engage with us
In some cases, we may collect information about you from another Government of Jersey department or from the following third parties in order to deliver our duties.
NHS Business Services Authority (NHSBSA)
The VDPS, administered by the NHSBSA, will collect the following types of information on behalf of Government of Jersey:
- contact details provided on your claim form, such as name, address, phone number, email address and social security number, as well as preferred means of contact
- medical conditions and full medical history, provided in a medical assessment report written by an independent medical assessor
- voluntary information, such as unsolicited information you may provide to us when you engage with us
How we will use the information about you
We need to collect and hold information about you, in order to carry out the public functions of Strategic Policy, Planning and Performance. Our legal basis for processing personal data in this case is public functions (Schedule 2 para 13 of the Data Protection Law).
We have set out in further detail below why we use your personal data in each instance.
Data is collected in order to communicate with scheme applicants and make a fair, informed decision whether to uphold their claim. Data is processed on the legal basis of Public Functions.
| Contact details such as name, address, phone number, email address and social security number, as well as preferred means of contact | To update you about your claim and the complaints process, and to verify your identity in the event that your claim is awarded. If you are claiming on behalf of someone else, the NHSBSA will use the contact details provided on the application form to verify with Jersey's Probate Registry that you manage that person's affairs, as evidenced by a document such as a grant of probate. Note that these documents held by the Registry are available to the public. The application form will also ask for your JY number. Once your application is received, the NHSBSA will use the JY number to verify with the Government of Jersey's Public Health Team that you received the relevant vaccination in Jersey. | Public Functions: The processing is necessary for a) the administration of justice; b) the exercise of any functions conferred on any person by or under an enactment; or c) the exercise of any functions of the States or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, Part 2, paragraph 13)
|
|---|
| Medical records | In order to assess your claim, the NHSBSA will request medical records from the providers you list on the claim form. | Public Functions: The processing is necessary for a) the administration of justice; b) the exercise of any functions conferred on any person by or under an enactment; or c) the exercise of any functions of the States or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, Part 2, paragraph 13) |
|---|
High level information regarding your health, provided in a medical assessment by the VDPS | To make an informed, fair decision about your claim. The Government of Jersey will make a decision based on the findings in the independent medical assessor's report. | Public Functions: The processing is necessary for a) the administration of justice; b) the exercise of any functions conferred on any person by or under an enactment; or c) the exercise of any functions of the States or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, Part 2, paragraph 13) |
|---|
| Financial information, bank details | In the event that your claim is awarded, the Government of Jersey will request bank details from you in order to make payment. | Public Functions: The processing is necessary for a) the administration of justice; b) the exercise of any functions conferred on any person by or under an enactment; or c) the exercise of any functions of the States or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, Part 2, paragraph 13) |
|---|
| Identity documents, such as passport or driving license and a recent utility bill | Prior to payment, we will verify your identity by requesting a copy of your passport or driving license and a recent utility bill. | Public Functions: The processing is necessary for a) the administration of justice; b) the exercise of any functions conferred on any person by or under an enactment; or c) the exercise of any functions of the States or any public authority (Data Protection (Jersey) Law 2018, Schedule 2, Part 2, paragraph 13) |
|---|
Who we may share your personal information with
Other data controllers
We may need to pass your information to the following Government of Jersey Departments or the following organisations for the purposes stated above:
- Public Health directorate within Strategic Policy, Planning and Performance (SPPP) The NHSBSA will contact Public Health to verify that you received your vaccination in Jersey, using your JY number for reference
- Law Officers’ Department (LOD), the Government of Jersey may seek advice on your claim in cases where there is legal challenge, using your contact details and the medical report for reference
- the Jersey Probate Registry, if you are applying on behalf of someone else, you must be managing their estate to apply. Once the NHSBSA has received your application, the VDPS will contact the Probate Registry to validate this against their records, using your name and date of birth as reference
We may also disclose information to other public authorities where it is necessary, either to comply with a legal obligation, or where required under other legislation. Examples of this include, but are not limited to:
- where the disclosure is necessary for the purposes of the prevention or detection of crime
- for national security purposes
- for the purposes of meeting statutory obligations
- to prevent risk of harm to an individual
In some instances, this data sharing may require us to transfer your personal data outside Jersey, the UK and the EEA, however, we shall only do this with the necessary safeguards in place and where it is lawful because it is necessary and proportionate for the proper discharge of our statutory functions.
