How we use personal data for employment purposes
Purposes for processing
We process your personal data in the main because the processing is necessary for the purposes of a contract of employment we have with you. In some cases we may process information only once we have received your consent for us to do so. In other cases we will process data in order to comply with legal requirements, both contractually and non-contractually. The reasons for which we may process your personal data may include (but are not limited to):
- Staff administration (including payroll)
- Pensions administration
- Workforce planning, and provision of facilities such as estates, car parking and IT
- Equal Opportunities Monitoring
- Staff health and wellbeing, safety and security, e.g. CCTV and staff identity badges
- Provision of Management Information
- Surveying of staff to support organisational initiatives
- Business management and planning
- Accounting and Auditing
- Accounts and records
- Crime prevention, detection of fraud and prosecution of offenders
- Management of organisational change
- Supporting emergency preparedness and business continuity
- Health administration and services
- Compliance with obligations, e.g. returns to Cabinet Office / Government departments
Categories of personal data
In order to carry out our activities and obligations as an employer / engaging body we may process the following data:
- Contact details such as names, addresses, telephone numbers
- Emergency contact(s)
- Education and training, incl. development reviews (appraisals)
- Employment / identity records (including professional membership, qualifications, references and proof of identity and eligibility to work in the UK)
- Bank details
- Pay, benefits and Pension details (incl. National Insurance number)
- Information around travel and subsistence; expenses
- For staff driving a vehicle for work purposes: vehicle details, details of driving licence and vehicle insurance, tax, MOT etc.
- Personal demographics (including protected characteristics such as gender, race, ethnicity, sexual orientation, religion, date of birth, marital status, nationality)
- Medical information including mental and physical health
- Information relating to health and safety
- Trade union membership
- Offences (including alleged offences), criminal proceedings, outcomes and sentences
- Employment Tribunal applications, Employee Relations cases, complaints, accidents, and incident details
- Employment details (position, salary, FTE etc.) Status in relation to organisational change
- Support provided under employee assistance programmes
Please note this list is not exhaustive and may change over time.
Information sharing and recipients
There are a number of reasons why we may have to share your personal information with third parties.
There may be circumstances where information is shared without your consent, for example:
- The disclosure is necessary for a statutory function of NHS England or the third party to whom the information is being disclosed;
- There is a statutory obligation to share the data; for example making returns to the Cabinet Office, Department of Health, Office of National Statistics etc.
- Disclosure is required for the performance of a contract
- Disclosure is necessary to protect your vital interest; for example in medical emergency situations
- Disclosure is made to assist with prevention or detection of crime, or the apprehension or prosecution of offenders
- Disclosure is required by a Court Order
- Disclosure is necessary to assist NHS England to obtain legal advice
We may need to share your information with the following organisations:
Recruitment, Employee Records and Contracts Administration (NHS Business Services Authority)
The NHS Business Services Authority (NHS BSA) works in partnership with NHS England to provide a shared HR service. We share information with the BSA and allow them access to employee personal data as they are responsible for undertaking our recruitment (including pre-employment checks; creating and updating all employee data in ESR (see below); and maintaining employee personal files. NHSBSA may work with external service providers in order to provide this service, e.g. electronic recruitment systems and criminal record check systems.
Payroll and Pensions Administration (NHS Shared Business Services (SBS)
The payroll of NHS England is managed by NHS Shared Business Services (SBS). Your personal information will be made available to SBS through the Electronic Staff Record (ESR) (see below) in order to allow them to pay your salary, any associated expenses, to make appropriate deductions and to comply with our legal and statutory obligations. From time to time we may need to share additional information to that held in ESR with SBS in order to ensure that they deliver the services we require and continue meet statutory or contractual obligations. Data will also be shared with pensions providers, e.g. NHS Pensions and NEST.
Electronic Staff Record (ESR)
Your personal information may also be used to fulfil other employer responsibilities, for example, by to maintain appropriate occupational health records, comply with health and safety obligations, carry out any necessary security checks and all other employment related matters. In addition, the information held may be used in order to send to you information which is relevant to our relationship with you. Your information will only be disclosed as required by law or to our appointed agents and/or service providers who may be used for a variety of services; for example, processing of payroll and provision of pensions administration or staff surveys.
