Workforce privacy notice

Protection legislation requires Cumbria Constabulary to provide people with information about how it uses their information (a privacy notice).

This privacy notice is relevant to all current, prospective and ex- ‘employees’ (which includes staff, officers, specials and PCSOs). It also includes contractors, apprentices and volunteers who undertake roles similar to employees. The Constabulary collects and processes a vast amount of employee personal data across multiple departments. We are committed to being transparent about how we collect and use that data. Therefore, this notice should also be read in conjunction with other Cumbria policies and procedures.  

In this notice, employees can be referred to as ‘you’ and Cumbria Constabulary can be referred to as ‘we’.

The Chief Constable of Cumbria Constabulary is committed to protecting your personal information.  

This Privacy Notice contains important information about:

• what personal details we collect
• what we do with that information
• who we may share it with and why
• your choices and rights when it comes to the personal information you have given to us

We may need to make changes to our Privacy Notice, so please check our website for updates from time to time. If there are important changes such as changes to where your personal data will be processed, we may contact you to let you know.

Who we are

This Privacy Notice is provided to you by the Chief Constable of Cumbria Constabulary who is the data controller of this data.

Your personal data – what is it?

'Personal data' is any information about a living individual which allows them to be identified. Identification can be directly using the data itself, or by combining it with other information which helps to identify a living individual.

The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the General Data Protection Regulation (the GDPR') and the Data Protection Act 2018, and other legislation relating to personal data and rights, such as the Human Rights Act 1998.

The data we may collect

Below is a list of the types of personal data we could collect about you and in some circumstances, family members and people you associate with. Please note, this is in no way exhaustive. The type of personal data and the level of detail collected will depend on the purpose for which it is collected.

Personal Data that we may collect includes:

• Personal details such as name, date of birth, gender, sex, address, ID numbers and contact details, including emergency contact details
• Cumbria Constabulary user details such as collar number
• Bank account details and payroll records
• Salary and grade details
• Records of any compensation payments
• Education and work history
• Marital status, family circumstance and dependents
• A photograph
• Sound, visual images including for example CCTV and Body Worn Video footage
• Data from interactions with systems, software and devices used to perform your job such as e-mail, radios, in vehicle technologies
• Records containing your performance and training
• Records of any disciplinary proceedings
• Sickness and other absence details including emergency leave and annual leave
• Your contract and terms and conditions of employment
• Records of grievances
• Health and safety records
• Welfare records 
• Information about your use of Cumbria Constabulary and national systems

Under certain circumstances we may collect special category personal data. Such data, where collected, even though we may not explicitly ask for it, could reveal the following to differing extents:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade Union membership
• Medical records including physical or mental health
• Sex life or orientation
• Genetic or biometric data

Some of this information may be collected for equal opportunity monitoring purposes.

Please note, any member of staff issued with a device that they set up to use with fingerprint or facial recognition will be required to accept the terms and conditions and provide consent to the provider when setting up functions involving fingerprint or facial recognition.        

Cumbria Constabulary will use the minimum amount of personal information necessary to carry out a particular activity.

Use of criminal data: Criminal information and special category data (where relevant) will be used to protect the public and maintain trust and confidence in our service. This can include escalating its use for a law enforcement purpose. For example:

• Ensuring the integrity of new and existing employees
• Investigating complaints made internally or from members of the public
• Pursuing criminal investigations where a criminal offence is evident

Why we use your information

We may process your data to enable us to carry out functions relating to:

