Information about patients’ coronavirus (COVID-19) status may be shared with NHS and other partners involved in their care and treatment, along with:
*Public Health Wales
*The Department of Health
*The Police Force
*Other government departments where it is legally required, or where it is necessary for the protection of public health or management of the outbreak
The lawful basis is GDPR Article 6(1)(c), compliance with a legal obligation, or Article 6(1)(e), that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (the provision of statutory health care services).
The exemptions in GDPR Article 9(2)(h) and 9(2)(i) will be applied, that processing is necessary for matters of substantial public interest or for the management of health care systems.
The conditions in paragraphs 2 (management of health care systems), 3 (public health) and 6 (statutory and government purposes) of schedule 1 of the Data Protection Act 2018 are also engaged.
For more information please contact BCU.DPO@wales.nhs.uk