Data Controller

NHS West Yorkshire Integrated Care Board

Purpose

The ICB holds personal and confidential information of its staff for employment-related purposes, such as;

  • Recruitment – application forms, collecting references, carrying out DBS checks, payroll and pension information.
  • Payment of salary,
  • Administration of pensions and staff benefits including Trade Union affiliation
  • Managing and monitoring annual leave and sickness
  • Accidents and investigations
  • Disciplinary and grievance proceedings
  • Learning and development
  • Referrals to Occupational Health
  • Disciplinary procedures
  • Workforce information
  • Anonymous data sets used by NHS England / NHS Digital / NHS Jobs

Lawful basis

The ICB’s lawful bases for processing personal data under the UK GDPR:

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

Article 6(1)(f) – processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party

For special category data the basis is article 9(2) b - employment laws.

For criminal conviction information (obtained via the Disclosure and Barring Service (DBS)) processing meets the requirements of Article 10 of the GDPR under Schedule 1, Part 1 of the Data Protection Act 2018 - processing in connection with employment, health and research - Processing necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection.

Relevant legislation: the provisions of the Safeguarding Vulnerable Groups Act 2006 as a basis for carrying our DBS checks.

Type of information used

Personal data: name, date of birth, address, postcode, work email address.

Special category data: racial or ethnic origin, political beliefs and information concerning health.

Information relating to criminal convictions (DBS checks).

Who we will share the information with (recipients)

The ICB shares information with a variety of organisations and individuals for a number of lawful purposes including:

  • Public disclosure under Freedom of Information - e.g. requested names or contact details of senior managers or those in public-facing roles
  • Public disclosure of organogram information showing the staffing structure of the ICB and jobs at different levels including the whole time equivalent and pay scale / band for each post, and in addition the job title in relation to senior manager posts
  • Disclosure of job applicant details - e.g. to named referees for reference checks, to the Disclosure and Barring Service for criminal record checks
  • Disclosure to employment agencies - e.g. in respect of agency staff
  • Disclosure to banks and insurance companies - e.g. to confirm employment details in respect of loan/mortgage applications/guarantees
  • Disclosure to professional registration organisations - e.g. in respect of fitness to practice hearings
  • Disclosure to Occupational Health professionals (subject to explicit consent)
  • Disclosure to police or fraud investigators - e.g. in respect of investigations into incidents, allegations or enquiries
  • Disclosure to Auditors in relation to audit of financial accounts and internal controls.

Do we use any processors

The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.

Microsoft Azure, supported by IT staff, host our data.

NHS Leeds Teaching Hospitals Trust – management of the ESR system for the ICB.

Cloverleaf Advocacy 2000 Ltd – Provider of Oliver McGowan learning disability and autism mandatory training for staff.

Inclusion North CIC – Provider of Oliver McGowan learning disability and autism mandatory training for staff.

How we collect (the source) and use the information

The types of information that the ICB processes include personal information contained within your HR record which you provided us when you started working for the ICB.

How long we will keep the information

6 years after the staff member leaves or the 75th birthday, whichever is sooner.

Your Rights

With regards to your staff record, under the UK GDPR you have the following rights: