Privacy notice for applicants and employees

St Helens Borough Council is committed to collecting and processing your personal information in accordance with fair and transparent information practices and in accordance with the General Data Protection Regulation (2016/679 EU) and the Data Protection Act 2018.

This notice explains how St Helens Borough Council handles the personal information of job applicants as part of the recruitment and selection of staff.

St Helens Borough Council is the data controller for the information you provide during the process unless otherwise stated. If you have any queries about the process or how we handle your information please contact us at recruitment@sthelens.gov.uk or Human Resources, Corporate Services Department, Town Hall, Corporation Street, St Helens, WA10 1HP.

What personal information is being processed?

We collect a range of information about you. This includes:

• Your name, address and contact details, including email address and telephone number;
• Your National Insurance Number;
• Your Date of Birth and age;
• Details of your qualifications, skills, experience and employment history, including start and end dates with previous employers;
• Information about your current level of remuneration, including benefit entitlements;
• Any information that you provide us during an interview, including interview notes and the records of any tests or assessments;
• Information about your entitlement to work in the UK.

The council may also collect, store and use the following 'special categories' of more sensitive personal information:

• Equal opportunities monitoring information about your ethnic origin, sexual orientation, health, religion or belief, marital status, gender reassignment and age. (you are not required to provide this information for your application to be progressed);
• Information about your health, including any medical condition, health and sickness records;
• Whether or not you have a disability for which the council needs to make reasonable adjustments during the recruitment process;
• Information about criminal convictions and offences.

We collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment; including online tests.

We will also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks (for applicable roles). We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.

Why we process your personal data

St Helens Borough Council needs to process your data in order to:

• take steps at your request prior to entering into a contract with you as part of the recruitment and selection process. For example, the Council needs decide whether you meet the minimum requirements to be shortlisted for a role and whether your application meets the requirements to invite you to an interview. If we decide to call you for an interview, we will use the information you provide us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and carry out appropriate checks.
• enter into a contract with you where your application is successful and you meet all pre-employment checks.
• ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant's eligibility to work in the UK before employment starts.
• manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job.
• consider if we need to make reasonable adjustments to the recruitment process for candidates who have a disability.
• comply with obligations with regard to equal opportunities monitoring (where you have provided this data).
• to seek information about criminal convictions and offences where that is necessary for the role.

We will not use your data for any purpose other than the recruitment exercise for which you have applied.

Lawful basis for processing

We need to collect and use your personal information for a number of purposes, as described above, in relation to the recruitment and selection process.

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the GDPR:

• Article 6(1)(a) where you have given your consent for the processing of your data for a specific purpose, namely the recruitment process. You have the right to withdraw your consent for processing for that purpose at any time;
• Article 6(1)(b) which relates to processing necessary in order to take steps at your request prior to entering into a contract;
• Article 6(1)(c) so we can comply with our legal obligations such as ensuring your right to work within the UK and making reasonable adjustments in our recruitment process.

Where the information we process is special category data, for example your health data or equal opportunities data, the additional bases for processing that we rely on are:

• Article 9(2)(a) where you have given your explicit consent for us to process this data;
• Article 9(2)(b) which relates to carrying out our obligations in respect of employment;
• Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity.

Who we share your information with

Your information will be shared for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, those participating in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

If your application for employment is successful and we make you an offer of employment we may then need to share your data with third parties such as:

• Former employers to obtain references for you;
• Disclosure and Barring Service where criminal records checks are required in respect of the role offered;
• Occupational Health to obtain a pre-employment medical health check;
• Home Office where the right to work in the UK;
• If requested, we are required to share your information to prevent or detect crime, to protect public funds, or in other ways as permitted by law;

In these circumstances the data will be subject to confidentiality arrangements.

How long we keep your personal information

If your application for employment is unsuccessful, St Helens Borough Council will hold your data on file for no more than 12 months after the end of the relevant recruitment process.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained for the duration of your employment and following termination in accordance with our Employee Privacy Notice.

Your data rights

Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data.

Full details of your data rights can be found at www.sthelens.gov.uk/dataprotection

If you believe that the organisation has not complied with your data protection rights, you should discuss the issue with your supervisor or another supervisor or manager and contact the Human Resources department.

If you would like to exercise any of these rights, please contact St Helens Borough Council's Data Protection Officer at dataprotection@sthelens.gov.uk.

You have the right to lodge a complaint to the Information Commissioner's Office if you believe that St Helens Borough Council has not complied with the requirements of the GDPR or DPA 2018.

St Helens Borough Council is committed to collecting and processing your personal information in accordance with fair and transparent information practices and in accordance with the General Data Protection Regulation (2016/679 EU) and the Data Protection Act 2018.

