Privacy notice for employees

Devon County Council (DCC) is a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582. This notice applies to current and former employees.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

You have some obligations under your employment contract to provide the Council with data. In particular, you are required to report absences from work; you may be required to provide information about disciplinary or other matters under the implied duty of good faith.

You may also have to provide the Council with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details; your right to work in the UK and payment details; and your NHS Covid Pass, where applicable, must be provided to enable the organisation to enter into a contract of employment with you.

If you do not provide other information, this will hinder the Council’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated on the 21 December 2021. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

How we will use your personal data

Processing employee data allows the council to:

  • maintain accurate and up-to-date employment records and records of employee’s contractual and statutory rights
  • run recruitment processes and undertake pre-employment checks
  • operate and keep a record of disciplinary and grievance procedures (including records of mediation’s that have taken place) to ensure acceptable conduct
  • operate and keep a record of employee performance and related procedures, including capability, probation, supervision, appraisal and ASYE (for social workers) and to allow effective performance management, to plan career development, and for succession planning and workforce management purposes
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled
  • obtain occupational health advice, to ensure it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled
  • operate and keep a record of types of leave (including maternity, paternity, adoption, parental and shared parental leave) to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits they are entitled
  • operate and keep a record of restructures, redundancies and redeployment procedures to allow effective workforce management and to ensure that employees are receiving the pay or other benefits to which they are entitled
  • operate and keep a record of any TUPE transfers
  • monitor and report on vaccination status where this is a regulatory requirement for certain jobs (COVID vaccination)
  • monitor and report on vaccination uptake where vaccination is recommended and/or the organisation provides free vaccination (flu vaccination) to enable costs and resources required to be planned and arranged. In addition to monitor percentage take up in the wider workforce
  • ensure effective general HR and business administration
  • provide references on request for current or former employees
  • respond to and defend against legal claims
  • maintain and promote equality in the workplace
  • respond to requests for statutory reports
  • operate and keep a record of whistle-blowing procedures
  • provide statistical information for workforce management and planning
  • operate the Apprenticeship Levy
  • to process voluntary deductions from your pay, such as trade union membership subscriptions

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law.

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law for example, to help prevent or detect crime or to safeguard children or vulnerable adults.

We use a Human Resources Management System called iTrent to process personal data regarding current and former employees. This application is also used to process personal data relating to staff of organisations that contract with the council to provide HR and Payroll service.

iTrent is a secure cloud-housed application provided by MHR who have achieved certification to the ISO27001 and SOC-2 international security standards. The application has also been the subject of rigorous external security testing, to ensure appropriate information security is in place to protect the Council’s data.

A further programme of testing is also planned throughout the lifespan of the application to ensure the highest levels of information security are maintained.

For more details about the council’s security arrangements please visit www.devon.gov.uk/security.

What information do we collect and process?

The Council collects and processes a range of information about you. This includes:

  • your name, address and contact details, including your email address, telephone number, date of birth and gender
  • your job description, which is published on our JH Job Descriptions library
  • the terms and conditions of your employment and any related correspondence
  • details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and with the Council, including the reason for leaving
  • information about your remuneration, including entitlement to benefits
  • details of your bank account and National Insurance number
  • information about your marital status, next of kin, dependants and emergency contacts
  • information about your nationality and entitlement to work in the UK
  • a copy of your driving licence
  • information about your criminal record
  • information about any disqualification from caring for children (for applicable posts only)
  • information about your COVID-19 vaccination status (for applicable posts only)
  • dates of flu vaccination
  • details of your working pattern (days and hours of work) and attendance at work
  • details of leave taken by you, including holiday, family related and unpaid leave, and the reasons for the leave
  • details of any absence, including sickness absence and the reasons for the absence
  • details of any absence management procedures related to you, including any warnings issued to you and related correspondence
  • information about medical or health conditions, including whether or not you have a disability for which the Council needs to consider reasonable adjustments
  • details of any disciplinary or grievance procedures in which you have been involved, including any investigations, any warnings issued to you and related correspondence
  • details of any publicly available online information, including social media. This is linked to information that you might make publicly available that could potentially affect your employment with DCC; and may therefore be used by the Council for example in a grievance or disciplinary or other relevant processes.  This information is not collected/processed where there is no lawful purpose to do so.
  • CCTV footage. This is included because there are cameras at some of DCC sites and you will be filmed leaving and entering premises. This footage is not routinely monitored, however, the Council may be required to share information to enable us to comply with our own obligations and/or those of other regulatory bodies, for example through court orders and other legal obligations. If this is necessary, the council will only share the minimum amount of personal data needed for this purpose.
  • details of how you use our IT and communication systems
  • details of any compensation history or settlement agreements related to you. This relates to payments made that are linked to your employment only; for example, details of any personal injury claims made against the Council.
  • assessments of your performance, training and development that you have participated in, performance improvement plans, any warnings issued to you and related correspondence
  • details of any whistle-blowing procedures in which you have been involved and related correspondence
  • details of any TUPE transfers or redundancy processes related to you
  • details of trade union membership
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, religion and belief
  • details about you that you record in your Outlook calendar that are not marked as “private”
  • information regarding your availability in Outlook (free or busy information) that is shared with partner organisations such as local NHS bodies to facilitate multi-agency working

The Council collects this information in a variety of ways. For example, data is collected through application forms, CVs, obtained from your passport or other identity documents, such as your driving licence; from forms completed at the start of or during your employment; from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the Council collects personal data about you from third parties such as references supplied by former employers, information from employment background checks and information from criminal record checks permitted by law.

