What this privacy notice is for?

Our core data protection obligations and commitments are set out in the council’s primary privacy notice at:

• Oldham Council privacy notice

This notice provides additional privacy information for:

• applicants;
• employees (and former employees);
• workers (including agency, casual and contracted staff); volunteers;
• trainees and those carrying out work experience

It describes how we collect, use and share personal information about you:

• before, during and after your working relationship with us, and
• the types of personal information we need to process, including information the law describes as ‘special’ because of its sensitivity

It is important that you read this notice, together with any other privacy information we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Purpose(s)

The main reasons for processing your personal information are:

• Undertaking pre-employment and verification checks during the recruitment process as well as regular checks to view the status of an existing enhanced DBS certificate
• Checking, where relevant to the role and in compliance with the ROA Act 1974, criminal records to determine suitability for appointment
• Making a decision about your recruitment or appointment
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK
• Monitoring your compliance with the organisation’s Information Security guidance and policies
• Paying you and, if you are an employee, deducting tax and National Insurance contributions
• Liaising with your pension provider
• Administering the contract we have entered into with you
• Business management and planning, including accounting and auditing
• Conducting performance reviews, managing performance and determining performance requirements
• Making decisions about salary reviews and compensation
• Assessing qualifications for a particular job or task, including decisions about promotions
• Gathering evidence for possible grievance or disciplinary hearings
• Making decisions about your continued employment or engagement
• Making arrangements for the termination of our working relationship
• Education, training and development requirements
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• Ascertaining your fitness to work
• Managing sickness absence
• Complying with health and safety obligations and public access legislation
• To prevent fraud, including sharing and matching of personal information for the national fraud initiative
• To conduct data analytics studies to review and better understand employee retention and turnover rates
• For equal opportunities monitoring purposes
• To monitor staff engagement and survey results
• For the purpose of independent reviews

Categories of personal data

In order to carry out our activities and obligations as an employer, we process personal information in relation to:

• Personal demographics (including date of birth, gender, marital status and civil partnerships)
• Photographs, CCTV footage and other information obtained through electronic means such as swipecard records
• Contact details such as names, addresses, personal email address, telephone numbers and emergency contact(s)
• Recruitment records (including CV, application form, references, pre-employment and verification checks)
• Employment records (including your workplace, job title, national insurance number, training records, professional memberships, proof of eligibility to work in the UK and security checks)
• Bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Information relating to health and safety (including accident and incident details)
• Information about your use of our information and communications systems
• Disciplinary and Grievance information (including Employment Tribunal applications, complaints)
• Staff survey responses and results
• Health and safety incidents and reports

We may also collect, store and use the following special and sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation (including ensuring meaningful equal opportunities monitoring and reporting)
• Trade union membership (including complying with employment law and paying subscriptions)
• Medical information including physical health or mental condition, sickness and occupational health records (including to comply with employment and other laws, ensure health & safety, assess fitness to work and monitor and manage absence)
• Genetic information and biometric data
• Offences (including alleged offences), criminal proceedings, outcomes and sentences

We will only collect information about criminal convictions if it is appropriate for the employment role and where we are legally permitted or required to do so. We collect information about criminal convictions as part of the recruitment process or may be notified of information directly by you or a 3rd party in the course of your recruitment or employment.

We do not need your consent to use personal or special categories of your personal information to carry out our legal obligations or exercise specific rights in the field of employment law, social security and social protection. In limited circumstances, we may approach you for your written consent to allow us to process your personal information. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us and that where consent is given, you have the right to withdraw it at anytime (without affecting the lawfulness of our processing prior to the withdrawal of your consent).

Legal basis for processing

The legal conditions we rely for processing your personal data are set out in Articles 6(1) (b), (c), (e) and 6(f) and Articles 9 (2) (b), (f) and (h) of the General Data Protection Regulations (GDPR) and are listed below:

• entering into or performing obligations under your contract of employment
• performing or exercising obligations or rights under employment law, social security law or social protection
• general legal obligations we must meet
• where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards
• where it is needed in relation to exercising or defending legal rights (e.g. in relation to legal proceedings and claims)
• your consent (in situations where you have a genuine choice and control over whether your information is processed, including the right to withdraw your consent at any time without detriment)
• our legitimate interests (or those of a third party) provided your interests and fundamental rights do not override those interests
• fraud prevention and protection of public funds
• compliance with any Court Orders
• where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent

Examples of our legitimate interests are:

• to monitor your use of our information and communication systems to ensure compliance with our IT policies.
• to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software
• to carry out regular checks to view the status of an existing enhanced DBS certificate

If statutory or contractual, consequences if information not provided

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Information sharing/recipients

In addition to the general reasons for information sharing described in the council’s primary privacy notice:

• we may share information about you with third parties where required by law, where necessary to fulfil your contract of employment or where we or a third party has a legitimate interest
• for the purposes of the National Fraud Initiative conducted by central government under Section 33 and Schedule 9 of the Local Audit and Accountability Act 2014
• in connection with school workforce census as provided for in Section 114 of the Education Act 2005 and the associated Education (Supply of Information about the School Workforce) (No.2) (England) Regulations 2007/2260, which affects some directly employed council staff working in education
• to obtain pre-employment references from other employers
• to obtain necessary criminal record checks from the Disclosure and Barring Service
• under our duties to comply with any court orders that may be
• for the purpose of independent reviews

As well as information directly collected from candidates in the recruitment process and from employees during the course of employment, we also collect or receive information from:

• former employers
• referees
• employment agencies
• Disclosure and Barring Service
• complainants (e.g. service users/employees)
• next of kin
• health professionals
• public sources, if relevant to employment and job role

Automated Decisions

• All the decisions we make about you involve human intervention

Data retention/criteria

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any future legal, accounting, or reporting requirements.

Once your employment ends we must continue to retain necessary information for a maximum of 6 years and for pensionable employees, certain employment records must be kept until after pension benefits become payable.

If you are an unsuccessful applicant we will only retain your identifiable information for a maximum of 18 months.

Rights of individuals

You have a number of legal rights in relation to your personal information. These apply regardless of your employment status with the Council.

You have a right to be informed about how and why your personal information is being processed. This notice fulfils that obligation. You also have a number of other rights.

Information about:

• these rights and how to exercise them
• contacting our DPO
• raising a concern with us, or
• making a complaint to the Information Commissioner

is accessible in our Guide on Exercising your Rights which is available here:

• Data Protection - web page

We may update or revise this Privacy Notice from time to time and provide supplementary privacy information as is necessary to the Council’s current workforce.