The information you supply or have supplied to the council is regulated by the General Data Protection Regulation (GDPR). This legislation specifies:
- what information can be collected
- how information is stored and used
- the period during which information is stored
- your rights to view and correct the information held
- your right to "be forgotten".
During the application process and during your working life with the council, you are asked to supply personal information for a range of HR processes. This includes your name, address, date of birth, gender, national insurance number and (for some employees only), passport number, birth certificates/marriage certificate, start date, salary, post, work absence information and so on.
Most of the information you provide is required so we pay you correctly and ensure you pay the correct amount of income tax for example. However some data like details on equalities, are provided on a voluntary basis. To comply with data protection legislation, we will make it clear that answering these type of questions isn't mandatory.
Data controller and purpose
The information you have provided and for current staff, continue to provide during your working life will be processed by the London Borough of Tower Hamlets’ Human Resources (including Payroll and Pension) Service to ensure that your employment is legally sound and that we can (for example) provide a safe working environment and pay your salary or pension correctly. We process your data in accordance with the GDPR and if you have any concerns, the council’s Data Protection Officer can be contacted at DPO@towerhamlets.gov.uk.
The appendix details what data we collect and process and the reasons why.
Condition for processing personal data
The appendix details why it is necessary for us to process your personal data and the section of the GDPR under which the data is lawfully processed.
How long do we keep your information?
We will only hold your information for as long as is required by law and to provide you with the necessary services. This will vary according to the information supplied. For example information regarding you and your pension will be retained until after your death and so potentially for many decades.
We may also anonymise some personal data you provide so you cannot be identified and use this for statistical analysis to help the council target and plan the provision of services.
Your personal information may be shared with internal departments or external partners and agencies involved in delivering services on our behalf. For example the information you supply to the council will be processed by Northgate, who manage the HR/Payroll computer system, Altair who manage the computer system used by the pensions team and shared with HMRC to ensure you pay the correct tax. The appendix gives details of the organisations we may share your data with and the circumstances where it may be shared.
The council has a duty to protect public funds and may use personal information and data matching techniques to detect and prevent fraud, and ensure public money is targeted and spent in the most appropriate and cost-effective way. Certain information may be shared with internal services and external bodies like the Audit Commission, Department for Work and Pensions, the Home Office, other local authorities, HM Revenue and Customs, and the Police.
Automated decision making and profiling
Some of the data you provide may be processed by computer and therefore automated decisions may be made. For example your salary payments will, in the main, be calculated automatically. You can ask for this to be explained to you; please check the ‘your rights’ section. We may also use the data to build a profile of the council workforce, to ensure equalities of opportunity and to investigate service delivery improvements. This data would normally be anonymised and never used to make decisions on a specific individual.
Requesting access to your personal data
Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the council’s data protection officer at DPO@towerhamlets.gov.uk.
You have other rights in respect of your data, for example the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.
If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with council’s data protection officer at DPO@towerhamlets.gov.uk in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/.
Your rights and responsibilities
For the purposes of the GDPR, London Borough Tower Hamlets is the Data Controller. Where you are requested to provide information to us, any delays in providing it may result in a delay in the Council providing appropriate services to you. We process your data in accordance with the GDPR. If you have any concerns the Council’s Data Protection Officer can be contacted on DPO@towerhamlets.gov.uk.
You can find out more about your rights under GDPR (including details of your rights about automated decisions, data rectification etc) on the GDPR page.
This notification provides information on the processing of your personal data and as such overrides any previous data protection clauses in your contract of employment as previously issued to you. It is required to ensure that the council acts in accordance with the GDPR.