During the course of its employment activities, East Lancashire Hospitals NHS Trust collects, stores and processes personal information about prospective, current and former staff.
The Trust is registered with the Information Commissioner's Office as a Data Controller: Reference Z8049565.
This Privacy Notice includes applicants, employees (and former employees), workers (including agency, casual and contracted staff), volunteers, trainees and those carrying out work experience.
We recognise the need to treat staff personal and sensitive data in a fair and lawful manner. No personal information held by us will be processed unless the requirements for fair, lawful and transparent processing can be met.
The legal basis for processing your information is under GDPR, Article 6(1) b, that processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. The collection of special categories of personal data is done under GDPR, Article 9(2)h, that data processing is necessary for the management of health or social care systems and services.
In order to carry out our activities and obligations as an employer we process data in relation to:
- Personal demographics (including gender, race, ethnicity, sexual orientation, religion)
- Contact details such as names, addresses, telephone numbers and Emergency contact(s)
- Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks)
- Bank details
- Pension details
- Medical information including physical health or mental condition (occupational health information)
- Information relating to health and safety
- Trade union membership
- Offences (including alleged offences), criminal proceedings, outcomes and sentences
- Employment Tribunal applications, complaints, accidents, and incident details.
- Professional registration and qualifications, education and training history.
- Information relating to employee relations (i.e. disciplinary proceedings, grievances and complaints, tribunal claims, etc)
Our staff are trained to handle your information correctly and protect your confidentiality and privacy
We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected or sold for direct marketing purposes.
Your information is not processed overseas.
This includes, but is not limited to:
- Staff administration and management (including payroll and performance)
- Pensions administration
- Business management and planning
- Accounting and Auditing
- Accounts and records
- Crime prevention and prosecution of offenders
- Education
- Health administration and services
- Information and databank administration
- Sharing and matching of personal information for national fraud initiative.
We have a legal basis to process this as part of your contract of employment, as part of our recruitment processes following data protection and employment legislation or compliance with any legal obligation with applies to us as your employer or potential employer.
The Trust shares staff information with a range of organisations or individuals for a variety of lawful purposes, including:
- Disclosure to data processors - e.g. to companies providing archive storage of personnel records under contract to the Trust
- Public disclosure under Freedom of Information - e.g. requested names or contact details of senior managers or those in public-facing roles
- Disclosure of job applicant details - e.g. to named referees for reference checks, to the Disclosure and Barring Service for criminal record checks, to named GPs for health checks, to housing agencies for staff relocation or accommodation
- Disclosure to employment agencies - e.g. in respect of agency staff
- Disclosure to banks and insurance companies - e.g. to confirm employment details in respect of loan/mortgage applications/guarantees, with individual consent
- Disclosure to professional registration organisations - e.g. in respect of fitness to practice hearings;
- Disclosure to occupational health professionals (subject to explicit consent)
- Disclosure to police or fraud investigators - e.g. in respect of investigations into incidents, allegations or enquiries, or in response to a court order
Confidential staff information is only shared with other organisations where there is a legal basis, when one of the following applies:
- When there is a statutory duty to share staff data
- When there is a statutory power to share staff data
- When the employee has given their explicit consent to the sharing
To enable effective staff administration East Lancashire Hospitals NHS Trust may share your information with external companies to process your data on our behalf In order to comply with our legal and contractual obligations as an employer. This includes providing information to our Payroll provider, East Lancashire Financial Services to enable to processing of payroll, travel expenses and pensions.
This authority is under a duty to protect the public funds it administers, and to this end may use the information you have provided 'for the prevention and detection of fraud. It may also share this information with other bodies responsible for auditing or administering public funds for these purposes.
For further information see; http://oli.xelht.nhs.uk/sorce/beacon/singlepageview.aspx?pii=413&row=952&SPVPrimaryMenu=5& SPVReferrer=home
Or contact your Local Anti-Fraud Specialist Sarah Bailey Mersey Internal Audit Agency (MIAA) Tel: 0151 285 4798.
On commencement of employment with the Trust, your personal data will be uploaded to the Electronic Staff Record (ESR).
ESR is a workforce solution for the NHS which is used by the Trust to effectively manage the workforce leading to improved efficiency and improved patient safety.
In accepting employment with the Trust, you accept that the following personal data will be transferred under the streamlining programme if your employment transfers to another NHS organisation:
- Personal information such as your name, date of birth and contact details
- Recruitment information including qualifications, registrations with professional organisations, National Insurance (NI) Number, etc.
- Payroll information
- Assignment details (job role, department etc.)
- Training records
Streamlining is the process by which certain personal data is transferred from one NHS organisation to another when your employment transfers.
NHS organisations have a legitimate interest in processing your data in this way in establishing the employment of a suitable workforce.
The streamlining programme is a data sharing arrangement which is aimed at improving efficiencies within the NHS both to make costs savings for Trusts but also to save you time when your employment transfers
Information is retained in line with recommended retention schedules set out in the Records Management Lifecycle policy (c080 v1.5)
Trust employees have the right to access personal information about them held by the Trust, either to view the information in person, or to be provided with a copy.
Staff members wanting to access their employment information should contact their Human Resources representative.
Requests are normally fulfilled within 30 calendar days of receiving the request in writing.
There is no charge for this unless the request is deemed to be manifestly unfounded, excessive or repetitive.
If we determine this to be the case we will notify you of this in writing.
Data Protection laws give individuals rights in respect of the personal information that we hold about you.
These are:
1. To be informed why, where and how we use your information.
2. To ask for access to your information.
3. To ask for your information to be corrected if it is inaccurate or incomplete.
4. To ask for your information to be deleted or removed where there is no need for us to continue processing it.
5. To ask us to restrict the use of your information.
6. To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
7. To object to how your information is used.
8. To challenge any decisions made without human intervention (automated decision making)
You have the right to refuse (or withdraw) consent to information sharing at any time. However, this may not be possible if the sharing is a mandatory or legal requirement imposed on the trust. Any restrictions, and the possible consequences of withholding your consent, will be fully explained to you as the situation arises.
For more information on your rights as data subjects please see https://www.elht.nhs.uk/about-us/data-protection-confidentiality-and-fair-processing
Should you have any further queries or wish to lodge a complaint on the uses of your information, please speak to the Trust Data Protection Officer on 01254 7384488 or IGIssues@elht.nhs.uk
For further guidance concerning the General Data Protection Regulation and Subject Access Requests in general, please contact:
The Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Tel: 0303 123 1113 or 01625 545745
Or please see the Information Commissioner's Office website (www.ico.org.uk).