Staff privacy notice

Part of: Privacy statements

As an employer, Haringey Council (the council) must meet its contractual, statutory and administrative obligations. We are committed to ensuring that the personal data of our employees is handled in accordance with the principles set out in the Data Protection Act.

This privacy notice tells you what to expect when the council collects personal information about you. It sits beneath the council’s corporate privacy statement and is relevant to current and former staff of the London Borough of Haringey, including full-time and part-time permanent and fixed-term employees.

The data controller processing your data is the London Borough of Haringey – referred to as ‘Haringey’ or ‘council’ in this document.

Our Registration number is Z5793648 and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. The council is the controller for this information unless this notice specifically states otherwise.

We are committed to protecting your privacy. We have a Data Protection Officer who makes sure we respect your rights and follow the law. For more information see our Data Protection page.

If you have any concerns or questions about how we look after your personal information or wish to exercise your rights to access the information that we hold about you or control how your information is used, please contact Haringey Council’s Data Protection Officer:

What information do we collect from you?

During the course of your time working with us, we will collect, obtain and hold a range of data about you that may be able to identify you directly or indirectly. If and when you cease to be employed by us, we will continue to hold some data about you for a predefined period of time in order to fulfil our remaining tasks and legal obligations.

The personal data that Haringey holds about you as a member of staff will include the following:

  • your name
  • contact details including emergency contacts
  • photograph
  • employee user name
  • employee ID number
  • date of birth
  • sex
  • nationality
  • national insurance (NI) number
  • marital status
  • right to work documentation – for example, passport, visa
  • details of qualifications relevant to your role, for example, social workers
  • pre-employment screening
  • DBS results
  • any criminal convictions that you declare to us
  • your political declaration form in line with our policy and procedure regarding party political activities
  • details of any secondary employment, political declarations, conflict of interest declarations or gift declarations

Job information

We process this information for the payment of your salary, pension and other employment-related benefits. We also process it for the administration of statutory and contractual leave entitlements such as holiday or maternity leave.

  • Your job title and department
  • Information about your employment contract such as:
    • Start and leave date/s
    • Hours
    • Contract type
    • Salary
    • Grade and salary band
    • Changes to your employment contract
    • Working pattern (including any requests for flexible working)
    • Information about any benefits you have received
  • Details of your time spent working and any overtime, expenses or other payments claimed, including details of any loans such as for travel season tickets.
  • Details of periods of leave taken by you, including:
    • Holiday
    • Sickness absence
    • Sabbaticals
    • Special leave
    • Family leave – this includes forms applying for the relevant leave, statutory pay amounts, copies of MATB1 forms/matching certificates and any other relevant documentation relating to the nature of the leave you will be taking.
  • Your bank details for pay and expenses purposes.
  • Tax status information

Performance information

We use this information to assess your performance, to conduct pay and grading reviews and to deal with any employer/employee-related disputes. We also use it to meet the training and development needs required for your role.

  • Assessments of your performance, including:
    • Appraisals
    • Performance reviews and ratings
    • Training you have participated in
    • Performance improvement plans
    • Promotions
  • Details of any probation, disciplinary, capability, sickness or grievance procedures in which you have been involved, including:
    • Any warnings issued to you and related correspondence.
  • Whistleblowing concerns raised by you, or to which you may be a party or witness.
  • Information related to your training history and development needs.

Education and work history

  • Details of your:
    • Qualifications
    • Skills
    • Experience
    • Employment history
  • References given and received

Information about your family or social circumstances

In certain circumstances, we will also hold limited information about your spouse, partner, civil partner, or other individuals. This is collected, for example, where you name them as an emergency contact or where shared parental leave is requested.

Your image

When this has been captured on one of Haringey’s CCTV cameras or captured for your ID badge.

Basic information about your activities in the council offices

We use this information to assess your compliance with corporate policies and procedures and to ensure the security of our premises, IT systems and employees.

  • Use of information and communication systems, such as access times from swipe card access, or an IP address if you access information from a device.
  • Information about your access to data held by us for the purposes of criminal enforcement if you are involved with this work.
  • Information derived from monitoring acceptable IT use standards.

