Human Resources (HR) Privacy Notice
Read the privacy notice for HR
Employee personal data
This notice is provided for clarification on what the Council needs in order to process information regarding employees (individuals) and to manage the recruitment process.
It's necessary for the Council to gather, collect, store and process personal information relating to employment and prospective employment via the recruitment process.
We take the security of employees data seriously. The Council has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. System restrictions and authorisation requirements are put in place as well as a code of conduct to which all employees are complied to act under key principles of public life.
Where the Council engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
The information we hold and process will be used for the management and administration of your contract with us, during your employment. We'll keep and use the information to enable us to manage our relationship with you effectively, lawfully and appropriately.
The information you provide will be used during the recruitment process, whilst you are working for us and at the time your employment ends and after you have left. We'll only use your personal information when the law allows us to. Mostly commonly, we do this to enable us to comply with your employment contract and any legal requirements.
Personal data includes identifiers such as name, address, data of birth, National Insurance Number, Tax code and personal characteristics such as gender and ethnic group, qualifications/ training, and health, disciplinary or absence information.
Information may also be used to offer employee benefit schemes or salary sacrifice schemes and in the provision of learning and development activities for employees to support them to deliver their duties.
Personal banking details are required in order to process all payments due in respect of employment with the council.
Information in respect of an employee's health may be gathered at different times via statutory health surveillance programs, statutory health assessments or as a result of our recruitment or attendance management arrangements.
This information is captured to ensure that the Council complies with statutory responsibilities, supports employee's health and wellbeing and manages attendance across the organisation.
Information on employees preferred work styles, strengths and learning preferences is also gathered to support effective performance delivery and team working through learning and development activities.
During employment or recruitment, an individual may be invited to disclose personal characteristic information as defined in the Equality Act 2010 and other equalities related information. This information is used for statistical monitoring of the composition of East Renfrewshire's workforce.
Some posts require employees to have Disclosure checks or PVG checks made against them. In these cases the Council may process information regarding criminal convictions
.
The lawful basis for processing personal data is set out in Data Protection legislation. In this case the lawful basis for processing employees' personal data are:
1. Contract: the processing is necessary for a contract (between an individual and their employer or prospective employer)
2. Legal Obligation: the processing is necessary for the Council to comply with the law
3. Public task: the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law (4)
4. Consent: in limited circumstances, for instance relating to employee benefit schemes, the Council may rely on employee consent to process their personal data. Where the Council is relying on employee consent to process personal data, employees have the right to withdraw this consent at any time.
Special Category Data
Data Protection legislation defines Special Category Data as data relating to the processing of personal data regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data, data concerning health or data concerning a person's sex life or sexual orientation.
The Council will have a requirement to process some types of Special Category Data and in particular:
- racial or ethnic origin information for monitoring purposes
- health information for employee assistance and absence monitoring
- Trade Union information
The lawful basis for processing Special Category Data are:
1. The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or the employee in the field of employment law
2. The processing is necessary for the purposes of occupational medicine, for the assessment of the working capacity of the employee
The Council may receive employee personal data from or share employee personal data with the following organisations:
- The Department for Work and Pensions, HMRC and other Government departments
- Police Scotland and other criminal investigation agencies
- Scottish Public Services Ombudsman
- The (UK) Information Commissioner
- The Care Inspectorate
- ·Scottish Social Services Council
- General Teaching Council (Scotland)
- Disclosure Scotland
- Strathclyde Pension Fund
- Scottish Public Pensions Agency
- The Council's occupational health provider
- The Council's external training providers
- Our insurance provider, for the purposes of insurance policies held by the Council in respect of Employers Liability Insurance, indemnification of employees and other insurance purposes as necessary
The Council will disclose information required by law and may share information with other bodies responsible for detecting/preventing fraud or auditing/administering public funds.
We will only keep your personal data for as long as necessary. This means that we must retain some information for periods in line with regulatory or legislative requirements. If there's no regulatory or legal requirement to retain your information this will be a business justification. Full details of how long we'll retain employee personal data can be found within Section 15 of our Record Retention Schedules. After this time personal data will be securely destroyed.
.
If you've concerns about the processing of your personal data by us, you can contact our Data Protection Officer at dpo@eastrenfrewshire.gov.uk.
For independent advice about data protection, privacy and data sharing, Information Commissioner's Office website.
Please contact hrdirect@eastrenfrewshire.gov.uk if you need this policy in an alternative format or require further information.
This notice will be kept under regular review and was last updated February 2025
