Human Resources Privacy Notice - Employees

Human Resources at New Forest District Council is committed to protecting and respecting your privacy. For the purpose of the 2018 General Data Protection Regulation, the data controller is New Forest District Council, Appletree Court, Beaulieu Road, Lyndhurst, SO43 7PA data.protection@nfdc.gov.uk

This Privacy Notice aims to explain:

The different kinds of personal data we process
How we use your data
How we store your data
Who has access to your data
How long your information is kept for
How your data is protected
What are the legal grounds for processing your information

1. What kind of personal data do we process?

We collect and process a range of information about you. This includes:

your name, address and contact details, including email address and telephone number, date of birth and gender;
the terms and conditions of your employment;
details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
information about your remuneration, including entitlement to benefits such as pensions, shared cost AVCs (administered on behalf of NFDC by AVC Wise Ltd), tax free childcare and salary sacrifice cycle to work scheme (administered on behalf of NFDC by Edenred UK)
details of your bank account and national insurance number;
information about your marital status, next of kin, dependants (if relevant) and emergency contacts;
information about your nationality and entitlement to work in the UK
information about your criminal record if relevant to the role;
details of your schedule (days of work and working hours) and attendance at work;
details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence. Two years after any disciplinary warning is spent all documents and relevant correspondence will be deleted;
assessments of your performance, including appraisals, performance reviews and ratings, performance improvement plans and related correspondence;
information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
relevant personal information may be given to training providers if you attend a course on behalf of New Forest District Council.
details of your reason for leaving NFDC employment, including employment dates

We may collect this information in a variety of ways. For example, data might be collected through application forms, CVs; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as pension benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, we may collect personal data about you from third parties, such as references supplied by former employers and information from criminal records checks permitted by law.

2. How we use your personal data?

We need to process data to enter into an employment contract with you and to meet obligations under your employment contract. For example, we need to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer pension entitlements.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws, to enable employees to take periods of leave to which they are entitled, and to consult with employee representatives if redundancies are proposed or a business transfer is to take place.

In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the organisation to:

run recruitment and promotion processes;
maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
maintain accurate records of entitlement to benefits, include pension administration and shared cost AVCs (administered on behalf of NFDC by AVC Wise Ltd)
enable access to the Councils My Lifestyle employee benefits portal which offers access to retail discounts and a salary sacrifice cycle to work scheme (administered on behalf of NFDC by Edenred UK)
operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace; disciplinary records will be retained for two years after a sanction is spent
operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
obtain occupational health advice, to ensure that we comply with duties in relation to individuals with disabilities, meet our obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with our duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
ensure effective general HR and business administration;
conduct employee engagement surveys and leaver questionnaires when you decide to leave your employment;
provide references on request for current or former employees (this will confirm employment dates and position held);
respond to and defend against legal claims;
maintain and promote equality in the workplace.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities).

Where the organisation processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring.

Data that the organisation uses for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

3. How we store your data

Data will predominately be stored in the Councils HR Management Systems; personnel files are maintained through an online filing system. Data may also be stored on other IT systems, namely the organisations email system.

4. Who has access?

Your information will be held on the Human Resources electronic systems, including online filing. Members of the HR Team will have access to your data including HR Admin, HR Advisory and Payroll. Each team will be limited to viewing data that is relevant to them, for example only the HR Advisory team will have access to Employee Relation matters, and Payroll to payroll information (e.g. bank account details).

Your information will be shared internally with your line manager, business unit manager and IT staff if access to the data is necessary for the performance of their roles.

NFDC shares your data with third parties in order to obtain pre-employment references from other employers and obtain employment background checks including:

DBS (where necessary for the role);
Hampshire County Council for the administration of pension benefits;
HMRC for the deduction of Income Tax and National Insurance
AVC Wise Ltd for the administration of Shared Cost AVCs (where employees choose to sign up to this service)
iTrent suppliers of the Councils HR Management System
Edenred UK for the administration of the My Lifestyle Employee Benefits platform (where employees choose to sign up for this service)

NFDC will not transfer your data to countries outside the European Economic Area.

4.a. Data Matching

This authority is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for; auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The Cabinet Office is responsible for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here.

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned.

Data matching by the Cabinet Office is subject to a Code of Practice.

View further information on the Cabinet Office's legal powers and the reasons why it matches particular information

5. How long will we keep your information?

NFDC will hold your personal data for the duration of your employment. The period for which your data is held after the end of your employment is seven years.

Payroll and pension records will be retained for 13 years.

6. How do we protect your data?

NFDC takes security of your data seriously. All information provided is stored on our secure servers as managed by the IT Department. We have internal policies and controls in place to try to ensure that your data is not lost, accidently destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

Where the organisation engages third parties in regards to personal data, for example obtaining Occupational Health advice, this is done under a duty of confidentiality and they are obliged to implement appropriate technical and organisation measures to ensure the security of data. All external emails containing personal data must be in an attachment and encrypted using WinZip marked as 'Official-Sensitive'. For further information please see 'Safer Information Handling Policy'.

7. What are the legal grounds for processing your information?

a. Where it is necessary for the performance of a contract

b. Where it is in the public interest to do so;

c. With your consent

d. In order to comply with a legal obligation;

e. Where it is in the legitimate interest of NFDC to do so;

f. With your explicit consent or where there is a substantial public interest in relation to special categories data.

Your rights:

As a data subject, you have a number of rights. You can:

access and obtain a copy of your data on request;
require the organisation to change incorrect or incomplete data;
require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing.

Please see New Forest District Councils 'Information Rights Policy' which is available on the NFDC website at: Information Rights Policy (PDF) [237KB]

We work hard to ensure that we only gather information that we need to process your enquiry and deliver the services that you are entitled to in the best way possible. However, if you have any concerns relating to this or your Privacy in general, please speak to a member of the HR team or email our Data Protection Officer on data.protection@nfdc.gov.uk

If you believe that the organisation has not complied with your data protection rights, you can complain to the Information Commissioner.

Information Commissioner - https://ico.org.uk/
Telephone helpline - 0303 123 1113
Email - casework@ico.org.uk

Further information

For further general information plus information on access, portability, erasure, correction, restriction, objection and notification see New Forest District Councils 'Information Rights Policy'; ask at any office for a hard copy or it is available at www.newforest.gov.uk