Privacy notice for applicants and employees

St Helens Borough Council is committed to collecting and processing your personal information in accordance with fair and transparent information practices and in accordance with the General Data Protection Regulation (2016/679 EU) and the Data Protection Act 2018.

This notice explains how St Helens Borough Council handles the personal information of employees, apprentices, former employees, and temporary agency workers in the course of its human resources activities in order to manage the employment relationship.

What personal information is being processed?

St Helens Borough Council collects and processes a range of information about you. This includes, for example:

• Your name, address and contact details, including email address and telephone number, date of birth and gender;
• Your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• Your remuneration, including entitlement to benefits such as pensions;
• Details of your bank account and national insurance number;
• Information about your marital status, next of kin, dependants and emergency contacts;
• Your nationality and entitlement to work in the UK;
• Your suitability to undertake specified posts (through a DBS check in respect of a criminal record (you will be made aware of the need for a DBS check at the point of application);
• Details of your schedule (days of work and working hours) and attendance at work;
• Details of periods of leave taken by you, including holiday, sickness absence, family leave and the reasons for the leave;
• Details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• Assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
• Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief (it will be your choice whether or not to provide this information at the point of contact).

Why we process personal data

The council needs to process data to:

• Enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide an employment contract, to pay you correctly and to administer benefit and pension entitlements.
• Ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are legally entitled. In other cases, the organisation has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

The following is an illustrative, non-exhaustive list of ways in which the council may process your data:

• Run recruitment and selection processes, including conducting pre-employment checks such as determining your legal right to work in the UK, carry out DBS checks (where necessary), make offers of employment and provide contracts of employment;
• Plan its resources including succession planning, budgetary and financial planning, organisational and development planning and workforce management;
• Process payroll and benefits including salary, tax, salary sacrifice, pensions and business travel and expense management;
• Maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency);
• Operate and keep a record of disciplinary and grievance processes and to carry out internal reviews, investigations and audits;
• Operate and keep a record of employee performance and related processes, to plan for career development, provide workforce development and for education and training purposes;
• Operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• Obtain occupational health advice, to ensure that it complies with duties in relation to individuals with work-related injury and illness or disabilities and to meet its obligations under health and safety law. Ensuring that employees are receiving the pay or other benefits to which they are entitled;
• Operate and keep a record of all types of leave (including maternity, paternity, adoption, parental and shared parental leave) and flexible working arrangements, ensuring that the organisation complies with its duties in relation to leave entitlement, and to ensure that employees receive the pay or other benefits to which they are entitled;
• Manage physical access control, authorise administer, monitor and terminate access to or use of facilities, records, property and infrastructure including communications services such as telephones, laptops and email/internet use;
• Provide references on request for current or former employees.

Lawful basis for processing

We need to collect and use your personal information for a number of purposes as described in relation to the performance of your employment contract.

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the GDPR:

• Article 6(1)(b) which relates to processing necessary for the performance of a contract, that being your contract of employment.
• Article 6(1)(c) so we can comply with our legal obligations as your employer.
• Article 6(1)(f) where processing is necessary for the purpose of our legitimate interest as your employer.

Where the information we process is special category data, for example your health data or equal opportunities data, the additional bases for processing that we rely on are:

• Article 9(2)(b) which relates to carrying out our obligations in respect of employment.
• Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee.

Who we share your information with

Your information will be shared with the Human Resources team, your line manager, senior managers and other relevant officers within the council where this is required for your role.

We may also share your information with third parties such as:

• The Disclosure and Barring Service where a DBS check is required for your role
• HM Revenue and Customs with regard to tax
• Pension providers such as the MPF or TPA where you are a member of a pension which is deducted from your salary
• UK Border or other public authority
• Other third-party organisations as permitted or required by law (for example, if you are in a post that is based at a school and covered by the statutory School Workforce Census, or is covered by the statutory National Minimum Data Set (Adults) or Children's Social Work Workforce surveys, we are required to share information that is relevant to the census/survey with the DfE (Schools and Children's) or Skills for Care (Adults)
• Other third-party organisations with your consent such as for employment verification or bank loans
• Other third parties who are providing a relevant service to the Council (for example Employee Benefits)
• Other third-parties when reasonably necessary such as in the event of a life-threatening emergency.

How long we keep your personal data

Your personal information will be retained for as long as necessary to achieve the purpose for which it was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by applicable law.

The organisation will hold your personal data for the duration of your employment in your personnel file. Following termination of your employment, the periods for which your data is held will depend on the type of data. Some records will be retained for up to 7 years.

Your data rights

Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data.

Full details of your data rights can be found at www.sthelens.gov.uk/dataprotection

If you believe that the organisation has not complied with your data protection rights, you should discuss the issue with your supervisor or another supervisor or manager and contact the Human Resources department.

If you would like to exercise any of these rights, please contact St Helens Borough Council's Data Protection Officer at dataprotection@sthelens.gov.uk

You have the right to lodge a complaint to the Information Commissioner's Office if you believe that St Helens Borough Council has not complied with the requirements of the GDPR or DPA 2018.