General Data Protection Regulation
The General Data Protection Regulation (GDPR) / Data Protection Act 2018 came into effect in 2018. It represented a substantial change in how organisations deal with information about you (your Personal Data) and what rights you have in respect of the handling of that Personal Data.
What does it mean for me?
The Information Commissioner’s Office (ICO), which is the regulator for Data Protection matters in the UK, has provided an extensive guidance on GDPR on its website at https://ico.org.uk/ and in particular the Guide to the General Data Protection Regulation found at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/ provides an easy to navigate guide in respect of your Individual Rights under GDPR.
What does it mean for the Council when dealing with my personal data?
For the most part, the Council will continue to use the information it holds on you for the same purpose or purposes it did before the GDPR came into force; namely as your Employer.
In that respect the Council’s processing of your data (holding and using it) may differ from a number of other organisations e.g. those who hold your information for marketing purposes, who may need to seek your permission for all uses of your Personal Data.
We have, in any event, provided this Privacy Notice which explains the basis for our use of your data. If we seek to use your Personal Data in a different manner from that which we state in this Privacy Notice, we will tell you and if necessary, seek your permission unless we are permitted or required by law to use it for such purposes without your request.
Using your personal data
General Approach
This Notice tells you how West Dunbartonshire Council uses your Personal Data. West Dunbartonshire Council, is a local authority established under the Local Government (Scotland) Act 1973 and having its principal place of business at Council Offices, 16 Church Street, Dumbarton, G82 1QL ("the Council", "we" or "us") and in terms of Data Protection legislation is the Data Controller for the Personal Data we hold.
Why do we need your personal information and what do we do with it?
You are giving us your personal information to allow us to effectively manage your employment or prospective employment relationship with West Dunbartonshire Council and for us to meet our obligations to you as an employer or prospective employer.
Throughout the lifetime of your employment relationship with West Dunbartonshire Council the information you provide will be used for the following purposes:
- Your name, national insurance number and contact details, including your home address, telephone numbers and email addresses will be used to identify you and communicate with you as necessary.
- During the recruitment process or at times during your employment information may be gathered to assess your suitability to perform specific roles. In addition, information will be gathered to check eligibility to work in the United Kingdom.
- Information in relation to employment history, qualifications, training certification and licenses (such as a driving license) may be required in order to validate that you are appropriately qualified to undertake the activities of your role (or prospective role) and to ensure calculation of allowances or statutory payments for which you are entitled.
- Personal banking details are required in order to process all payments due to you in respect of your employment with West Dunbartonshire Council.
- Qualification for particular categories of leave; maternity, adoption, shared parental and paternity support leave may require you to provide additional information such dates of confinement, to ensure that you meet the appropriate qualifying criteria and receive appropriate leave and payments.
- Information in respect of your health may be gathered at different times via statutory health surveillance programmes, statutory health assessments or as a result of our recruitment or attendance management arrangements. This information is captured to ensure that we comply with our statutory responsibilities, support employee’s health and wellbeing and manage attendance across the organisation.
- During your employment, you may be invited to disclose personal characteristic information as defined in the Equality Act 2010 and other equalities related information. This information is used for statistical monitoring of the composition of West Dunbartonshire Council’s workforce.
- In some circumstances an employee may engage in “case management” processes, which include but may not be limited to, attendance management, discipline or grievance. In such circumstances, personal information is often disclosed by individuals and recorded in case notes. Such information will be considered as evidence in the case management decision making process. The outcome of such processes will be communicated to you and recorded on file.
- During the course of your employment, use of council equipment and premises may result in the collection of other data. This includes, but is not limited to;
- Dialled telephone numbers and the date, time and duration of incoming and outgoing calls.
- Websites visited, including date, times of visit.
- Emails sent and received, including dates, times, subject, recipient and sender.
- Details of any media files stored on our network
- The use of unencrypted USB devices
- System login times
- Door entry system recordings
- CCTV footage
- Online Training Undertaken
- Vehicle Fleet Emissions - Monitoring and Tracking Equipment
This information may be used for monitoring compliance of employers requirements, investigating and managing conduct and for data matching exercises.
- Some posts require members of staff to have Disclosure checks or PVG checks made against them. In these cases the council will process information regarding criminal convictions (and any police intelligence regarding suspected criminality included in a PVG check) to assess your suitability for the post in question.
Some members of staff may also be service users. We process information on service users (including service users who are members of staff) in accordance with the privacy notices published for the various services we provide and staff should consult those service delivery privacy notices for details of this processing.
Legal basis for using your information:
As your employer we are bound by law to deal with you, as our employee/former employee in a number of ways. These include ensuring your health, wellbeing and safety, that you are a fit and proper person to perform your duties, that you are properly remunerated and have access to a pension, that you do not work excessive hours and that you are treated equally and fairly.
For all of these requirements we require to hold and use your information.
Additionally as we deliver our services to the public through you in either front facing or back of house situations, we may require to use your Personal Data in connection with the delivery of these services (Public Task).
These services are provided in terms of the Council’s functions as a local authority, more details of which can be found on the staff intranet (see in particular the Scheme of Delegation which provides details of many Council Functions).
Therefore, processing your personal information is necessary for the performance of a contract with you (or in the case of recruitment, to take steps to enter into a contract with you). If you do not provide us with the information we have asked for then we will not be able to manage our employment relationship with you. Some information needs to be shared with external bodies because the council is under a legal obligation to do so.
Who do we share your information with?