• Personnel Management – to carry out all functions relating to your employment, including general administration of your contract or terms and conditions, but also for the management of the workforce. This may include:
  • Payment of salary and allowances
  • Time management and timesheets
  • Performance management and conducting performance reviews
  • Education, training and development requirements
  • Making decisions about your continued employment or engagement
  • Disciplinary matters and grievances including gathering evidence
  • Health and safety related matters
  • Dealing with legal disputes involving you, including accidents at work and injury award claims
  • Providing employment-related benefits to you, such as occupational sick, adoption, maternity, paternity, shared parental and annual leave
• Occupational Health – to look after your wellbeing and welfare
• Payroll – to manage your wages
• Pensions – to administer and manage your pensions
• Departmental Administration and Management – to provide business continuity, business and workforce planning, to compile a staff directory, inventory data and make travel bookings
• Staff services – to provide services such as reward systems and childcare services
• Communications and Staff Awareness – to draw your attention to key organisational information
• Staff recognition – to acknowledge the good behaviour and conduct of our staff
• Internal Monitoring and Auditing – to monitor your use of our information and communication systems to ensure compliance with policies and procedures and maintain and improve standards. Any staff member using information for a non-business reason, for example, for a personal use, will be committing a criminal offence under Section 170 of the Data Protection Act 2018
• ·Equality and Diversity – to compile workforce demographic and diversity analysis, monitoring and reporting
• Health and safety – we may engage in functions which require us to take actions such as, but not limited to, carrying out individual risk assessments, display screen equipment assessments, workstation assessments to identify reasonable adjustments, and creating and updating accident/incident records in line with Health and Safety in the workplace legislation
• Transport – to monitor your use of Cumbria Constabulary vehicles and radios
• Continuous Improvement – to identify areas to continuously improve the wellbeing of staff, identify areas of focus to enhance our commitment to staff and improve our services to the public. For example, feedback including surveys

The organisation collects this information in a variety of ways. For example, data is collected or obtained from:

• application forms and CVs
• your identity documents such as passport or driving licence
• forms completed at the start of or during employment such as vetting status
• correspondence, or through interviews, meetings or other assessments

Data is stored in a range of different places, including in your personnel file, in the force HR management system and in other IT systems including e-mail.

The legal basis for processing your personal data

Some of the purposes for using your data will overlap and there can be several lawful conditions for processing your personal data.

The Chief Constable of Cumbria Constabulary may process personal data for the following reasons:

• You have given consent for your personal data to be processed
• To comply with employment related legislation
• The performance of a contract with you
• In the legitimate interest of the controller
•  It is necessary for performance of a public task, including law enforcement

The GDPR recognises that because of the imbalance of power between an employer and employees, consent will rarely be considered sufficiently freely given, to then be valid, for the necessary need to process human resources personal data.

Where we process special categories of personal data (special category data was previously defined as sensitive personal data), we will do so in accordance with the specific conditions of processing set out in Data Protection legislation, this includes the following:

• You have given explicit consent for your data being processed
• It is necessary in the context of employment law, or laws relating to social security and social protection – the Force is legally obliged to comply with any request received from statutory and/or regulatory and/or Government Bodies, such as the Inland Revenue, the Child Maintenance Service, the Department of Works and Pensions, the Health and Safety Executive, and the Financial Conduct Authority etc
• It is necessary to protect individuals’ vital interests
• The processing is carried out in the course of the legitimate activities of a charity or not-for-profit body, with respect to its own members, former members, or persons with whom it has regular contact in connection with its purposes
• The processing relates to personal data which have been manifestly made public by the data subject
• It is necessary for the establishment, exercise or defence of legal claims, or for courts acting in their judicial capacity
• It is necessary for reasons of substantial public interest and occurs on the basis of a law that is proportionate to the aim pursued and protects the rights of data subjects
• The processing is required for the purpose of medical treatment undertaken by health professionals, including assessing the working capacity of employees and the management of health or social care systems and services
• The processing is necessary for reasons of public interest in the area of public health
• The processing is necessary for archiving purposes in the public interest, for historical, scientific, research or statistical purposes, subject to appropriate safeguards

Each of the above reasons for processing special category personal data provide an equal legitimate basis for the necessary and proportionate processing of personal data. Again, the GDPR recognises that because of the imbalance of power between an employer and employees, consent will rarely be considered sufficiently given, to then be valid, for the necessary processing of human resources personal data. For example, whilst employers need explicit consent from an employee to undergo a medical examination, and then explicit consent to the release of the report, consent will not be relied upon, for example, used, for the holding, and any other necessary use of the same report.

