Human Resources privacy notice

All personal information is held and processed by East Ayrshire Council in accordance with the Data Protection law.

For information on the role of the Data Controller, Data Protection Officer and contact details for the Council, please refer to our Privacy Statement.

Employee personal data is required to be collected by us in order to carry out our duties as an employer under the employee/employer contract.

Information may also be used to offer employee benefit schemes or salary sacrifice schemes, and in the provision of learning and development activities for employees to support them to deliver their duties.

Personal data includes identifiers such as:

• name
• address
• date of birth
• National Insurance Number
• tax code
• personal characteristics such as gender and ethnic group
• qualifications/ training
• health, disciplinary or absence information

Personal banking

Personal banking details are required in order to process all payments due in respect of employment with the Council.

Employee health

Information in respect of an employee’s health may be gathered at different times via statutory health surveillance programs, statutory health assessments or as a result of our recruitment or attendance management arrangements.

This information is captured to ensure that we comply with:

• statutory responsibilities
• supports employee’s health and wellbeing
• manages attendance across the organisation 

Workstyles, strengths and learning preferences

Information on employees preferred workstyles, strengths and learning preferences is also gathered to support effective performance delivery and team working through learning and development activities.

Equalities related information

During employment or recruitment, an individual may be invited to disclose personal characteristic information as defined in the Equality Act 2010 and other equalities related information.

This information is used for statistical monitoring of the composition of our workforce.

Disclosure or PVG checks

Some posts require employees to have Disclosure checks or Protecting Vulnerable Groups (PVG) checks made against them.

In these cases the we may process information regarding criminal convictions, and any police intelligence regarding suspected criminality included in a PVG check, to assess an employee’s suitability for the post in question.

Service users

Some employees may also be service users.

We process information on service users, including service users who are members of staff, in accordance with the privacy notices published for the various services we provide.

Employees should consult those service delivery privacy notices for details of this processing.

The lawful basis for processing personal data are set out in Data Protection legislation. In this case the lawful basis for processing employees’ data are:

1. Contract – the processing is necessary for a contract between an individual and their employer.
2. Legal obligation – the processing is necessary for the Council to comply with the law.
3. Public task – the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
4. Consent – in limited circumstances, for instance relating to employee benefit schemes, we may rely on employee consent to process their personal data. Where we rely on employee consent to process personal data then employees have the right to withdraw this consent at any time.

Data protection legislation defines Special Category Data as data relating to the processing of personal data regarding:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• the processing of:
  • genetic data
  • biometric data
  • data concerning health
  • data concerning a person’s sex life or sexual orientation

We will have a requirement to process some types of Special Category Data and in particular:

• racial or ethnic origin information for monitoring purposes
• health information for employee assistance and absence monitoring
• trade union information

Lawful basis for processing Special Category Data

The lawful basis for processing Special Category Data are:

1. The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or the employee in the field of employment law.
2. The processing is necessary for the purposes of occupational medicine, for the assessment of the working capacity of the employee.

We may receive employee personal data from or share employee personal data with the following organisations:

• The Department for Work and Pensions and other Government departments
• Police Scotland and other criminal investigation agencies
• Scottish Public Services Ombudsman
• The (UK) Information Commissioner
• The Care Inspectorate
• Scottish Social Services Council 
• Disclosure Scotland
• Strathclyde Pension Fund
• Health & Safety Executive
• Trade Unions
• MyJobScotland
• The Council’s occupational health provider
• The Council’s external training providers
• The Council’s insurance provider, for the purposes of insurance policies held by the council in respect of Employers Liability Insurance, indemnification of employees and other insurance purposes as necessary

Where workplace assessment for qualifications is undertaken, personal data may be shared with appropriate qualifications authorities such as the Scottish Qualifications Authority and City and Guilds for the processing of results and issuing of qualifications.

Similarly such data may be shared with providers of external training courses to enable certificates of accreditation to be issued.

We will also make any disclosures required by law and may also share information with other bodies responsible for:

• detecting or preventing fraud, or
• auditing and administering public funds

We will only keep your information for the minimum period necessary.

After this time, information is deleted/destroyed in accordance with our Council approved Retention Schedule (PDF 814 KB) which explains how long we keep information for.

It is important that we hold accurate and up-to-date information about employees.

If any details have changed, or change in the future, then employees should ensure that they inform Human Resources as soon as possible so that they can update their records.

Under data protection legislation, employees have the right to request access to information about them that the council holds.

Employees also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
• in certain circumstances, transfer their data to another organisation (data portability)

Employees can contact the Council regarding their data protection rights and the processing of their data.

If employees have a concern about the way we are collecting or using their personal data, they should raise their concern in the first instance with their line manager and/or the council’s Data Protection Officer.

Contact details can be found on our Privacy Statement.

Please note if your concern is not about a data protection matter and instead concerns employment matters, this should be raised initially with your line manager and if necessary through our individual grievance procedures.