Service providers
The Government of Jersey will:
- receive medical reports from the independent medical assessor, following your application via the VDPS website
- communicate outcome of the claim and share the medical report with you
- communicate the outcome of an appeal or ‘mandatory reversal’
- if your claim is awarded, verify your identity by requesting a copy of your passport or driving license and a recent utility bill
- request bank details from you and make payment where a claim is awarded
- deal with queries regarding scheme policy, as well as subject access requests (SARs) and freedom of information requests (FOIs)
Your personal data will be processed on our behalf by the NHSBSA so that they can provide services to us. We have strict contracts in place with service providers to ensure they process your data only on our instructions and with appropriate security in place. The categories of third parties who may receive your personal data in order to provide us with a service are email and data storage providers (Microsoft and Egress email encryption).
The NHSBSA will:
- receive applications via the VDPS website
- verify that you received the vaccination in Jersey with the Government of Jersey’s Public Health Team, using the JY number provided on the application form as reference
- request medical records from healthcare providers listed on the application form and manage administration costs from healthcare providers
- compile a chronology of your records and share this with the independent medical assessor for review
- receive the medical report from the independent medical assessor and share this with the Government of Jersey
- detect and prevent fraud and mistakes
The NHSBSA will use the information you provide to:
- process your application
- progress your claim to an independent medical assessor
After the VDPS receives your completed claim form, they will check to make sure that you are eligible to apply for a Vaccine Damage Payment by verifying with the Government of Jersey’s Public Health directorate that you received the vaccination in Jersey on or after 1 December 2020, using the JY number on the application form for reference. If you meet the eligibility criteria, they will contact the healthcare providers you or your representative listed on the application form for copies of your full medical records.
This could include, where appropriate:
- GP notes and medical history
- hospital notes
- information from other healthcare providers that have provided treatment relevant to your claim
The NHSBSA work with your healthcare providers to get copies of your full medical records as quickly as possible. You do not need to request medical records yourself.
After the NHSBSA receive your full medical records, they will prepare your claim and send it to an independent, third-party medical assessor (a doctor registered with the General Medical Council), who will assess your claim based on the VDPS’ standard criteria and produce a medical report. This report will be sent to the Government of Jersey. The Government of Jersey’s Medical Officer for Health will make a decision to uphold your claim based on the findings in the report.
The Government of Jersey will communicate the outcome of your claim to you and request bank details from you if your claim is awarded.
Confidential patient information
When necessary, the NHSBSA will only share information that can identify you with those:
- directly involved in reviewing and processing your claim
- with a legal right to it
- who you have given us permission to share with
How long do we store the information about you
The Government of Jersey will retain your data in line with
Strategic Policy, Planning and Performance’s retention schedule.
The NHSBSA will retain your personal data for no longer than is necessary for the purpose for which it was obtained. The retention period is dependent upon the outcome of your application.
- if a claim is rejected without medical records being assessed, the claims form will be retained for 6 years
- if your claim is successful, medical records will be retained for 6 years
- anonymised information will be retained for planning and information purposes such as dates, vaccine administered, medical condition(s) and decision made
At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.
Where do we store the information about you
Government of Jersey systems store data in Jersey, the UK and the European Union. The UK has been granted adequacy status by the European Commission and personal data stored there will be protected to the same standards as personal data held in Jersey and the EU.
Statutory or contractual obligations to provide personal data
You are not obliged by any law or contract to provide us with your personal data. However, if you choose not to provide certain information when requested, we may not be able to perform the service you have requested, or we may be prevented from complying with our legal obligation.
Your rights
Please see the Government of Jersey website
your personal data right for details of your rights under the Data Protection Law and how to exercise them.
Withdrawal of application
You can withdraw your application at any time by emailing
vaccinedamages@gov.je.
Complaints
If you have an enquiry or concern regarding processing your personal data you can contact SPPP’s Data Governance Officer at
r.young3@gov.je.
If you wish to make a complaint about how your personal data is processed, you can contact the Government’s Data Protection Officer at
DPO@gov.je.
If you believe that Strategic Policy, Planning and Performance has contravened the Data Protection Law and the contravention affects your data protection rights, you have the right to make a complaint at any time to the
Jersey Office of the Information Commissioner (JOIC).
We would, however, appreciate the chance to deal with your concerns before you approach the JOIC, so please contact us in the first instance.
Changes to this notice
We may, from time to time, revise this privacy to ensure it remains up to date. It is advisable to check it regularly to keep aware of any changes.
gov.je