Special category data

Haringey Council may also process some kinds of more sensitive information about you that is classed as ‘special category’ data, and which receives additional protections under law, and in terms of our processing of it. We use this information to comply with our legal obligations and for equal opportunities monitoring. We also use it to ensure the health, safety and wellbeing of our employees.

This includes data about:

  • health, medical conditions or disabilities either declared by you or obtained from health checks, occupational health referrals and reports, sick leave forms, health management questionnaires or fit notes, for example, Statement of Fitness for Work from your GP or hospital.
  • religion or beliefs
  • ethnicity
  • sexual orientation
  • gender identity
  • trade union affiliations, where applicable.
  • information you have provided regarding Protected Characteristics as defined by the Equality Act for the purpose of equal opportunities monitoring. This may be extended to include other protected characteristics.
  • details of any DSE, access needs, risk assessments or reasonable adjustments.
  • accident records if you have an accident at work.

For certain roles, we are required to seek information about past criminal convictions, working with children or vulnerable adults, and/or your fitness to practise in certain regulated professions.

How do we collect this information?

Much of this data we will have asked you to provide to us directly when you started your employment. Alternatively, we may have asked you for it during your employment, or you may have provided it to us independently in order for us to help you with something or update your details.

If we do not receive information directly from you, we either generate it ourselves (such as your council employee ID and username), or we receive it from third parties, such as:

  • HM Revenue and Customs (HMRC)
  • Pensions scheme providers
  • Disclosure and Barring Service
  • Occupational Health
  • Social Work England
  • Individuals or organisations that you named as a referee.
  • An employment agency
  • Your employer if you are a secondee
  • Referees, either external or internal
  • CCTV images from our CCTV systems

We request data from you when you:

  • submit a successful application for a job at the council
  • complete your onboarding as a new starter either online or via paper forms
  • update your personal records by instructing the HR team using an e-form, form or via the Human Resources Employee Self Service system during your employment or ask us to update your record in any way
  • supply emergency contact details – in which case we will assume that the person whose details you give us are happy for these details to be shared with us by you
  • request shared parental leave, in which case we will receive the spouse/partner’s name and the name of their employer either from you or from your spouse/partner’s employer
  • share it during the course of your employment, for example, during correspondence with you, during the annual appraisal process, if you need to take sick leave, apply for new roles, request new courses, or if your role changes
  • are required to ensure that you are remaining to be appropriate to practise in certain regulated professions, working with children or vulnerable adults, for example, DBS and members of Social Work England as appropriate

Why do we collect this information?

We take our obligations around the handling of data very seriously, and it is therefore, important for you to know the various lawful bases that we rely on under data protection law for the processing of your personal data.

In order to be able to process your data lawfully, we must rely on a specific lawful basis, depending on the main reason why we need the data. Below we will explain these lawful bases and when they might be used.

We process data about you under this legal basis when we need to comply with UK legislation, such as in the areas of employment for tax purposes or to comply with the Equality Act, Public Sector Equality Duty or laws around health and safety in the workplace.

Necessary for Haringey Council to perform a contract with you

We process your data in order to carry out the contract of employment we have with you, or to enter into it in the first place – for example, ensure you can work in the UK, pay you a salary and keep records of disciplinary, complaint or grievance proceedings.

Necessary for the purposes of the council’s legitimate interests

Sometimes we will process your data because we have identified a ‘legitimate interest’ in doing so. The legitimate interests we identify are determined through an assessment made by weighing our requirements against the impact of the processing on you. This is done to make sure that our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data.

