HR privacy notice

The London Borough of Waltham Forest is a data controller under the General Data Protection Regulations (GDPR), 2018 as we collect and process personal information about you in order to provide HR support services. This notice applies to current and former employees, workers and contractors. This notice does not form part of any contract of employment or other contracts to provide services. We may update this notice at any time.

You should read this notice, together with any other privacy notice we may provide in the future when we are collecting or processing personal information about you so that you are aware of how and why we are using your information. We reserve the right to update this privacy notice. We may also notify you in other ways from time to time about the processing of your personal information.

If you have questions regarding this service or our privacy practices, you can contact us by e-mail or in writing at the address below:

HR collects and processes a range of information about you and from third parties.

The following information is collected from you for the performance of an employment contract:

• Your name, date of birth, legal sex
• Contact details including: address, email address and phone number
• The terms and conditions of your employment
• Details of your education, qualifications, skills, experience and your employment history, including start and end dates with previous employers and with the council
• Location of your employment
• Information about your remuneration such as your entitlement to pension benefits
• Details of your bank account
• Information about your private or personal interests that could bring about conflict with the Authority’s interests (this can include interests of family members, partners or anyone else with whom you have a close relationship).

The following information is collected from you to comply with our legal obligations:

• Information about your nationality and entitlement to work in the UK
• Details of your criminal records, we will collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally allowed to do so. We may be notified by you of criminal convictions during the course of your employment with the council. In additional circumstances, due regard will be given The Childcare (Disqualification) Regulations 2009
• Details about your pay, tax, national insurance number and national insurance deductions, your P45, P60 and other third-party deductions such as court orders or student loans
• Details of other jobs and sources of income such as pensions
• Details of your schedule (days of work and working hours) and attendance at work
• Details of periods of leave taken by you including holiday, sickness absence, family leave and sabbatical; and the reasons for the leave to ensure that employees are receiving the pay or other benefits to which they are entitled
• Records of other types of leave (including maternity, paternity, adoption, parental and shared parental leave); to allow effective workforce management to ensure that the council complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefit to which they are entitled
• Information about medical or health conditions through consulting with occupational health (OH). This includes disability status to enable the council to make reasonable adjustments and meet our obligations under health and safety in the workplace. The council needs to ensure that employees are receiving the pay or other benefits to which they are entitled.

The following information is collected from you voluntarily to assist with meaningful monitoring and reporting to support the Council’s equality and inclusion objectives:

• Responses to surveys and feedback requests, including staff surveys and exit questionnaires

Equal opportunities monitoring information including: ethnicity, religion, sexual orientation, gender identity, intersex status, marital status, disability status, socio-economic background.

The following information is collected and processed for the purpose of legitimate interests:

• Performance management and appraisal information and information to determine performance requirements and professional development
• Training records to establish performance objectives and professional development
• Assessing your skills and experience for a particular job, task, promotion and or as part of an organisational restructure in the council; to make decisions about your continued employment
• CCTV footage and other information obtained through electronic means such as swipe card records and your photo for identification purposes
• Information about your dependents and next of kin emergency contact details
• Details of your trade union membership to pay union premiums, register the status of a protected employee and comply with employment law obligations.

The Council has a legitimate interest in processing personal data before, during and after the end of the employment contract. Processing employee data enables the council to:

• Undertake recruitment and promotion processes to attract the most suitably qualified staff
• Maintain accurate and up to date employment records for efficiency in the employment relationship
• Making decisions about pay reviews, honorariums and market supplements to administer the working relationship
• Operate and keep a record of discipline, capability and grievance processes and correspondence, under the implied duty of good faith and to ensure acceptable conduct within the workplace
• Operate and keep a record of employee performance and related processes for professional development; for succession planning and to meet council objectives
• Operate and keep a record of absence and absence management procedures for effective workforce management purposes
• To monitor your use of our information and communication systems to ensure compliance with our IT policies (e.g. outlook, Lync, internet, work phones and laptops)
• To ensure network and information security is maintained at all times. Such includes preventing unauthorised access to council systems and portals including electronic communication systems, and to take steps to prevent the distribution of malicious software
• Run reports for the management of employee processes such as starters, leavers, establishment data, payroll, performance appraisals, Disclosure and Barring Service, fixed-term contracts, visa expiry, absence reports, maternity, paternity, continuous service, age, working hours, contract type, ethnicity, gender and demographics
• To respond to and defend legal claims
• To prevent fraud
• Ensure effective general HR and business administration

Some of the above grounds for processing will overlap and there may be several grounds that justify our use of your personal information.

