Guidance

Vaccine Damage Payments Scheme privacy notice

Published 17 December 2021

1. Summary of initiative

The Vaccine Damage Payments Scheme (VDPS) provides a one-off, tax-free lump sum payment to those who are severely disabled as a result of vaccination against diseases listed in the Vaccine Damage Payments Act or legislation made under the Act. Responsibility for vaccine damage payment policy and legislation lies with the Department of Health and Social Care (DHSC), and the scheme became operated and administered by the National Health Service Business Services Authority (NHSBSA) from 1 November 2021. It was previously administered by the Department for Work and Pensions (DWP).

Decisions on claims are based on advice provided by medical assessors with whom NHSBSA contracts for this purpose.

2. Data controller

From 1 November 2021, DHSC and NHSBSA became joint data controllers for the purposes of the Data Protection Act. You should read this privacy notice and the NHSBSA Vaccine Damage Payment Scheme privacy notice.

3. What personal data we collect

Personal data collected for claimants by NHSBSA includes information to identify the claimant, and if necessary, their partner or any named individual provided on the claims form, their contact details, bank account or credit or debit card details to process payment if a claim is successful, and information to support a customer’s claim which includes medical records, national insurance number, and any supporting information the customer may wish to provide in order to support their claim.

4. How we use your data (purposes)

NHSBSA will process personal data for the purpose for which it was collected. The information given will be used to assess, and process a customer’s application, for payment purposes, and also to update customer records where appropriate.

The Department of Health and Social Care may access some of this information in order to help it carry out its policy responsibilities for the Vaccine Damage Payments Scheme.

5. Legal basis for processing personal data

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are that we have:

• your consent (given through a VDPS claim form)
• a vital interest
• the need to perform a task in the public interest or in the exercise of official authority
• a legitimate interest

6. Data processors and other recipients of personal data

DHSC and NHSBSA will jointly monitor the sharing of information between each other and other third parties, to ensure that it is in accordance with data protection principles.

This data might be shared with HM Courts and Tribunals Service, only in the result of an appeal, and the Centre for Health and Disability Assessments, and any other body who may be contracted by NHSBSA in future to conduct medical assessments. Your information may be shared with other organisations if they have a legal right to it.

7. International data transfers and storage location(s)

Data is stored securely and safely through NHSBSA, in the UK.

8. Retention and disposal policy

If a claim is successful, medical records will be retained for 6 years. Notice of payment will be retained for 50 years.

If a claim is turned down before going to medical assessment, the claim form will be retained for 6 years. Notice of claim will be retained indefinitely.

If a claim is turned down after medical assessment, information will be retained until 50 years after the claimant’s date of death, due to the indefinite right of appeal. Notice of claim will be retained indefinitely.

9. How we keep your data secure

Data is securely kept on file at NHSBSA’s secure facilities, and all digital and electronic data is stored and shared securely, with access restrictions in place through password protection. A full data protection impact assessment has been completed.

10. Your rights as a data subject

By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) or the UK Data Protection Act 2018.

You have the right to:

• get copies of information about you that is used
• ask for information about you to be corrected if you think it is wrong
• ask for information about you to be restricted, for example, if you think it is wrong
• object to information being used - this is not an absolute right, we will tell you if we continue to use it
• get information deleted - this is not an absolute right, we will tell you if we cannot delete it

11. Comments or complaints

If you are unhappy or wishing to complain about how personal data is used as part of this programme, contact data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

If you are still not satisfied you can complain to the Information Commissioner’s Office.

Their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

12. Automated decision making or profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

13. Changes to this policy

This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 13 October 2021.