Privacy Notice - Employee

This privacy notice outlines for employees, workers and contractors the personal data that the Council proposes to hold relating to them, how they can expect their personal data to be processed and for what purposes.

The Council collects and processes personal data relating to its employees and workers to manage the employment relationship.  The Council collects and processes personal data relating to contractors to manage the contract for services.  The Council is committed to protecting the privacy and security of your personal information and being transparent about how it collects and uses that data and to meeting its data protection obligations. The Data will be:

  • used lawfully, fairly and in a transparent way;
  • collected only for valid purposes and not be used in a way that is incompatible with those purposes;
  • accurate and amended on request;
  • held securely;
  • kept as long as necessary and for the purposes we have told you about.

The Council is responsible for how we hold and use personal information about you.  We are required under data protection legislation to notify you of the information contained in this privacy notice.  The notice applies to current and former employees, workers and contractors.  This notice does not form part of any contract of employment or other contract to provide services.  We may update this notice at any time and you will be informed it has been updated as soon as is reasonably practical.

What personal information does the Council collect to manage the employment relationship?

Personal information means any information about an individual from which that person can be identified.  It does not include data where the identity has been removed (anonymised).  There are special categories of more sensitive personal data which require a higher level of protection, such as information about a person’s health, sexual orientation or criminal convictions.

The Council collects and processes a range of personal information about you. This includes:

  • your name, title, address and contact details, including personal email address and telephone number, date of birth and gender;
  • information about your marital status, next of kin, dependants and emergency contacts;
  • recruitment information including your application form, CV, references, copy of qualification certificates;
  • start and end dates, with previous employers and with the Council;
  • information about your nationality and entitlement to work in the UK;
  • the terms and conditions of your employment;
  • information about your salary, annual leave, pension and benefits information:
  • details of your bank account, national insurance number, payroll records and tax status information;
  • Details of your vehicle and number plate, copy of driving licence, MOT certificate and vehicle insurance, and the Council will carry out periodic driving licence checks as necessary if you drive on behalf of the Council.
  • employment records, including job titles, work history, working hours, remuneration, training records and professional membership;
  • details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
  • details of any disciplinary, capability or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
  • assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
  • CCTV footage and other information obtained through electronic monitoring such as vehicle trackers;
  • photographs;
  • termination of employment information including reasons and related correspondence for your contract with the council coming to an end;
  • results of HMRC employment status check, details of the intermediary through which you are employed or your services are supplied.

The Council also collect and processes more sensitive personal information about you. This may include:

  • equal opportunities monitoring information, including information about your race or ethnic origin, sexual orientation, religion or belief.
  • information about medical or health conditions, including whether or not you have a disability for which the Council needs to make reasonable adjustments;
  • occupational health referrals and reports, sickness meetings and formal reviews including sickness improvement plans and related correspondence;
  • where you leave the Council and the reason is related to your health, information about the condition and any information relating to ill-health retirement;
  • details of absence from work including time on maternity, paternity or parental leave and sick leave.  
  • information about any criminal record and DBS / Disclosure Scotland checks;
  • details of trade union membership and information relating to days you are absent due to being on strike; and
  • bio-metric data - a few employees use a biometric clocking in and out system.

The Council collects this information in a variety of ways. For example, data is collected through application forms, CVs; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments. We will collect additional personal information in the course of job-related activities throughout the period of you working with us.

In some cases, the Council collects personal data about you from third parties, such as references supplied by former employers and information from criminal records checks permitted by law and from third party benefit providers including where you chose to opt into benefits.

We also collect personal data from HCC Pension Services in relation to your local government pension.

Data is stored in a range of different places, including on your employee file, in the Council's HR management systems and other IT systems including Sharepoint and the Council’s email system.

Why does the Council process personal data?

The Council needs to process data to enter into an employment contract or a contract for services with you and to meet its obligations under that contract. For example, it needs to process your data to provide you with an employment contract or a contract for services, to pay you in accordance with your contract and to administer any relevant benefits or pension entitlements.

In some cases, the Council needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

In other cases, the Council has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the Council to:

  • run recruitment and promotion processes;
  • determine the terms on which you work for us and making decisions on salary and remuneration;
  • assessing qualifications, experience and skills for a particular task;
  • maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of contractual and statutory rights;
  • operate and keep a record of disciplinary, capability and grievance processes, to ensure acceptable conduct and performance within the workplace;
  • operate and keep a record of your performance, to plan for career development, and for succession planning and workforce management purposes;
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that you are receiving the pay or other benefits to which they are entitled;
  • obtain occupational health advice, ascertaining fitness for work, ensuring compliance with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that you are receiving the pay or other benefits to which they are entitled;
  • operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the Council complies with duties in relation to leave entitlement, and to ensure that you are receiving the pay or other benefits to which they are entitled;
  • process the ending of the contract relationship;
  • ensure effective general HR and business administration;
  • allow you access to Council buildings;
  • monitor your use of our information and communication systems to ensure compliance with our IT and social media policies;
  • to ensure network and information security, including preventing unauthorised access to our computers and electronic communication systems;
  • for workforce monitoring and to conduct data analysis to plan for workforce changes or development;
  • provide references on request for current or former employees;
  • respond to and defend against legal claims; and
  • maintain and promote equality in the workplace.