Examples of when we will process your data in our legitimate interests are:

  • providing you with a Haringey Council staff card, Haringey Council IT account, access to a Haringey Council email account, and give you personalised access to buildings, IT applications, resources and network services such as wifi
  • monitoring use of IT services to ensure adherence to the council’s Acceptable Use Policy
  • providing you with access to training and development services
  • enabling effective communications to you about council operations and keeping you informed and involved with what’s happening at the council
  • contacting those people you have named to be notified in the event of an emergency
  • operating and keeping a record of employee performance and related processes to plan for career development, workforce development, succession planning and workforce management purposes
  • using staff information to conduct strategic analysis, modelling and forecasting to help the council plan ahead
  • analysing the effectiveness of a service that we provide, such as a staff survey. This analysis is carried out at an aggregate level so that you are not identifiable from the data
  • ensuring that we can keep Haringey Council sites safe and secure, and taking measures to prevent and detect crime. This involves capturing images of you in our CCTV system
  • with the council’s employee benefit and wellbeing providers
  • with the council’s insurance brokers and insurers and related third parties, for example, lawyers and loss adjustors for the purpose of risk mitigation, securing insurance cover, maintaining and administering that cover and processing any claims that may arise as a result

Necessary to protect your vital interests or those of another person

On rare occasions, we may need to access or share your information in order to protect your life or that of another person, for example in an emergency situation where we cannot gain your consent or to do so could endanger life. We will only rely on vital interests in extremely limited circumstances when no other legal basis is available.

We may sometimes ask for your consent to do something that involves the use of your personal data. We will do this where no other lawful basis applies and where it makes sense to give you the highest level of control over how your data is used by us.

For this reason, we will not ask for your consent very often where your data is being processed for employment reasons because one of the other lawful bases listed above will often be more appropriate.

However, you would be asked to specifically consent to the processing of your data if, for example, we wished to use your image in marketing materials; wished to send you marketing, or to process your data where we cannot rely on one of the above bases.

Processing in the substantial public interest

For the purpose of securing insurance cover for the general protection of the council and its staff, maintaining and administering that cover and processing any claims that may arise as a result.

Processing your 'special category' personal data

Sensitive personal data, called “special category” data in the legislation, receives extra protection under data protection law. Haringey Council can only process it if we have an additional lawful basis to rely on and meet higher standards for safeguarding it.

Special category data is defined as information which reveals:

  • your race or ethnicity, religious beliefs, sexual life or orientation, or your political opinions, or other protected characteristics.
  • a trade union membership.
  • information about your health, including:
    • any medical condition, health and sickness records
    • occupational health referrals
    • where you leave employment and the reason for leaving is determined to be ill health, injury or disability, the records relating to that decision
    • information required for medical physicians and/or pension providers
    • details of absences from work (other than holidays) including time on sick leave or statutory/family leave

Of the lawful bases available to us, those the council is mostly likely to rely on in relation to staff data are the following:

  • processing is necessary for the establishment, exercise or defence of legal claims against the council
  • we have asked for and received your explicit consent to process your data for a specific purpose

Processing is necessary for us to carry out our obligations or exercise our (or your) rights under employment, social security and social protection law

This would apply when, for example, we:

  • keep a record of reasonable adjustments for a disability to allow us to meet our obligations under the Equality Act
  • ensure that you are physically fit to work in a particular role
  • set up a voluntary salary deduction to a trade union
  • provide employment references confirming your employment with the council to future employers

Processing is necessary for purposes of preventive or occupational medicine and to assess your working capacity as an employee

This would apply when we obtain advice from medical professionals at Occupational Health with regards to making adjustments to your working practices due to a health condition.

Processing is necessary to protect your life or someone else’s

We will rely on this basis on rare occasions when we cannot reasonably get your consent for whatever reason.

Processing is necessary for statistical purposes

Where this is based on UK law, respects your right to data protection and where measures are taken to safeguard your rights and freedoms, such as through the collection of minimal data.

This includes compiling statistics for equal opportunity initiatives.

How long do we keep your information?

As a principle, information about you will not be kept for longer than it is needed for the purpose it was collected.

Haringey Council has records retention schedules which document for how long different information is required. For more detailed information about the personal information that we hold and how we use it, please see our Record of Processing Activities.

As the retention schedules indicate, we need to keep different data for differing periods of time. If you have any queries regarding how long we keep your data that are not answered in the schedules, please email the Data Protection Team at data.protectionact@haringey.gov.uk

When it is no longer required in line with its retention period, personal information is securely and permanently destroyed.

