Human Resources Data Protection and Privacy Notice
Staffordshire County council (the data controller) is required to collect personal, and special category, data about employees in order to meet contractual, statutory and administrative obligations. This includes, but is not limited to:
- Information related to your employment – name, address, telephone numbers, email addresses, date of birth, gender, NINO, passport details, marital status, next of kin, emergency contacts employment and education history, location of employment, criminal convictions.
- Information related to your salary and pension – job role and contract, hours worked, expenses, leave, pension details, bank details, payroll records, tax details, trade union membership, maternity, paternity, shared parental and adoption leave and pay.
- Information relating to your performance and training – performance at work, grievances, disciplinary, whistleblowing, training and development.
- Information relating to monitoring – ICT acceptable use standards, photographs, CCTV images.
- Information relating to your health and wellbeing –health and wellbeing, accident records.
The General Data Protection Regulation and Data Protection Act 2018 place responsibilities on organisations to process this type of data in a fair, lawful and secure way. The organisation must ensure to fairly balance the organisations needs and an employee’s right to privacy.
A number of lawful bases will be relied upon when processing employee data depending on what data is being processed and why. These include processing where it is necessary; for the performance of a contract, to comply with our legal obligations as your employer, to protect your vital interests or those of another person, for the performance of our public task, and for the purposes of our legitimate interest.
Where the information we process is special category data, i.e. health data, additional lawful bases will be relied on where the processing is necessary; for employment, social security and social protection, to protect a person’s vital interests, in connection with a legal claim, for health or social care purposes, for archiving purposes. In addition we rely on processing conditions at Schedule 1, part 1, paragraph 1 and 2 of the Data Protection Act 2018 which relate to the processing of special category data for employment and health purposes. When we process data relating to criminal convictions and offences we rely on Schedule 1, part 2, paragraph 6 of the Act.
Data will be held and processed for the purposes of employment and will only be shared with third parties where the third party is providing services on the council’s behalf or where we are required to do so by law. Only data which is relevant and necessary will be shared.
Your data will be retained in line with our Records Retention Schedule.
Further details on how the council processes personal data is available in our Privacy Notice which can be found on the council’s website.
If you would like to exercise your rights as a data subject, or make a complaint regarding how your data is processed, you can do so by contacting the council Data Protection Officer on dpo@staffordshire.gov.uk and subsequently the Information Commissioner’s Office.