Where the Council relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not.

How we use sensitive personal information

Special categories of sensitive personal information require higher levels of protection and need justification for processing it.

We have in place appropriate safeguards for the security of this information, e.g. it is stored in your employee file which has restricted access and we will be looking to review and further strengthen these safeguards over the next year. 

We use information relating to leave of absence, including sickness absence, family related leave or strike days to comply with employment and other laws. Information about health or medical conditions, is processed to assess your fitness for work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including occupational and statutory sick pay, maternity, paternity or parental leave pay, pensions.  It is also processed to carry out our employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes) or in reaching decisions regarding your entitlements under the local government pension ill-health retirement scheme.  

Where we process information on criminal convictions we only do this where the law allows us to do so. For certain positions, we undertake criminal records checks to ensure that individuals are permitted to undertake the role in question.  Information about trade union membership is processed to allow the Council to operate check-off for union subscriptions and information is processed in relation to strike days to enable the Council to correctly administer pay and benefits.

A small number of employees use a biometric clocking in and out system.  The data is only used for time management purposes. The biometric data itself is held securely within the system.

Where the Council processes other special categories of personal data, such as information about ethnic origin, sexual orientation, religion or belief, this is done for the purposes of equal opportunities monitoring and reporting.  Employees are free to decide whether or not to provide such data and there are no consequences of failing to do so.

Automated decision-making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention.  We do not envisage that any decisions will be taken about you using automated means.

Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.  If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 

Please note that we may process your personal information without your knowledge or consent, in compliance with this notice, where this is required and permitted by law.

Who has access to data?

Your information will be shared internally, including with members of the HR team, your line manager, managers in the service area in which you work, finance officers and other senior managers in the Council, where applicable in the course of their duties.   On occasion IT or audit staff may have access to data, if it is necessary for the performance of their roles.

The Council shares your data with third parties in order to obtain pre-employment references  and other checks, including where necessary criminal records checks from the Disclosure and Barring Service or Disclosure Scotland. The Council may also share your data with third parties in the context of a TUPE transfer of services to another provider. In those circumstances the data will be subject to confidentiality arrangements.

The Council also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits including the local government pension scheme and the provision of occupational health services and criminal and driving licence record checks.

We may also need to share your data with a regulator or with other third parties in the performance of the contract or to comply with the law.  This may include making returns to HMRC or with the Council’s employment solicitors, Union representatives, ACAS or an employment tribunal or other court.

We require third parties to respect the security of your data and to treat it in accordance with the law. 

The Council will not transfer your data to countries outside the European Economic Area.

How does the Council protect data?

The Council takes the security of your data seriously. The Council has internal policies and controls in place to try to ensure that your data is not lost, used or accessed in an unauthorised way, altered or disclosed.  We limit access to your personal information to those employees or third parties who have a specific need to know in the performance of their duties.  Access to personal information in your employee file is restricted to specific individuals as is access to the HR IT system.

Where the Council engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.  We do not allow third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

The Council has in place procedures to deal with any suspected or actual data security breach and we will notify you and any applicable regulator of a suspected or actual breach where we are legally required to do so.

For how long does the Council keep data?

The Council will hold your personal data for the relevant retention periods.  A data retention schedule sets out the periods for which data is held.  Employee information held on your employee file, is usually held for the duration of your employment plus up to seven years.   

The HR team are reviewing the HR data retention schedule and are putting in place processes to review the retention periods for individual documents.

Your rights

Your duty to inform us of changes:  It is important that the personal information we hold about you is accurate and current.  Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information: As a data subject, you have a number of rights. You can:

  • request access and obtain a copy of your data on request;
  • require the Council to change incorrect or incomplete data;
  • require the Council to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where the Council is relying on its legitimate interests as the legal ground for processing;
  • ask the Council to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the Council's legitimate grounds for processing data; and
  • request the transfer of your information to another party.

If you would like to exercise any of these rights, please contact the Council’s Data Protection Officer DPO@testvalley.gov.uk

If you believe that the Council has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You have some obligations under your employment contract to provide the Council with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the Council with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the Council to enter into a contract of employment with you. If you do not provide other information, this may hinder the Council's ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

 

This employee privacy statement complies with the principles of Data Protection and the General Data Protection Regulations.