Find out more about how we use your information in the following areas:
- Phase 3 of the Joint Working Programme
- Designing and implementing the new NHS England and NHS Improvement joint operating model
- Our workforce – HR and Organisation Development
We are collecting and processing personal data about you for the following purposes:
- As part of phase 3 of the Joint Working Programme there is a legal requirement that during a 45 day consultation period (16 July – 29 August), all staff affected can submit their consultation response for the consideration of the Design Delivery Leads (DDLs) in each area of the 17 regions/directorates involved in the process.
- Any feedback submitted will be used to develop a Consultation Outcomes Report, which will summarise the main themes and this will be published at the end of September. Invite them to participation events.
- Although feedback may be submitted anonymously, if you choose to provide your contact details a member of the Joint Working Programme Team may contact you to discuss your response with you.
- If you would like to ask a question you will need to provide your contact details to receive the response
- In order to successfully implement the change programme, we need to store information about the impact of the new structures on your position and employment, e.g. new posts you may move to or apply for or possible redundancy.
Categories of personal data and sources
The following information will be collected via the consultation/change process about you:
- Your contact details – name, email address and contact telephone number (optional, but required if you want to ask a question)
- The response to the consultation that you provide in the free-text box on the form
- Your Electronic Staff Record information will be used in conjunction with the following information, collected during the change process: information about your acceptance/challenge of your provisional status, posts that you express interest in, interviews you attend, your acceptance or otherwise of posts offered in respect of suitable alternative employment and about any other parts of the change process in which you are involved.
Categories of recipients
Your personal data is received and used by the central Joint Working Programme and HR and OD teams as well as local Joint Working Implementation and HR and OD teams in NHS England and NHS Improvement.
Legal basis for processing
For the GDPR purposes NHS England’s and NHS Improvement’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’., underpinned by our statutory duties to cooperate, and Article 6(1)(c) ‘…legal obligation…’ and Article 6(1)(b) “…processing is necessary for the performance of a contract to which the data subject is party…”.
Where we process any special categories of personal data that you may provide, the condition is 9(2)(b) ‘…processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’
The Joint Working Programme launched the new Operating Model on 1 April 2019. This was the start of the new National Director and Executive Senior Management structure as published and consulted on at the end of 2018.
Part of the preparation work has been to ensure that all staff are aligned to this new senior management structure for 1 April 2019. For many this will not involve a change, but for some this will involve a change of line manager. This will be the only change, and there will be no change in terms and conditions or ways of working.
The Joint Working Programme team are also working on the detailed design of the operating model for all staff at band 9 and below. The Joint Working Programme team is working in partnership with the Unions and any proposed changes to staff terms and conditions which arise from the new design work will be subject to consultation.
Categories of personal data and sources
In order to be able to ensure staff are aligned to the correct senior manager the Joint Working Programme team have used staff records from the Electronic Staff Records and from discussions with individual managers in both organisations. They are also using similar information for the design of the operating model.
The personal data necessary for the alignment and design work includes name, job title, job description, email address, work phone numbers, job grade and pay (salary and allowances), fixed term end date, employment status (permanent, temp, secondment etc), role (part-time, full-time, flexible working arrangements), position in the organisational structure, substantive position, working hours / full time equivalent, primary work location, employee number, assignment status (e.g. career break / maternity leave). From these data items the minimum necessary is used in relation to each member of staff.
Categories of recipients
For individual staff members the data is used by design and delivery leads working in each directorate (2 or 3 per directorate) and shared with relevant managers in both organisations. Information that identifies staff directly is needed because design and alignment requires managers’ knowledge as well as data held on ESR.
As some new directorates are made of a composite of different directorates across both organisations and some of the new functions will be delivered by a combination of NHS England and NHS Improvement staff there is a need for appropriate sharing of information between individuals in both organisations.
Legal basis for processing
For the GDPR purposes NHS England’s and NHS Improvement’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. This is underpinned by our statutory duties to cooperate.
How NHS England and NHS Improvement use personal data jointly for employment purposes
Our joint employment purposes
NHS England and NHS Improvement are working together to establish integrated Human Resources services, and the components of this joint service will be designed and implemented during 2019/2020. The purposes related to employment for which we currently process personal data jointly are:
NHS England and NHS Improvement have established a joint recruitment service, and are responsible as joint controllers for the processing of personal data that you provide on your application, and from other sources. We have engaged the NHS Business Services Authority (NHSBSA) to process applications for employment on our behalf.
NHS BSA works with NHS England and NHS Improvement through each stage of the recruitment process using our end-to-end recruitment system TRAC, this includes pre- and post-interview activities up to confirming the offer of employment and issuing a contract. If you applied for a vacancy using NHS Jobs your application will be imported into the TRAC recruitment system and all information you receive about your application will be generated by TRAC. You may be invited to create a TRAC account if you are shortlisted to enable your application to be managed through the system.
We will use information you have provided to verify your identity when we speak to you, and at all stages of the application process.