Who do we share your information with?

While you are working with us, we will need to share certain information both internally between departments and with external parties.

As a principle, only minimal information will be shared as necessary and only where we have identified a lawful basis or exemption for doing so, and the data is proportionate to the need. There is guidance and governance in place to help staff to ensure that only the necessary data is made available to other departments or third parties who would not otherwise have access to it.

Some information must be shared by HR with other departments to complete essential tasks related to your employment, such as payroll, occupational health, pensions, arranging access to IT services and providing reasonable adjustments.

Other purposes for which personal data may need to be shared internally

  • Analysis to ensure our compliance with equality of opportunity and diversity legislation (anonymised)
  • Allow for line managers to provide staff with sufficient support in their role
  • Strategic analysis, planning and forecasting
  • Investigating alleged employee misconduct

Third parties with whom information about staff may need to be shared by the council

  • HMRC, or Health and Safety Executive (HSE) to meet statutory reporting obligations
  • External pensions providers to administer staff pensions
  • Occupational Health
  • With the council’s employee benefit and wellbeing providers
  • Social Work England Disclosure and Barring Service to obtain criminal record checks for certain roles
  • Law enforcement agencies for the prevention or detection of crime
  • External auditors
  • Legal advisors to the council, and court of law as necessary
  • Emergency response services as necessary to protect your vital interests or those of another person
  • Public Health England or any appropriately designated body, when we are requested to do so
  • Social Work England
  • Third parties who carry out aspects of processing on our behalf, such as ‘e payslips’.
  • With the council’s insurance brokers and insurers and related third parties – for example, lawyers and loss adjustors for the purpose of risk mitigation, securing insurance cover, maintaining and administering that cover and processing any claims that may arise as a result.
  • Independent investigators who are instructed to carry out a specific investigation in line with our policies and procedures.

Data will be stored in a range of different places in HR management systems including third-party platforms and on other IT systems (including email).

How do we protect your information?

We take the security of your data seriously. Details on council measures surrounding IT security can be found in our Information Security Policy and Statement which sets out the definition of, commitment to and requirements of Information Technology and Security. It specifies regulations to be implemented to secure information and technology that the council manages and to protect against the consequences of breaches of confidentiality, failures of integrity and interruption of availability.

  • We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties
  • Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions contained within a contract, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data

Do we use any data processors? 

Yes – a list of our current data processors can be found in Appendix A below.

What rights do you have in relation to the way we process your data?

As an individual whose data we process (a data subject), you have certain rights in relation to the processing.

You have the right to:

  • withdraw your consent for us to process your personal data where we have relied on that consent as our basis for processing your data.
  • ask us to confirm that your personal data is being processed and to access (have a copy of) that data as well as to be provided with supplemental information about the processing
  • request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
  • have your data erased by us, although in certain circumstances we may not be able to do this
  • restrict the processing of your personal data in certain ways
  • obtain your personal data for reuse
  • object to certain processing of your personal data

If you would like to exercise any of your rights please contact the Data Protection Team at data.protectionact@haringey.gov.uk

Make a complaint

If you have any concerns about the way that we have handled your personal data please email the Data Protection Team at data.protectionact@haringey.gov.uk as we would like to have the opportunity to resolve your concerns.

If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data. Details on how you can do this can be found at the Information Commissioner's Office (ICO).

Further information

Personnel files

Electronic records are held for each member of staff. Data is held securely on Haringey Council systems. You can request your personnel file by emailing the HR Team or by submitting an access request.

Whistleblowing

The council has a policy and procedure in place to enable its current staff and ex-employees to have an avenue for raising concerns about malpractice.

If you wish to raise a concern please refer to our Whistleblowing Policy. Information in this context is processed by us because it is necessary for our compliance with our legal obligations under the Public Interest Disclosure Act 1998.

Although every effort will be taken to restrict the processing of your personal data and maintain confidentiality whether this is possible will be dependent on the nature of the concern and any resulting investigation.

Learning and development

Our Learning and Development Team use online learning platforms or external learning providers to facilitate the delivery of our work-related courses. We will share some information about you with these providers during your employment to ensure you have the necessary access to complete the training required for your role.

