Data Controller(s)

NHS Barnsley CCG

NHS Business Services Authority (for the Electronic Staff Record aspect)

Purpose

The CCG holds personal and confidential information if its staff for employment-related purposes, such as recruitment, payment of salary, sickness and absence monitoring and professional development purposes.

Type of information Used

Identifiable: Personal (such as name, address, date of birth) and Special Category (health, racial or ethnic origin information)

Information relating to criminal convictions (DBS checks).

Legal basis

UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

UK GDPR Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of  employment…social protection law in so far as it is authorised by Union or Member State law.

For criminal conviction information (obtained via the Disclosure and Barring Service (DBS)) processing meets the requirements of Article 10 of the UK GDPR under Schedule 1, Part 1 of the Data Protection Act 2018 - processing in connection with employment, health and research - Processing necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection.

Relevant legislation: the provisions of the Safeguarding Vulnerable Groups Act 2006 as a basis for carrying our DBS checks.

How we collect (the source) and use the information

The CCG uses information for the purposes of employment in a variety of ways including:

• Recruitment – application forms, collecting references, carrying out DBS checks, payroll and pension information.
• Managing and monitoring annual leave and sickness.
• Carrying our personal development reviews.
• Referrals to Occupational Health
• Disciplinary procedures.
• Processing staff leavers, retirements and providing references.
• Recruitment of temporary staff/student placements

Data Processors

Sheffield CCG – provide the CCG with a HR service

Victoria Pay Services (Payroll) NHS Sheffield Teaching Hospitals

IBM (system supplier of the Electronic Staff Record - ESR)

Methods Consulting Ltd – management of NHS Jobs (recruitment website)

NHS SBS (finance system) for payroll purposes

Health Management Limited – provider of Occupational Health services

Your Rights

Under UK GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To be notified of data breaches

How long we will keep the information

In accordance with the Records Management Code of Practice for Health and Social Care 2016

Who we will share the information with (recipients)

In addition to the sharing with our named Data Processors above - the CCG shares information with a variety of organisation and individuals for a number of lawful purposes including:

• Public disclosure under Freedom of Information - e.g. requested names or contact details of senior managers or those in public-facing roles
• Disclosure of job applicant details - e.g. to named referees for reference checks, to the Disclosure & Barring Service for criminal record checks
• Disclosure to employment agencies - e.g. in respect of agency staff
• Disclosure to banks & insurance companies - e.g. to confirm employment details in respect of loan/mortgage applications/guarantees
• Disclosure to professional registration organisations - e.g. in respect of fitness to practice hearings
• Disclosure to Occupational Health professionals (subject to explicit consent);
• Disclosure to police or fraud investigators - e.g. in respect of investigations into incidents, allegations or enquiries.

Data Controller(s)

NHS Barnsley CCG

Purpose

The CCG will process information provided by applicants for the management of their application and the subsequent selection process.

Type of information Used

Anonymous – for shortlisting and selection purposes

Identifiable: Personal such as name, address, date of birth etc. - following the short-listing process

Legal basis

UK GDPR Article 6 – 6(1)(c) ‘…necessary for compliance with a legal obligation…’ 

For criminal conviction information (obtained via the Disclosure and Barring Service (DBS)) processing meets the requirements of Article 10 of the UK GDPR under Schedule 1, Part 1 of the Data Protection Act 2018 - processing in connection with employment, health and research - Processing necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection.

Relevant legislation: the provisions of the Safeguarding Vulnerable Groups Act 2006 as a basis for carrying our DBS checks.

How we collect (the source) and use the information

The recruitment process involves passing details provided by you on your application regarding your qualifications, skills and work experience, (but excluding your name, address and other personal data) to the short-listing and selection panels. After shortlisting, the names of those being interviewed will be provided to the interview panel. On occasion the interview panel may include colleagues external to the CCG, such as the Local Authority. Details provided by you are also used to help fulfil our obligations to monitor equality and diversity within the organisation and process your application.

Data Processors

Methods Consulting Ltd – management of NHS Jobs (recruitment website)

NHS Sheffield CCG - HR Shared Services provider

Your Rights

Under UK GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To restrict or stop processing
• To be notified of data breaches

How long we will keep the information

For unsuccessful job applicants, information is retained for 1 year.

For successful applicants, job application information is retained for 3 years.

Who we will share the information with (recipients)

This information is not usually shared outside of the CCG unless an individual external to the CCG is included on the interview panel.