HR Employment Records - privacy notice

How we use your information

Calderdale Council of Town Hall, Crossley Street, Halifax, HX1 1UJ is registered with the information Commissioners Office (ICO) under the provisions of the Data Protection Act 2018. The Council takes its responsibilities under the Act very seriously.

This privacy notice is applicable to HR (Human Resources) which includes:

• Recruitment;
• Contracts and Payroll;
• Advisory;
• Pensions;
• Organisational Development;
• and information held on the related HR and Payroll systems.

Health & Safety and Occupational Health have their own privacy notices, available directly from them.

During your recruitment and employment with us it is necessary under the Data Protection Act 2018 for Calderdale Council acting as Data Controller to collect and process personal information about you. This notice tells you about the personal information we collect and how it may be used.

Who this privacy notice applies to

This privacy notice applies to all applicants, employees (and former employees) on permanent or fixed term contracts, workers (including agency, casual, contracted staff and those workers covered by the Intermediaries Legislation IR35), volunteers, trainees and those carrying out work experience.

What personal information is

During the course of its employment activities, Calderdale Council collects, stores and processes information about prospective, current and former staff.

Personal information is information about someone which allows that person to be identified from that data or a combination of data available to us. Examples include: name, address, employee/payroll number, National Insurance number, photo, email address or mobile phone number. Some personal information is classified as special category data. This may include information about your race or ethnic origin, physical or mental health conditions, alleged or real offences, proceedings for any alleged or real offence, sexuality, religion or beliefs.

How we collect your personal information

We get information about you from the following sources:

• Directly from you.
• From an employment agency.
• From your employer if you are a secondee.
• Previous employers.
• From referees, either external or internal.
• From Occupational Health and other health providers.
• From Pension administrators and other government departments, for example tax details from HMRC or Criminal Records Checks from the Disclosure and Barring Service.
• From your Trade Union.
• From providers of staff benefits.
• From external training providers.
• CCTV images from our landlords or taken using our own CCTV systems.

Personal information is likely to be collected when making, responding and offering you employment and during your employment with us. Such information may be collected over the phone, by face to face contact; when receiving written correspondence; or electronic correspondence such as e-mails, faxes, online application forms, questionnaires, forms relating to notification of appointment, change to contract or leaving; and text messages.

What personal data we process and why

Information related to your employment

We use the following information to carry out the contract we have with you, provide you access to business services required for your role and manage our human resources processes. We will also use it for our regulatory purposes in our role as a supervisory authority.

• Personal contact details such as your name, address, contact phone numbers (landline and mobile) and personal email addresses.
• Your date of birth, nationality, gender and NI number.
• A copy of your passport or similar photographic identification and / or proof of address documents.
• Marital status.
• Next of kin, emergency contacts and their contact information.
• Employment and education history including your qualifications, professional memberships, job application, employment references, right to work information, other pre-employment checks.
• Location of employment.
• Details of any secondary employment, political declarations, conflict of interest declarations or gift declarations.
• Any criminal convictions that you declare to us.
• Your responses to staff surveys if this data is not anonymised.
• Driving Licence checks.
• In conjunction with managers and Transport Services where appropriate - to provide Council vehicle drivers with a council vehicle and complete any necessary driving license validations including monitoring mileage and use, if applicable.
• Employment Tribunal applications.
• Complaints.

Information related to your salary, pension and salary sacrifice schemes

We process this information for the payment of your salary, pension and other employment related benefits. We also process it for the administration of statutory and contractual leave entitlements such as holiday or maternity leave.

• Information about your job role and your employment contract including; your start and leave dates, salary (including grade and salary band), any changes to your employment contract, working pattern (including any requests for flexible working).
• Details of your time spent working and any overtime, expenses or other payments claimed, including details of any salary sacrifice schemes such as car purchase schemes.
• Details of any leave including sick leave, holidays, family leave[1], special leave etc.
• Pension details including membership of occupational pension schemes (current and previous).
• Your bank account details, payroll records and tax status information.
• Trade Union membership for the purpose of the deduction of subscriptions directly from salary.
• Details relating to Maternity, Paternity, Shared Parental and Adoption leave and pay. This includes forms applying for the relevant leave, copies of MATB1 forms/matching certificates and any other relevant documentation relating to the nature of the leave you will be taking.
• Details of mileage and expenses claims where appropriate for casual and essential car users and complete associated driving checks including license validations, MOT and road tax in conjunction with managers and Health and Safety.

