Drug and Alcohol Service privacy notice

We keep this privacy notice under regular review and was last updated in April 2020.

Kent County Council respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

Who we are

We are Kent County Council. Kent County Council (KCC) collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the General Data Protection Regulation (GDPR) which applies across the European Union (including in the United Kingdom) and we are responsible as ‘controller’ of that personal information for the purposes of those laws. Our Data Protection Officer is Benjamin Watts.

Under section 2B of the National Health Service Act 2006, KCC is under a duty to take such steps as it considers appropriate for improving the health of the people in its area.

As part of its response to this duty, KCC commissions specialist drug and alcohol treatment services on behalf of Public Health England (PHE) in Kent. These services offer harm reduction advice, assessments and recovery plans. When individuals present to the service for help and support with their drug and alcohol use, information about them is collected by the drug and alcohol treatment service during the referral, assessment and throughout the course of their treatment. This includes personal information, information about the treatment they receive, drug and alcohol status and health and wellbeing information. If consent is received by service user, this information is shared with PHE via a system called National Drug Treatment Monitoring System (NDTMS) and is kept securely.

Personal information we collect and use

Information collected by us

When an individual presents to drug and alcohol services and throughout their journey, they are asked a series of questions which the services keep as a record of their treatment. The providers of the service are the data controller for this information.

Our contractual arrangements with our service providers ensure that the grounds on which they may collect and process data are clear, there are appropriate arrangements for data security (including a process for dealing with any data breaches) and for the deletion of data when it is no longer required.

Please refer to our providers’ own Privacy Notices via the links below or contact them, if you wish to know more.

If the service user agrees, some partially identifiable information is shared with KCC and PHE via NDTMS. KCC is the data controller for this transfer.  If you do not agree then no data will be shared.

This information includes the following:

  • partially identifiable information (such as initials, first part of postcode, local authority, date of birth, gender, employment status)
  • special category characteristics (such as ethnicity, disability and rating of physical and psychological health)
  • drug and/or alcohol use (such as types of drugs, when last used drugs, quantity of alcohol use, route of administration)
  • assessment and plan information (such as dates of referral and assessment for treatment, pregnancy status, medication, housing need, whether you have children or living with children, Blood-Bourne Virus (BBV) status)
  • criminal justice status (such as prison release, court order and offending behaviour).

KCC and PHE never use NDTMS to collect or store full names and addresses. KCC and PHE never publishes any NDTMS information that could be used to identify individual people. KCC does not share any personal information with PHE, this is done by your provider to the extent described in this notice. The data collected is specified by the PHE guidance on Alcohol and Drug misuse treatment core dataset collection, which can be viewed on the National Government website.

How we use your personal information

On behalf of PHE we use the personal data and other information collected to:

  • monitor how effective drug and alcohol treatment services are
  • plan and develop services that best meet local needs
  • produce statistics and support research about drug and alcohol use and treatment.

Reasons we can collect and use your personal data

The provision of your ‘personal data’ and ‘special categories of personal data’, (such as health, race, ethnicity, sexual orientation) is required from you to enable us to plan and monitor the effectiveness of drug and alcohol treatment services and produce statistics and support research about drug and alcohol use and treatment.

The statutory basis for collecting and processing your personal data

We process your personal data on the basis that ‘processing is necessary for the performance of a task carried out in the public interest’, being a lawful basis allowing us to collect and  use your personal data.

We rely on the “research” exemption under Article 9(2)(j) of GDPR to enable us to collect and process your special categories of personal data in the manner and to the extent described above. We believe this condition is met is necessary for archiving purposes, scientific or historical research purposes or statistical purposes; is carried out in accordance with Article 89(1) of the GDPR (as supplemented by section 19) and is in the public interest. .

We also rely on  the Article 9(2)(h) to enable us to collect and process your special categories of personal data in the manner and to the extent described above. We believe that the processing is necessary  for “health and social care purposes” being the management of health care systems or services or social care systems or services, in circumstances where those involved with collecting data and processing same are under a duty of confidentiality imposed by law.

Although we have a statutory basis for collecting and sending some of your personal data to Public Health England if you do not consent to the sharing of personal data we and our providers will not do so and this will not affect the service you receive from the Drug and Alcohol Service.

How long your personal data will be kept

We will hold your personal information for 5 years from the last involvement with drug and alcohol services before being securely destroyed

Who our providers share your personal information with

We routinely share through the contractual arrangement with our providers:

  • partially identifiable information (such as initials, first part of postcode, local authority, date of birth, gender, employment status)
  • anonymised special category characteristics (such as ethnicity, disability and rating of physical and psychological health)
  • anonymised drug and/or alcohol use (such as types of drugs, when last used drugs, quantity of alcohol use, route of administration)
  • anonymised assessment and plan information (such as dates of referral and assessment for treatment, pregnancy status, medication, housing need, whether you have children or living with children, Blood-Bourne Virus (BBV) status)
  • anonymised criminal justice status (such as Prison release, court order and offending behaviour)

This information is shared with Public Health England via a system called National Drug Treatment Monitoring System (NDTMS) and is kept securely.

View Public Health England’s privacy notice.

Your rights

Under GDPR you have rights which you can exercise free of charge which allow you to:

  • know what we are doing with your information and why we are doing it
  • ask to see what information we hold about you (subject access request)
  • ask us to correct any mistakes in the information we hold about you
  • object to direct marketing
  • make a complaint to the Information Commissioner's Office

Depending on our reason for using your information you may also be entitled to:

  • ask us to delete information we hold about you
  • have your information transferred electronically to yourself or to another organisation
  • object to decisions being made that significantly affect you
  • object to how we are using your information
  • stop us using your information in certain ways

We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note, your request may delay or prevent us delivering a service to you.

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner's Office (ICO) on individuals’ rights under GDPR.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Contact

Please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk, or write to: Data Protection Officer, Sessions House, Maidstone, Kent ME14 1XQ.

GDPR also gives you right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted on 03031 231113.

Read our corporate privacy statement.