This notice explains how St Helens Borough Council handles the personal information of employees, apprentices, former employees, and temporary agency workers in the course of its human resources activities in order to manage the employment relationship.

What personal information is being processed?

St Helens Borough Council collects and processes a range of information about you. This includes, for example:

• Your name, address and contact details, including email address and telephone number, date of birth and gender;
• Your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• Your remuneration, including entitlement to benefits such as pensions;
• Details of your bank account and national insurance number;
• Information about your marital status, next of kin, dependants and emergency contacts;
• Your nationality and entitlement to work in the UK;
• Your suitability to undertake specified posts (through a DBS check in respect of a criminal record (you will be made aware of the need for a DBS check at the point of application);
• Details of your schedule (days of work and working hours) and attendance at work;
• Details of periods of leave taken by you, including holiday, sickness absence, family leave and the reasons for the leave;
• Details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• Assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
• Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief (it will be your choice whether or not to provide this information at the point of contact).

Why we process personal data

The council needs to process data to:

• Enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide an employment contract, to pay you correctly and to administer benefit and pension entitlements.
• Ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are legally entitled. In other cases, the organisation has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

The following is an illustrative, non-exhaustive list of ways in which the council may process your data:

• Run recruitment and selection processes, including conducting pre-employment checks such as determining your legal right to work in the UK, carry out DBS checks (where necessary), make offers of employment and provide contracts of employment;
• Plan its resources including succession planning, budgetary and financial planning, organisational and development planning and workforce management;
• Process payroll and benefits including salary, tax, salary sacrifice, pensions and business travel and expense management;
• Maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency);
• Operate and keep a record of disciplinary and grievance processes and to carry out internal reviews, investigations and audits;
• Operate and keep a record of employee performance and related processes, to plan for career development, provide workforce development and for education and training purposes;
• Operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• Obtain occupational health advice, to ensure that it complies with duties in relation to individuals with work-related injury and illness or disabilities and to meet its obligations under health and safety law. Ensuring that employees are receiving the pay or other benefits to which they are entitled;
• Operate and keep a record of all types of leave (including maternity, paternity, adoption, parental and shared parental leave) and flexible working arrangements, ensuring that the organisation complies with its duties in relation to leave entitlement, and to ensure that employees receive the pay or other benefits to which they are entitled;
• Manage physical access control, authorise administer, monitor and terminate access to or use of facilities, records, property and infrastructure including communications services such as telephones, laptops and email/internet use;
• Provide references on request for current or former employees.

Lawful basis for processing

We need to collect and use your personal information for a number of purposes as described in relation to the performance of your employment contract.

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the GDPR:

• Article 6(1)(b) which relates to processing necessary for the performance of a contract, that being your contract of employment.
• Article 6(1)(c) so we can comply with our legal obligations as your employer.
• Article 6(1)(f) where processing is necessary for the purpose of our legitimate interest as your employer.

Where the information we process is special category data, for example your health data or equal opportunities data, the additional bases for processing that we rely on are:

• Article 9(2)(b) which relates to carrying out our obligations in respect of employment.
• Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee.

Who we share your information with

Your information will be shared with the Human Resources team, your line manager, senior managers and other relevant officers within the council where this is required for your role.

We may also share your information with third parties such as:

• The Disclosure and Barring Service where a DBS check is required for your role
• HM Revenue and Customs with regard to tax
• Pension providers such as the MPF or TPA where you are a member of a pension which is deducted from your salary
• UK Border or other public authority
• Other third-party organisations as permitted or required by law (for example, if you are in a post that is based at a school and covered by the statutory School Workforce Census, or is covered by the statutory National Minimum Data Set (Adults) or Children's Social Work Workforce surveys, we are required to share information that is relevant to the census/survey with the DfE (Schools and Children's) or Skills for Care (Adults)
• Other third-party organisations with your consent such as for employment verification or bank loans
• Other third parties who are providing a relevant service to the Council (for example Employee Benefits)
• Other third-parties when reasonably necessary such as in the event of a life-threatening emergency.

How long we keep your personal data

Your personal information will be retained for as long as necessary to achieve the purpose for which it was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by applicable law.

The organisation will hold your personal data for the duration of your employment in your personnel file. Following termination of your employment, the periods for which your data is held will depend on the type of data. Some records will be retained for up to 7 years.

Your data rights

Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data.

Full details of your data rights can be found at www.sthelens.gov.uk/dataprotection

If you believe that the organisation has not complied with your data protection rights, you should discuss the issue with your supervisor or another supervisor or manager and contact the Human Resources department.

If you would like to exercise any of these rights, please contact St Helens Borough Council's Data Protection Officer at dataprotection@sthelens.gov.uk

You have the right to lodge a complaint to the Information Commissioner's Office if you believe that St Helens Borough Council has not complied with the requirements of the GDPR or DPA 2018.