Privacy notice - Employment records
Overview
During the course of its employment activities, East Sussex County Council collects, stores and processes personal information about prospective, current and former staff.
This privacy notice covers employees (and former employees), workers (including agency, casual and contracted staff), volunteers, trainees and those carrying out work experience.
East Sussex County Council takes data protection seriously. Please be assured that your information will be used appropriately in line with data protection legislation, will be stored securely and will not be processed unless the requirements for fair and lawful processing can be met.
What information is being used?
In order to carry out our activities and obligations as an employer we handle data in relation to:
- personal demographics (including gender, race, ethnicity, sexual orientation, religion)
- contact details such as names, addresses, telephone numbers and emergency contacts
- employment records (including contract, terms and conditions, job titles, qualifications, work history, working hours, promotion, job applications, CVs and cover letters, contract start and end dates, absences, attendances, training records, professional memberships, references and proof of right to work in the UK)
- bank details
- pension details
- information about medical or health conditions, including whether employees have a disability for which the organisation needs to make reasonable adjustments and occupational health information
- information relating to health and safety
- trade union membership and political opinions
- offences (including alleged offences), criminal proceedings, outcomes and sentences
- employment tribunal applications, complaints, accidents, and incident details
- records of disciplinary , grievance, appraisal and performance management/improvement processes. This includes details of allegations, investigations, meeting records, outcomes, performance improvement plans and related correspondence.
How will your information be used?
- Staff administration and management (including payroll)
- Ensuring employees are complying with relevant policies and procedures
- Operating and recording disciplinary and grievance processes
- Conducting performance reviews, managing performance and determining performance requirements
- Operating and keeping a record of absence and absence management procedures
- Obtaining occupational health advice
- Pensions administration
- Business management and planning
- Accounting and Auditing
- Accounts and records
- Crime prevention and prosecution of offenders
- Education
- Health administration and services
- Information and databank administration
- Sharing and matching of personal information for national fraud initiative
- Statutory reporting - for example, sharing data about our schools workforce as part of the schools workforce census, sent to the Department for Education
- To support applications to the Council's Refer a Friend scheme, where applicable
- Provision of staff benefits
- Responding to and defending against legal claims
We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never sold for direct marketing purposes.
Our staff are trained to handle your information correctly and protect your confidentiality and privacy.
Your information is processed in the UK or in a country with an adequacy agreement with the UK.
What is the legal basis for processing your information?
The lawful bases we rely on for processing your personal data are article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. Processing your data may also be necessary for carrying out the employer’s obligations under article 6(1)(c) to ensure compliance with the law.
The lawful bases we rely on to process any information which is special category data, such as health information or trade union membership are article 9(2)(b) of the UK GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights or article 9(2)(g) - necessary for reasons of substantial public interest.
The additional DPA 2018 processing conditions we rely on are article 9(2)(f) with respect to legal claims and article 9(2)(h) for support for individuals with a particular disability or medical condition.
We may process information about criminal convictions and offences. The lawful basis we rely to process this data are Articles 6(1)(b) (c) and (e) for the performance of a contract; compliance with a legal obligation and for performance of a task carried out in the public interest. In addition we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a) relying on our provisions under the Rehabilitation of Offenders Act 1974.
How long will your information be kept for?
Your information will be kept for 7 years after termination of employment unless special circumstances apply, for example, records for those working in residential care homes will be kept for longer. A full list of retention periods applicable to personnel files is available on the East Sussex County Council website and on request.
Sharing your information
There are a number of reasons why we share information. This can be due to:
- our obligations to comply with legislation - for example, sharing information with tax authorities, regulatory authorities, law enforcement and regulatory bodies, or sharing schools workforce census data as required by the Education Act 2005.
- our duty to comply any court orders which may be imposed.
Any sharing of personal data is always done:
- on a case-by-case basis
- using the minimum personal data necessary
- with the appropriate security controls in place
- in line with legislation.
Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the sharing of your personal data to such persons.
We may use the information we hold about you to assist in the detection and prevention of crime or fraud. We may also share this information with other bodies that inspect and manage public funds.
Use of third party organisations
East Sussex County Council may share your information with trusted external organisations to process your data on our behalf.
To enable effective staff administration, East Sussex County Council may share your information with external organisations to process your data on our behalf in order to comply with our obligations as an employer. Where these third parties act as a "data processor" (for example, a payroll provider), they carry out their tasks on our behalf and upon our instructions for the above mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services. The following processing may be undertaken by third party organisations:
- occupational health, including health assessments by doctors and other healthcare providers
- professional advice and support from third parties including insurers, doctors and other healthcare providers, lawyers, barristers, third-party investigators, consultants, and IT administrators
- regulatory authorities, law enforcement and regulatory bodies
- counselling and employee assistance
- sickness absence recording (including an optional nurse referral service)
- Line management by trained colleagues from Brighton & Hove City Council, and Surrey County Council
- IT&D, payroll and finance processing by trained colleagues from Brighton & Hove City Council, and Surrey County Council
- training, including provision of an electronic learning management system
- If you take part in the Council’s Additional Voluntary Contribution pension scheme, with the scheme provider AVC Wise. You can find a copy of the AVC Wise privacy statement here.
- Personnel numbers are shared in order to facilitate access to our externally managed staff benefits platform and electric vehicle salary sacrifice scheme.
In addition, in the event that your job role is transferred to a new employer under the Transfer of Undertakings (Protection of Employment) regulations, or if you are seconded to a new employer, your information will be shared with the new employer. You can always expect to be informed of this in advance.
Some third parties to whom we may provide personal data, may be data controllers in their own right, and you should refer to their own privacy notices and policies in respect of how they use your personal data.
Any organisation commissioned by the Council will be under contractual obligation to comply with data protection legislation.
Your rights
Under data protection legislation, you have the right:
- to be informed why, where and how we use your information
- to ask for access to your information
- to ask for your information to be corrected if it is inaccurate or incomplete
- to ask for your information to be deleted or removed where there is no need for us to continue processing it
- to ask us to restrict the use of your information
- to ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information
- to object to how your information is used
- to challenge any decisions made without human intervention (automated decision making)
Please visit data subject rights for further details.
How to find out more or complain
Should you have any further queries on the uses of your information, please speak directly to our service:
To complain about the use of your information, please contact our Customer Services Team or our Data Protection Officer.
Further information on making a complaint.
You can also contact the Information Commissioner's Office (ICO) for further information or to make a complaint:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113 (local rate)