Information relating to your performance, learning and development and training

We use this information to assess your performance, to conduct pay and grading reviews and to deal with any employer/employee related disputes. We also use it to meet the training and development needs required for your role.

• Information relating to your performance at work eg induction, probation reviews, Shared Conversations.
• Grievance matters and investigations to which you may be a party or witness.
• Disciplinary records and documentation related to any investigations, hearings and warnings/penalties issued.
• Whistleblowing concerns raised by you or to which you may be a party, or witness.
• Information related to your training history and development needs.
• Learning and development activities and records including requests, expressions of interest, applications and agreements and related correspondence.

Information relating to monitoring

We use this information to assess your compliance with corporate policies and procedures and to ensure the security of our premises, IT systems, employees and workers. This may also include utilising the information for lawful investigative purposes.

• Information about your access to data held by us for the purposes of criminal enforcement if you are involved with this work.
• Information derived from monitoring IT acceptable use standards.
• Photos and CCTV images.
• Any other systems or software/programs that hold employees’ personal data.

Information relating to your health and wellbeing and other special category data

We use the following information to comply with our legal obligations and for equal opportunities monitoring. We also use it to ensure the health, safety and wellbeing of our employees. Further details can be found in the Occupational Health and Health & Safety Privacy Notices.

• Health and wellbeing information either declared by you or obtained from health checks, eye examinations, occupational health referrals and reports, sick leave forms, health management questionnaires or fit notes, ie Statement of Fitness for Work from your GP or hospital.
• Accident records if you have an accident at work.
• Details of any desk audits, access needs or reasonable adjustments.
• Information you have provided regarding Protected Characteristics as defined by the Equality Act and s.75 of the Northern Ireland Act for the purpose of equal opportunities monitoring. This includes gender, race, ethnicity, disability, sexual orientation and religion. Where not required for a legal or statutory purpose, this information can be added and updated on the HR and Payroll system by yourself. You can also choose not to share or disclose such information, such as in regard to sexual orientation or religion.
• Information relating to health and safety, such as audits/follow ups, general emails, alcohol and drug testing and incidents (accidents/investigations).

Criminal convictions and offences

We process information about staff criminal convictions and offences including alleged offences, criminal proceedings, outcomes and sentences. The lawful basis we rely to process this data are:

• Article 6(1)(e) for the performance of our public task. In addition we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a).
• Article 6(1)(b) for the performance of a contract. In addition we rely on the processing condition at Schedule 1 part 1 paragraph 1.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy.

We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected or sold for direct marketing purposes and your information is not usually processed overseas but may be in the case of overseas employment references and security checks where applicable.

The lawful basis for the processing of your personal data

Depending on the processing activity, we rely on the following lawful basis provisions of Article 6 of the General Data Protection Regulation (GDPR):

• Contract - processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract (Article 6(1)(b)).
• Legal Obligation - Processing is necessary for the Council to comply with the law (Article 6(1)(c)).
• Vital Interest – in order to protect your vital interests or those of another person (Article 6(1)(d)).
• Public Task – processing is necessary to perform a task in the public interest or for official functions and the task or function has a clear basis in law (Article 6(1)(e)).
• Legitimate Interests - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (Article 6(1)(f)).

We process special category data under the following conditions listed in Article 9 of the GDPR:

• Your explicit consent.
• Processing is necessary for carrying out obligations under employment, social security or social protection law or a collective agreement (Article 9(2)(b)).
• To protect your vital interests or those of another person where you are incapable of giving your consent (Article 9(2)(c)).
• Where it is necessary for the purposes of preventative or occupational medicine and for the assessment of the working capacity of the employee (Article 9(2)(h)).
• Where it is necessary for the establishment, exercise or defence of legal claims or judicial acts (Article 9(2)(f)).