The Council will not transfer your data outside of the EU. The data held about you in iTrent is held within UK data centres only and is not shared outside of the UK.  Your data is also held within Office365 and these are all hosted either within the UK or inside the EU and in Microsoft EU Model Clause compliant data centres.

Why we collect and use your personal data

The Council needs to process data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, to pay you in accordance with that contract and to administer any benefits.

In some cases, the Council needs to process data to ensure that it is complying with its legal obligations. For example, to check an employee’s entitlement to work in the UK, to deduct tax and comply with Court Order regulations and to comply with health and safety and/or employment legislation.

For certain positions, it is necessary to carry out criminal record checks to ensure that individuals are permitted to undertake the role in question.

In other cases, the Council needs to process data in the public interest. For example, when concerns are raised under its Whistle-Blowing Policy or in relation to safeguarding children and vulnerable adults. There may also be cases where the Council needs to process data in the vital interests of an individual. For example, if someone is seriously injured at work and information needs to be disclosed to the emergency services.

In other cases, the Council has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

The legal basis for us collecting your personal data

Where we are collecting personal data about you for the provision of one of the services outlined in this privacy notice, we rely upon the following lawful conditions outlined in the General Data Protection Regulation (GDPR).

  • Article 6(1)(a) – consent
  • Article 6(1)(b) – performance of a contract that the data subject and DCC are party to
  • Article 6(1)(c) – processing that is necessary for DCC to fulfil a statutory obligation
  • Article 6(1)(e) – processing for the purposes of delivering a public task carried out in the public interest

Who we may share your personal data with?

The Council needs to process data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, to pay you in accordance with that contract and to administer any benefits.

In some cases, the Council needs to process data to ensure that it is complying with its legal obligations. For example, to check an employee’s entitlement to work in the UK, to deduct tax and comply with Court Order regulations and to comply with Health and Safety and/or Employment legislation. For certain positions, it is necessary to carry out criminal record checks to ensure that individuals are permitted to undertake the role in question.

The Council publishes all its job descriptions on the HR Job Description library.  This library is available for all staff to access. This is necessary to support recruitment and job evaluation processes. No names or other identifying personal data is included on job descriptions that are published in this library.

In other cases, the Council needs to process data in the public interest. For example, when concerns are raised under its Whistle-Blowing Policy or in relation to safeguarding children and vulnerable adults. There may also be cases where the Council needs to process data in the vital interests of an individual. For example, if someone is seriously injured at work and information needs to be disclosed to the emergency services.

In other cases, the Council has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

The Council contracts with MHR to deliver our Human Resources management system, iTrent.  All personal data that is processed within this application is hosted by MHR in a secure data centre which is accredited to the ISO27001 and SOC-2 international security standard. The council has a contract in place with MHR to ensure the highest standards of data protection and information security are maintained. MHR may need to access personal data as part of their contract with the council, to ensure the continued operation of this application. Any personal data that needs to be accessed, will be restricted to the minimum that is necessary for this purpose.

Due to the nature of services delivered by the council, there is often a requirement for us to work in collaboration with our partners, such as other local authorities, NHS bodies and commissioned providers.  Therefore, to deliver these services, it may be necessary for us to share a limited amount of personal information about our employees (such as email addresses, contact details and outlook calendar free and busy information) with certain partners to facilitate service delivery. The council will only share the minimum amount of information that is necessary for this purpose and will only share where there is a legitimate need.

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004. Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the General Data Protection Regulation (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you so that we can support third party organisations to discharge their regulatory requirements. This includes organisations such as:

  • The data protection regulator (the Information Commissioner’s Office)
  • The Care Quality Commission
  • The Department for Work and Pensions

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

How long will we hold your personal data?

Devon County Council will retain your personal data for only as long as is necessary, and in line with our organisation’s record retention schedules.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Further details on your rights under data protection legislation and how to exercise them, are available here.

International transfers

Devon County Council will not transfer personal data to countries that are outside of the territorial scope of UK data protection laws without the required safeguards outlined in Chapter 5 of the GDPR.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.

Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk

Automated decisions

No automated decisions will be taken using personal data that is processed for any of the activities outlined in this privacy notice.