Data Controller(s)

NHS Sheffield CCG

NHS Business Services Authority (for the Electronic Staff Record aspect)

Purpose

The CCG holds personal and confidential information if its staff for employment-related purposes, such as recruitment, payment of salary, sickness and absence monitoring and professional development purposes.

Type of information Used

Identifiable: Personal (such as name, address, date of birth) and Special Category (health, racial or ethnic origin information)

Information relating to criminal convictions (DBS checks).

Legal basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

GDPR Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of employment…social protection law in so far as it is authorised by Union or Member State law.

For criminal conviction information (obtained via the Disclosure and Barring Service (DBS)) processing meets the requirements of Article 10 of the GDPR under Schedule 1, Part 1 of the Data Protection Act 2018 - processing in connection with employment, health and research - Processing necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection.

Relevant legislation: the provisions of the Safeguarding Vulnerable Groups Act 2006 as a basis for carrying our DBS checks.

How we collect (the source) and use the information

The CCG uses information for the purposes of employment in a variety of ways including:

• Recruitment – application forms, collecting references, carrying out DBS checks, payroll and pension information.
• Managing and monitoring annual leave and sickness.
• Carrying our personal development reviews.
• Referrals to Occupational Health
• Disciplinary procedures.
• Processing staff leavers, retirements and providing references.
• Recruitment of temporary staff/student placements

Data Processors

Victoria Pay Services (Payroll) NHS Sheffield Teaching Hospitals

IBM (system supplier of the Electronic Staff Record - ESR)

Methods Consulting Ltd – management of NHS Jobs (recruitment website)

NHS SBS (finance system) for payroll purposes

Health Management Limited – provider of Occupational Health services

Your Rights

Under GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To be notified of data breaches

How long we will keep the information

In accordance with the Records Management Code of Practice for Health and Social Care 2016

Who we will share the information with (recipients)

In addition to the sharing with our named Data Processors above - the CCG shares information with a variety of organisation and individuals for a number of lawful purposes including:

• Public disclosure under Freedom of Information - e.g. requested names or contact details of senior managers or those in public-facing roles;
• Disclosure of job applicant details - e.g. to named referees for reference checks, to the Disclosure & Barring Service for criminal record checks
• Disclosure to employment agencies - e.g. in respect of agency staff;
• Disclosure to banks & insurance companies - e.g. to confirm employment details in respect of loan/mortgage applications/guarantees;
• Disclosure to professional registration organisations - e.g. in respect of fitness to practice hearings;
• Disclosure to Occupational Health professionals (subject to explicit consent);
• Disclosure to police or fraud investigators - e.g. in respect of investigations into incidents, allegations or enquiries.