In addition we rely on processing conditions at Schedule 1 part 1 paragraph 1 and Schedule 1 part 1 paragraph 2(2)(a) and (b) of the DPA 2018. These relate to the processing of special category data for employment purposes, preventative or occupational medicine and the assessment of your working capacity as an employee

How long we keep your personal data

Please see:

• HR Retention and Disposal Schedule(PDF 496KB)

Data sharing

In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors. For example, we may share information about you with HMRC for the purpose of collecting tax and national insurance contributions.

Your personal information will not usually be transferred outside of the European Economic Area but may be in the case of overseas employment references and security checks where applicable.

Any disclosures of personal data are always made on a case by case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place.

Information is only shared with those agencies and bodies who have a 'need to know' or where you have consented to the disclosure of your personal data to such persons.

We may share your information internally with other departments / services of the Council, including:

• IT, Finance, Audit, Insurance, Pensions, Environmental Management.

Other external organisations we may share your information with may include:

• Any information technology or communication companies which provide and support our IT, voice or data infrastructure and resolve any issues.
• Our HR colleagues and service providers to deal with our payroll, vacancy and application process and support all aspects of our HR activities and applications.
• Other HR providers, such as those who manage employee surveys[2].
• Organisations who provide training and grants to us, such as external training organisations, Further Education and Higher Education Institutes, online eLearning providers and government agencies.
• The Disclosure and Barring Service (DBS) and the associated e-bulk (online DBS service) and other professional bodies including DfE to check your details with them.
• Officially recognised Trade Unions - Unison, GMB and Unite - for the purposes of collective bargaining and representation where applicable under s188 of the Trade Union and Labour Relations Consolidation Act 1992.
• Providers of goods or services and other professional advisers who provide us with support for any contractual arrangements we may have, for example the HR and Payroll System supplier.
• Police.
• Her Majesty's Revenue and Customs (HMRC).
• Care Quality Commission (CQC).
• Social Work England.
• Health and Care Professions Council (HCPC).
• Ofsted.
• Pension Scheme Providers, including Teachers Pensions, West Yorkshire Pension Fund, NHS Pensions, NEST Pensions, Prudential/AVC Wise and Scottish Widows.
• Pension Scheme Regulator.
• Government departments, local authorities and other organisations to research and understand how services are delivered and by whom, eg in response to the Children's Social Workforce Census and other statistical purposes and statutory returns.
• Organisation for National Statistics (ONS).
• Employee data will also be used to complete Mandatory and Statutory returns, for example Gender Pay Gap Reporting, the Children's Social Work Workforce Census, School Workforce Census and ASHE (Annual Survey of Hours and Earnings) Survey and for statistical purposes, eg in order to monitor absence management within the Council and benchmarking across other Local Authorities. Open Data/Dataworks also provides statistical data on the workforce.
• Other bodies that inspect and manage public funds.
• If we are required to do so by law.

Use of third party companies

To enable effective staff administration we may share your information with contracted external service providers to process your data on our behalf in order to comply with our obligations as an employer.

The personal information we share with others will be the minimum necessary and only that which is relevant to enable them to carry out their task. Special category data will only be made available when necessary and to those involved in dealing with your application and employment.

Prevention and detection of crime and fraud

We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

Individual rights

Data protection laws give individuals rights in respect of the personal information that we hold about you. These are:

• To be informed why, where and how we use your information.
• To ask for access to your information.
• To ask for your information to be corrected if it is inaccurate or incomplete.
• To ask for your information to be deleted or removed where there is no need for us to continue processing it.
• To ask us to restrict the use of your information.
• To ask us to copy or transfer your information from one IT system to another in a safe and secure way without impacting the quality of the information.
• To object to how your information is used.
• To challenge any decisions made without any human intervention (automated decision making).

In summary, you have the right to see what information is held about you, to have inaccurate information corrected and to have information removed from our system unless we are required by law or a statutory purpose to keep it by writing to cpt@calderdale.gov.uk. You have the right to complain to the Data Protection Officer if you feel that your data has not been handled in accordance with the law.

The Council's Data Protection Officer can be contacted at information.management@calderdale.gov.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office.