IBM, who provide ESR, and its partners as service providers will be responsible for maintaining the system. This means that they may occasionally need to access your staff record, but only to ensure that the ESR works correctly. Where this happens, access will be very limited and is only to allow any problems with the computer system to be investigated and fixed as necessary. They will not have the right to use this data for their own purposes and contracts are in place with the Department of Health to ensure that the data is protected and that they only act on appropriate instructions. IBM and the ESR Central Team may access anonymised data about transactions on the ESR system in order to support the development and optimal use of the system.
Some of your personal information from ESR will be transferred to a separate database, known as the Data Warehouse. This will be used by various Government and other bodies (listed below) to meet their central and strategic reporting requirements. It will allow them to access certain personal information to generate the reports that they need and are entitled to. The Data Warehouse is intended to provide an efficient way of sharing information. Organisations currently granted access to the Data Warehouse are; NHS Digital, NHS Employers, Health Education England and its local committees (LETBs), Deaneries, Department of Health, Welsh Government, NHS Wales Shared Services Partnership, Care Quality Commission, NHS Trust Development Authority, and Monitor. The government may allow further organisations to have access in the future and therefore an exhaustive list cannot be provided, however any organisation having access to your data will have a legal justification for access.
Occupational Health Service Provider
The NHS England Occupational Health Service is managed by an external provider. Your personal information will need to be shared with the provider as and when required in order to allow them to provide NHS England employees and managers with the services required.
Expenses system provider
In order to provide an efficient way for staff to claim expenses, we use a hosted third-party software. Staff data is transferred to and from this system from the ESR system in order to ensure staff are able to claim and be reimbursed for expenses and NHS England can be assured this is within the policy set. The provider meets the ISO27001 information security standard in respect of the security of the data it holds. The provider processes the data in order to advise accurate amounts for reimbursement. The company may also periodically analyse the data in order to review trends and suggest improvements to NHS England.
We provide information to our internal audit function which is provided by an external service provider, in order to ensure NHS England has good processes and systems to manage and protect public funds.
We may provide limited information to third party survey providers in order to collect views from our staff and report on staff engagement within the organisation.
NHS England is responsible for protecting the public funds it manages. To do this we may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds. We may also share your personal information due to:
- Our obligations to comply with current legislation
- Our duty to comply with any Court Order which may be imposed
Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Information is only shared with those agencies and bodies who have a “need to know” or where you have consented to the disclosure of your personal data to such persons.
We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation or other legal basis for disclosure .
We may obtain and share personal data with a variety of other bodies, which may include:
- Her Majesty’s Revenue and Customs (HMRC)
- Disclosure and Barring Service
- Home Office
- Child Support Agency
- Internal Audit, service currently provided by Deloitte LLP
- NHS Counter Fraud Authority
- Department of Health
- Central government, government agencies and departments
- Other local authorities and public bodies
- Ombudsman and other regulatory authorities
- Financial institutes for e.g. banks and building societies for approved mortgage references
- Credit Reference Agencies
- Utility providers
- Educational, training and academic bodies
- Law enforcement agencies including the Police, the Serious Organised Crime Agency
- Emergency services for e.g. The Fire and Rescue Service
- Auditors e.g. Audit Commissioner
- Department for Work and Pensions (DWP)
- The Assets Recovery Agency
- Relatives or guardians of an employee where there is a legal duty to do so
What if the data you hold about me is incorrect?
It is important that the information which we hold about you is up to date. If you believe that the information we hold is incorrect, in the first instance please check if the information can be updated on ESR through the Employee Self Service portal. Guidance is available at: https://nhsengland.sharepoint.com/TeamCentre/TCO/People/Pages/Workforce.aspx
If you are unable to make the change in ESR then please let us know by contacting your line manager and / or the Workforce Systems Team on firstname.lastname@example.org.
Legal basis for processing
For entering into and managing contracts with the individuals concerned, for example our employees the legal basis is Article 6(1)(b) – ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.
Where we have a specific legal obligation that requires the processing of personal data, the legal basis is Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.
For other processing of personal data about our employees, our legal basis is Article 6(1)(e) – ‘…exercise of official authority…’.
Where we process special categories data for employment purposes the condition is: Article 9(2)(b) – ‘…processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’.
For the processing of information about the health of our workforce, the legal basis is: Article 9(2)(h) – ‘ …processing is necessary for the purposes of preventive or occupational medicine…assessment of the working capacity of the employee…the provision of health or social care…’.