The Council processes employee data to meet its legal obligations in preventing discriminatory practices as well as in furtherance of its equality and inclusion agenda. To this goal, equality data such as legal sex, ethnicity, age (bands), and disability may display in management reports, in aggregated and/ or anonymised fashion to protect, as much as practically possible, individuals’ confidentiality.

Generally, the information we hold will have been provided by you (on an application or other forms at the start of or during your employment or when we communicate with you (e.g. right to work documents, pension benefit forms). We may also hold information provided by third parties where this is relevant i.e. funding organisations such as the Local Government Association (LGA), The Department for Work and Pensions (DWP), Her Majesty Revenue and Customs (HMRC), Local Government Pension Scheme (LGPS), Teachers Pension Scheme (TPS), Disclosure and Barring Service (DBS), Occupational Health (OH) and references supplied by former employers.

Data will be stored in a range of different places, including your HR file, HR systems and other IT systems such as email and the HR shared drive.

We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases, you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact our ability to provide some services to you.

The legal bases for processing your data are below:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. 

Internally

Your information may be shared internally, including HR and payroll, your service manager and IT staff, where access to the data is necessary for carrying out their work. We may share your contact details with the Council’s Communications team, where contact with you is justified under a lawful basis for processing personal data and/or in line with the purpose for which the data were collected. We will share your personal information confidentially with your service area, as part of our regular reporting activities on council performance and/or in the context of a restructuring exercise. The HR Information System’s Manager’s Dashboard will display aggregated and/ or anonymised information around certain protected characteristics (e.g. legal sex, ethnicity, age band) of employees in the manager’s line of management.

We may share information you have provided, and obtain information about you from other Waltham Forest Council departments such as Housing where held and only as appropriate.

Externally

We may share your information with third parties such as employers to obtain pre-employment references training providers, apprenticeship providers and funding agencies; The Department for Work and Pensions (DWP), The Greater London Authority (GLA), The Local Government Pension Scheme (LGPS), The Teachers’ Pension Scheme (TPS), Occupational Health (OH) and auditors.

Where you are enrolled into the Local Government Pension Scheme, your details will also be held by Wandsworth Council, whose Pensions Shared Service are our Pensions administrators.

The council may share your data in the context of; a sale of some or all of its business/Transfer of Undertakings and Protection of Employment (TUPE). In these circumstances, the council may need to share your information with a regulatory body such as the Redundancy Payments Service (RPS).

We may share your information with the Local Government Ombudsman in the event of complaints.

We may share relevant information with third-party suppliers, e.g. where you voluntarily join staff benefits schemes and you consent to the transfer of certain data to enable effective service provision.

The Council will not transfer your data outside the European Economic Area (EEA).

Information provided to us to deliver HR services are kept for the duration of your employment and we will keep your data after the end of your employment for a minimum of 7 years or 25 years if you work within Children Services after which time it will be securely destroyed.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Further details about retention periods for different aspects of your personal information can be found in the council’s retention policy.

Our Data Protection Officer

Our Data Protection Officer is Mark Hynes, you contact him by email at data.protectionofficer@walthamforest.gov.uk

Protecting your information

Please see the relevant section of the Corporate Privacy Notice.

Your information choice and rights

Please see the relevant section of the Corporate Privacy Notice.

Complaints and contact details

These are included in the relevant section of the Corporate Privacy Notice.

Information Commissioner’s Office

If we’re unable to resolve your complaint to your satisfaction, you can complain to the Information Commissioner's Office (ICO)