People Services

In order to comply with articles 13 and 14 of the General Data Protection Regulation (GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and Contact Details of the Data Controller

• Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact Details of the Data Protection Officer

• Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ.

Purposes for Processing

During the course of its employment activities, Lancashire County Council collects, stores and processes personal information about prospective, current and former staff.

This Privacy Notice covers employees (and former employees), workers (including agency, casual and contracted staff), volunteers, trainees and those carrying out work experience.

Lancashire County Council takes the processing of your personal data seriously. Please be assured that your information will be used appropriately in line with data protection legislation; will be stored securely and will not be processed unless the requirements for fair and lawful processing can be met.

We use personal data in accordance with our Information Governance policies and specifically to:

• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights
• produce annual benefit pension statements, calculation of benefits for retirement, redundancy and any other discretionary benefits
• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace
• operate and keep a record of employee performance, practice and related processes, to ensure safe practice and acceptable levels of performance, plan for career development, succession planning and workforce management purposes
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled
• respond to and defend against legal claims
• obtain occupational health advice to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law and ensure that employees are receiving the pay or other benefits to which they are entitled
• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management to ensure that the organisation complies with duties in relation to leave entitlement and that employees are receiving the pay or other benefits to which they are entitled
• provide references on request for current or former employees
• maintain and promote equality in the workplace
• share information as a result of a transfer of undertaking (TUPE)
• run recruitment and promotion processes
• ensure effective general HR record keeping and business administration
• be able to provide you with access to employee benefits such as employee discounts
• use information about your disability status to consider whether we need to provide reasonable adjustments during the recruitment process and/or your employment
• use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting and consider making accommodation for any possible disadvantages.
• Understand your workplace experience so that we can continually develop our workplace support, processes and infrastructure

Pseudonymisation and anonymisation

Lancashire County Council is committed to using pseudonymised or anonymised information as much as is practical, and in many cases, this will be the default position. Pseudonymisation is a procedure by which the most identifying fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. There can be a single pseudonym for a collection of replaced fields or a pseudonym per replaced field. Anonymisation is the process of removing identifying particulars or details for statistical or other purposes.

We may collect your personal information through:

• electronically through an online questionnaire form
• paper questionnaire form
• electronically if you contact us from an email address
• face-to-face interview with an interviewer using a paper or electronic questionnaire
• letter response that you send us

We may use external providers for consultations and surveys. Our electronic annual staff survey data is hosted by Snap Surveys on behalf of Lancashire County Council. The data is stored securely as specified in the Snap Surveys privacy policy.

All information you provide is treated in confidence and in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulations (UK GDPR).

No personal information which can identify you, such as your name or address, will be used in producing reports. We will follow our Data Protection policies to keep your information secure and confidential. Your equality data will be anonymised before it is sent to other teams.

Category of Personal Data being Processed

1. Personal data (information relating to a living, identifiable individual)
2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal Basis for Processing Personal Data

The legal basis for processing your personal data, in accordance with Article 6 (1) of GDPR is:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(d) Vital Interests: the processing is necessary to protect someone's life.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

(f) Legitimate Interests: pursued by the controller or by a third party.

Depending on the processing activity, we rely on all of the above lawful basis to process your personal data.

Where UK GDPR Article 6 (1) (c) Legal Obligation or Article 6 (1) (e) Public Task/Public Interest is relied on, it is relied on by virtue of the following legislation:

• Employment Rights Act 1996
• Equality Act 2010
• Equality Act 2010 (Specific Duties and Public Authorities) Regulations 2017
• Health and Safety at Work Act 1974
• Immigration, Asylum and Nationality Act 2006
• National Minimum Wage Act 1998
• Pension Act 2008
• Trade Union and Labour Relations (Consolidation) Act 1992
• Transfer of Undertakings (Protection of Employment) Regulations 2006
• Working Time Regulations 1999
• Limitations Act 1980
• Access to Medical Reports Act 1998Sex Discrimination Act 1975 & 1986
• Race Relations Act 1976
• Equality Act 2010
• Data Protection Act 2018

Legal Basis for Processing Special Categories of Personal Data

The legal basis for processing your special categories of personal data, in accordance with Article 9 (2) of GDPR is:

(a) The data subject has given explicit consent to the processing of this personal data.

(b) Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

(c) Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

(g) Processing is necessary for reasons of substantial public interest.

(j) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

In addition we rely on the processing condition at Schedule 1 part 1 paragraph 1 of the DPA 2018. This relates to the processing of special category data for employment purposes.

Recipients of the Data

Organisation	Purpose
Vivup and associated organisations and commercial partners	Access to benefits, discounts, offers and other related offerings.
Lancashire County Pension Scheme	Provision of pension benefits
HMRC and related government agencies	Taxation and statutory requirements
Trade Unions (Unite, Unison)	Trade union membership and representation
Banks, building societies and financial institutions	Confirmation of salary and other data
First Advantage, DBS check providers	Confirmation of right to work, security and other required checks
Occupational health provider	Advice on health related issues
Cycle to work scheme	Confirmation of employment

Information we Share

In order to carry out our activities and obligations as an employer we handle data in relation to:

• Equality and Diversity Data or Special Category Data(including gender, race, ethnicity, sexual orientation, religion)
• Contact details such as names, addresses, telephone numbers and Emergency contact(s)
• Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks)
• Bank details
• Pension details
• Medical information including physical health or mental condition (occupational health information)
• Information relating to health and safety
• Trade union membership
• Offences (including alleged offences), criminal proceedings, outcomes and sentences
• Employment Tribunal applications, complaints, accidents, and incident details

The Equality and Diversity Data or Special Category Data is collected for anonymous statistical reporting only.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy.

Any Transfers to Another Country

No data or processing takes place outside the UK.

Retention Periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice. Paper records are securely stored in line with LCC's standards of storage. Electronic and digital records are maintained within LCC's systems and comply with all necessary security requirements. Encrypted files are used when sharing personal data with partners

File Type	Description	Security	Retention period/ When they can go
Electronic and paper records	Teachers' personnel files	Securely held in line with UK policies and procedures	85 years from date of birth
Electronic and paper records	Social care staff files	Securely held in line with UK policies and procedures	50 years from end of employment
Electronic and paper records	Unsuccessful candidate correspondence (such as interview notes)	Securely held in line with UK policies and procedures	12 months from date recruitment finalised
Electronic and paper records	Employee file including performance plan and review, 1:1 notes, training and assessment records. Job description and employee specification Probationary review reports/forms Return to Work Interviews and absence monitoring Employee welfare and counselling service notes Notices of change to name, title, marital status, NI number, ethnicity classification, religion, disability status, next of kin, bank details, car details Certificates of attendance, qualifications, awards and exam results Contract of employment Correspondence regarding redundancy and retirement Letter of Resignation and notifications of termination Changes to job description or conditions of employment (named) Risk assessments including restrictions on lifting etc. (named) Statutory/regulatory training for specific posts (named)	Securely held in line with UK policies and procedures	6 years after termination of service. Note: The official and primary copies of these records should be submitted to LCC's People Services, and copies may not be held on Shared or Local Drives.
Electronic and paper records	Performance plan or review checklist and discussion forms.	Securely held in line with UK policies and procedures	1 year

Your Rights

You have certain rights under the General Data Protection Regulation (GDPR), these are the right:

• to be informed via Privacy Notices such as this.
• to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
• of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter to Information Governance Team, address below.
• of rectification, we must correct inaccurate or incomplete data within one month.
• to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
• to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
• to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
• to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
• in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Or email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact AskHR@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).