The Data Controller will comply with data protection law. This says that the personal data we hold about you must be:

• Used lawfully, fairly and in the case of data processed for general, non-law enforcement purposes, in a transparent way
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as is necessary for the purposes we have told you about
• Kept and destroyed securely, including ensuring that appropriate technical and security measures are in place to protect your personal data and to protect personal data from loss, misuse, unauthorised access and disclosure

Sharing your personal data

We may share your personal data internally with relevant departments for the purpose of fulfilling one or more of the above stated legal bases. We may also engage the services of other agencies to meet legal requirements. We may also fulfil another lawful basis this may include obtaining professional services such as legal advice to meet our obligations.

Where we have arrangements to share your personal data, there is a contract, memorandum of understanding or information sharing agreement in place to ensure that the requirements of the data protection legislation on handling personal information are met. Where we are required to disclose information by law, for example for safeguarding purposes, we may do so without these arrangements.

We engage with third party processors who handle some, or all, of the above-mentioned information on our instruction.

Cumbria Constabulary will take steps to ensure any disclosures of personal data are necessary and proportionate, as required by law. Whenever we share your personal information, sharing options will be evaluated to ensure that your data is shared in the most secure manner.

How we keep your personal information secure

We are committed to ensuring that your personal data is safe and processed securely. In order to prevent your personal data from being accidentally lost, used or accessed in an unauthorised manner, altered or disclosed, we have put in place suitable physical, electronic and managerial measures. These include information security awareness training for our staff. We have also compiled procedures to safeguard and secure the information that we hold about you which our staff adhere to.

Who has access to data?

Your personal information will be shared internally through secure work areas and access controls and will be limited to those who have a need to know. This may include members of the HR and recruitment team (including payroll), your line manager, managers in the business area in which you work, IT staff and other departments including Professional Standards where it is necessary for performance of their roles on behalf of the Force and/or in the public interest.

Your data may also be shared with employee representatives in the context of collective consultation. This would be limited to the information needed for the purposes of consultation.

Employees, contractors and other third parties who handle personal data will only process your personal information in line with our direct instructions. Where we employ suppliers to process personal data on our behalf the relevant agreements will be in place.

How long we keep your personal information for

Cumbria Constabulary keeps your personal information for the duration of your employment and for as long as is necessary for the particular purpose, or purposes, for which it is held.

Your rights and personal data

You have the right under data protection legislation to request a copy of your personal data for example, to know what it is used for and how it has been shared. This is called the right of subject access. Requests will be processed in line with legislation, which does place exemptions on the disclosure of personal data in certain circumstances. 

In addition to the right of access, you also have other rights, such as:

• the right to have inaccurate information rectified
• to ask for information to be erased where consent is withdrawn or where other grounds apply
• to have your information restricted (subject to conditions)
• the right to have your data transferred to another organisation (data portability) where the lawful reason for us using your data is based on consent or contract and it is carried out by automated means
• the right to object where the lawful reason for us using your data is based on legitimate interests or a task in the public interest, including profiling

You can find details of how to make such a request on our Privacy Notice page.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, we may provide you with a new notice explaining this new use and setting out the relevant purposes and processing conditions, prior to commencing the processing. If required by law, we will seek your prior consent to the new processing if this is appropriate.

The Data Protection Officer

You have the right to contact the Data Protection officer if you have any concerns about the way the organisation uses your data. They can be contacted by:

Emailing [email protected]

Writing to:
Data and Information Privacy Manager
Digital, Data and Technology Command
Police Headquarters
Carleton Hall
Penrith
Cumbria
CA10 2AU

Complaints

If you have a complaint about the way in which your personal data has been processed, you should contact the Data Protection Officer (details above) in the first instance.

If you are dissatisfied with their resolution to your complaint, you also have the right to complain to the Information Commissioner’s Office who can be contact at the following address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

They can also be contacted by telephoning 08456 306060 or 01625 545745 or by visiting their website at www.ico.org.uk