We are legally obliged to safeguard public funds so details will be checked internally for fraud prevention and verification purposes and may be shared with other public bodies for the same purpose. We are legally obliged to share certain data with other public bodies such as HMRC and will do so where the law requires this; we will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate. Information is also analysed internally in order to provide management information, inform service delivery reform and similar purposes
In some circumstances there will be a requirement to share some information with organisations external to West Dunbartonshire Council. These may include but not be limited to the following:
- Depending upon the nature of your role, relevant information may be shared with relevant registered employment bodies such at the Scottish Social Services Council (SSSC) or General Teaching Council for Scotland (GTCS)
- Information gathered in respect of accidents at work may be gathered and may be shared with the HSE as required.
- Where workplace assessment for qualifications is undertaken personal data may be shared with the appropriate qualifications authority such as the Scottish Qualifications Authority and City and Guilds, for the processing of results and issuing of qualifications.
- Your personal details may be shared with the Council’s insurance provider for the purposes of insurance policies held by the council in respect of Employers Liability Insurance, Indemnification of employees and other insurance purposes as necessary.
- If at any time during or subsequent to your employment you exercise your rights to enter into a dispute via the courts system, including employment tribunal, we may be required to share information in relation to your employment relationship with the courts or legal representatives as required.
- Where an employee/former employee is a member of the local government pension scheme or Scottish Teachers' Superannuation Scheme, there is a requirement to share information to ensure appropriate contributions are made and benefit calculations can be made.
- In circumstances relevant personal data may be shared with third parties in respect of processing payroll deduction made in respect of salary sacrifice contributions, charitable giving arrangements, payments made to satisfy court orders, AVC scheme contributions, trade union subscriptions, credit union contributions.
- If you have ever had an appointment with West Dunbartonshire Council’s current or previous occupational health provider, you may have an occupational health record. Such records are retained by the current occupational health provider. The contents of your medical records are confidential and are not disclosed to West Dunbartonshire Council but will inform any occupational health reports issued to West Dunbartonshire Council by the occupational health provider. Contact information for all employees is additionally held within provider’s online occupational health referral system.
- In the event that West Dunbartonshire Council change occupational health provider, these medical records will transfer directly to the new provider and will not pass to West Dunbartonshire Council.
- In circumstance where you agree to engage with our counselling or other provider of employee well-being services as a result of a management initiated referral or otherwise in the course of your employment,, relevant personal information will be shared with the provider to allow these services to be delivered.
- To permit the Council to operate its occupational health scheme and meet its obligations as Employer in respect of your health and well-being, your personal data which may include Special Category data will be shared with our occupational health provider – PAM Group Limited and their associated companies. Copies of their privacy policy may be found at https://www.pamgroup.co.uk/
- To permit the Council to operate its employee counselling scheme and meet its obligations as Employer in respect of your health and well-being, your personal data which may include Special Category data will be shared with our employee counselling scheme provider – Time for Talking. Copies of their privacy policy may be found at Privacy, Complaints and Data - TimeForTalking (This service will be provided by PAM Group from 1 September 2019)
- The Council is obliged to participate in the National Fraud Initiative in Scotland and in terms of this passes information on staff (primarily payroll data) to Audit Scotland for data matching to detect fraud or possible fraud. Details of this exercise can be found on Audit Scotland’s website at https://audit.scot/what-we-do/counter-fraud. The Council will also co-operate in other initiatives aimed at preventing and tackling crime.
- West Dunbartonshire Council is subject to the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004 (collectively referred to as “FOI”) legislation. Often we receive requests which seek disclosure of information about members of staff. Such requests are assessed carefully and we will only release staff information in response to FOI requests if doing so is compatible with our obligations under data protection law. We will only release non work related information about employees/former employee where we are obliged to do so to comply with law. We will seek the views of current members of staff as to any such release prior to release where practicable..
- Some officers may be required, as part of their duties, to attend or speak at council committees or subcommittees. If these meetings are webcast or audiocast then images and/or audio recordings of the meeting (including the attendance or contribution of officers attending) will be published on the council’s website and the Council’s host’s webcast/audio cast platform.
- If you are the author of a committee report or named as the contact point in that report, your name, service and work telephone number will be published on the committee report on the council website.
International transfers:
Information published on the council’s website (including video footage of webcast meetings, audiocast recordings of meetings and committee reports) can be accessed from anywhere in the world.
How long do we keep your information for?
The Council maintains a records retention and disposal schedule which sets out how long we hold different types of information for. This is available on the council’s intranet site.
Your rights under data protection law:
The General Data Protection Regulation provides you with the following rights regarding your personal information:
- The right to be informed about how your information will be used.
- The right of access to your personal information.
- The right to rectification, which is the right to require the Council to correct any inaccuracies.
- The right to request the erasure of any personal information held by the Council where the Council no longer has a basis to hold the information.
- The right to request that the processing of your information is restricted.
- The right to data portability.
- The right to object to the Council processing your personal information.
- Rights in relation to automated decision making and profiling.
Details on these rights are available in the ICO guide referred to above.
Complaints:
If you do not have access to the internet you can contact us on the above number to request hard copies of the above documents. We seek to resolve directly all complaints about how we handle personal information.
If your complaint is about how we have handled your personal information, you can contact the Council’s Data Protection Officer by email at dataprotection@west-dunbarton.gov.uk.
You also have the right to lodge a complaint about data protection matters with the Information Commissioner's Office, whose contact details are as follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone - 0303 123 1113 (local rate) or 01625 545 745; Website: https://ico.org.uk/concerns
Please note if your complaint is not about a data protection matter and instead concerns employment matters, this should be raised initially with your line manager and if necessary can be raised through our individual grievance procedures.