We will also share information about you with our training providers. For example, this will include information such as your name, contact details and job role. When necessary we will also share information about any dietary or access requirements that you might have when you attend training events.

Occupational health

During your employment, you may be referred to occupational health following a request to HR by you or your line manager. This may result in a face-to-face consultation, a telephone appointment with an occupational healthcare professional and/or a medical report from a GP or specialist.

We use Preventative Healthcare Company Ltd (PHC) to provide our occupational health service. The information you provide will be held by PHC, who will give us a report with recommendations.

Trade union membership

The recognised unions at Haringey Council (Unison, Unite and GMB) are controllers for the personal information connected to your union membership. The council holds some union subscription details in order to process salary deductions for union membership for which you will have given your consent.

Monitoring of staff

All of our IT systems and the swipe access system for the entry and exit of our premises are auditable and can be monitored, though we don’t do so routinely.

We are committed to respecting individual users’ reasonable expectations of privacy concerning the use of our IT systems and equipment. However, we reserve the right to log and monitor such use in line with our Acceptable Use Policy.

Financial monitoring

We use a financial accounting system to log every financial transaction. This includes any transactions or loans made to staff. If an outstanding debt by a member of staff is highlighted via this process, the council will use this information to take steps to recover the outstanding amount.

Security passes

All staff are issued with a security pass that displays their name, department, staff number and photograph. Staff pass details (names, numbers and photographs) are held on a standalone machine controlled by Facilities and can only be accessed by a restricted number of people. When you leave the council your details are deleted as soon as possible from this system.

Disclosures under the Freedom of Information Act

As a public authority, we receive information requests under the Freedom of Information Act (2000) about our staff and we must consider whether to disclose staff information (including agency and temporary staff) in response to these requests.

We will normally disclose work-related information about staff in a public-facing role. We may also disclose information about staff members whose work is purely administrative if their names are routinely sent out externally.

It is less likely that information about those who do not deal directly with the public in an operational capacity will be disclosed. The Executive Team and the Senior Leadership Team will have more information disclosed about them, such as photographs and biographical detail, due to their position at the council.

We will consider withholding information if we think that it will prejudice the rights and safety of our staff, irrespective of grade or position.

The type of information provided will only concern your professional life at the council. We will not disclose non-work related personal or special category data.

We will consult with you prior to deciding whether to disclose any information that we consider would not be within your reasonable expectations.

Before you begin working at the council, contact HR if you need to make us aware of a specific reason why your information cannot be provided as part of a disclosure. At any later point, if you have any concerns about information being released you need to inform us of this fact.

Requests for references

If you leave or are thinking of leaving, we may be asked by your new or prospective employers to provide a reference. For example, we may be asked to confirm the dates of your employment or your job role. If you are still employed by us at the time the request for a reference is received we will discuss this with you before providing this.

Appendix A – Data processors 

Data processors are third parties who provide certain parts of our staff services for us. Our current data processors are listed below.

Table: list of data processors used by Haringey Council
Data processor Purpose
Matrix Agency vacancies and tracking system
Talent Link Job applications and applicant tracking system
Access Onboarding, pre-employment screening and re-checks as per regulatory requirements
Capita  Onboarding, pre-employment screening and re-checks as per regulatory requirements
Halo Case management/helpdesk calls
V FIRE  Case management/helpdesk calls
Local Government Pension Scheme For administering LGPS Pensions
 
Teachers’ Pension Scheme (TPS) For administering TPS Pensions
 
Preventative Healthcare Company (PHC) Occupational Health provider
Kiddivouchers Childcare voucher provider
 
Cycle scheme Cycle to work scheme
HMRC Taxation
Court Processing Court Orders
SAP HR records and database system
 
Support Revolution  System Support for SAP
Latchams E-payslips 
Swiss post  Pensioners payslips 
Stor-a-file Document storage/archive
Abellio Season ticket loans
Salary Finance Salary Finance loans 
Credit Union Saving scheme
thebigword Translation and transcription