For successful applicants
Before agreeing a contract, we will use the information you have provided to complete the following pre-employment checks in line with NHS Employers’ guidance:
- Professional registration checks
- Employment history and reference checks
- Disclosure and Barring Service (DBS) check (if required)
- Work health assessment: to check you are fit to work or confirm what reasonable adjustments are required, if applicable
- Confirming Right to Work, identity, and eligibility for the vacancy
- Meeting safeguarding law requirements where this is relevant to the vacancy role
NHS England and NHS Improvement are also required to monitor the diversity of candidates to ensure we comply with the Equality Act 2010.
Categories of recipients
We share your information with:
- medical professionals, to assess your fitness to work and any reasonable adjustments that you need
- the Disclosure and Barring Service (DBS), if your role requires a DBS check
- with named referees to obtain a reference
- any other organisation who has a legal right to it.
Your information will not be transferred outside the European Economic Area (EEA),
Keeping your personal information
For non- successful applications, personal information in the e-recruitment system will be deleted within 400 days of the advertised application closing date. This information is retained so that we can revisit vacancies and applications in case the vacancy needs re-advertising or to enable us to respond to any candidate queries.
Successful applications will remain in the system for 400 days, but only information relevant to the employment of successful candidates will be retained within staff employment records. This will be specified in your contract of employment. If you withdraw at offer stage, you will not receive any further information and your details may still be retained for 400 days securely outside of the e-recruitment system
We have established a joint analytics team that is responsible for analysing data to enable reporting on compliance with equal opportunities requirements by NHS England and NHS Improvement. This supports workstreams such as the Workforce Race Equality Standard, the public sector Equality Duty and the Gender Pay Gap, which are mandatory for NHS employers.
Record level staff data is required to enable analysis by data items representing any characteristics relevant to equalities monitoring. Personal data including employee number is obtained from the Electronic Staff Record and other sources for example appointments to roles.
The dataset extracted includes employee number, data about role including grade and pay scale, position, type of contract, working hours, also protected characteristics including gender, ethnic origin, disability, marital status, sexual orientation, age band, religious belief.
The employee number is required to enable linkage between datasets.
Access to personal data including employee number is restricted to members of the joint analytics team.
With the introduction of joint working, most teams will include a combination of staff that have employment contracts with either NHS England or NHS Improvement. Line managers may be employed by either organisation. Where this is the case the manager is responsible for ensuring that the duties of both organisations as employers are discharged appropriately in relation to the staff that he or she manage.
Managers have access to the Electronic Staff Records of their staff, and use this to keep employment details up-to-date and manage the development of their staff, training compliance, annual leave and other absence. Managers use personal data relating to the health of their staff for the following purposes:
- Reimbursement of expenses
- Maintenance of professional registration
- Sickness absence management
- Maternity and adoption
- Occupational Health and accommodating special workplace needs.
Sickness absence management
As employers, NHS England and NHS Improvement have legal duties to ensure the health and safety of their employees at work, and that their employees receive their sickness pay allowance entitlement. We must also ensure that we comply with employment rights legislation around sickness absence.
Managers need to know that that their staff are fit for work, and be aware of adjustments that may be to necessary to support staff following a period of sickness. For these purposes they will receive GP fit notes from the staff that they manage. These indicate whether or not an individual is fit for work, and may give advice on any support required to accommodate an illness or condition when returning to work.
Managers will also receive return to work forms completed by their staff, and conduct return to work interviews to agree on any adjustments required.
Managers must ensure that the Electronic Staff Record (ESR) for their staff is kept up to date with sickness absence records. This enables us to comply with employment rights legislation when managing sickness absence.
By analysing the data extracted from the ESR we are able to identify and address any inequalities, and target health and wellbeing interventions.
Maternity, paternity and adoption
Managers are responsible for ensuring that the rights of their staff are respected when they are to become mothers or fathers.
They will receive completed MATB1 and matching certificates, which confirm details around a pregnancy or adoption. These forms are shared with HR and payroll ensuring communication with the employee about their entitlements and correct payment during periods of leave and
Occupational Health and accommodating special workplace needs
Line managers may refer a member of staff, with their consent, for an occupational health assessment.
The NHS England / NHS Improvement Occupational Health Providers are external providers. Managers will share your contact details and referral with the providers as required.
Managers will receive occupational health reports to inform them of any adjustments that are required.
Legal basis for processing for our joint employment purposes
NHS England’s and NHS Improvement’s lawful basis for processing personal data jointly is Article 6(1)(e) ‘…exercise of official authority…’. This is underpinned by our statutory duties to cooperate, and accompanies other the bases that apply, as described below.
For entering into and managing contracts with the individuals concerned, for example our employees the legal basis is Article 6(1)(b) – ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.
Where we have a specific legal obligation that requires the processing of personal data, for example equal opportunities monitoring, the legal basis is Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.
For other processing of personal data about our employees, our legal basis is Article 6(1)(e) – ‘…exercise of official authority…’.
Where we process special categories data for employment purposes the condition is: Article 9(2)(b) – ‘…processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’.
For the processing of information about the health of our workforce, the legal basis is: Article 9(2)(h) – ‘…processing is necessary for the purposes of preventive or occupational medicine…assessment of the working capacity of the employee…the provision of health or social care…’.