1.1 We use the site to ask you some questions about you in the context of your application (“Application”) for a position with us.

1.2. We will use the information that we collect about you only in the context of any Application that you may have made with us. We will use your answers to the questions asked by the site, alongside other information provided in the application and interview process, to evaluate your suitability for the role(s) that you have applied for.

1.3. Decisions about your Application may be based wholly or partly on the answers that you provide.

1.4. You must ensure that the answers that you provide accurately reflect your views. Any failure to do so may result in the rejection of your Application.

1.5. We will keep the answers that you provide on file for approximately 6 months, and may use them in relation to any further applications that you make in that time.

2. Cookies

The site uses cookies to distinguish you from other users of the site. This helps us to ensure that the site works correctly and can identify return visits. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy.

3. Where we store your personal data

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating inside or outside the EEA who work for us or for one of our suppliers. By submitting your information, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy statement.

4. Access to information

The Act gives you the right to access information held about you. Your right of access can be exercised in accordance with the Act. Any access request may be subject to a fee of £10 to meet our costs in providing you with details of the information we hold about you.

5. Changes to our privacy statement

We may change this privacy statement at any time, and such changes may take immediate effect. Any changes we may make to this privacy statement in the future will be posted on this page.

Staff, Applicant and Volunteer Privacy Notice Scope

This privacy notice applies to Trust staff, successful job applicants, former Trust staff, Trust volunteers, unsuccessful job applicants, unsuccessful volunteer applicants, former volunteers, students on work placements, independent contractors and agency workers. This notice explains how and why information is collected about you and the ways in which the information may be used. It describes how we safeguard your information and how long records are kept. It supplements our main Privacy Notice which is available here: https://www.enherts- tr.nhs.uk/help/privacy-data-protection/

For more information on Critical Worker COVID-19 testing, please see the Department of Health and Social Care (DHSC)’s Staff Testing Privacy Notice.

For more information on the COVID-19 Clinical Risk Assessment Tool, please see the separate Privacy Notice available on the Trust website.

Introduction

East and North Hertfordshire NHS Trust holds and processes personal data relating to individuals working or volunteering in the Trust. This is to manage the recruitment process and employment, contracting or volunteering relationship, and to meet its obligations as an NHS employer and service provider. The Trust is committed to being transparent about how it collects and uses that data to meet its data protection obligations. Personal information will be held in compliance with the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy. We aim to maintain high standards and adopt best practice for our record keeping. Your information is never collected or sold for direct marketing purposes.

What types of personal data do we handle?

In order to carry out our activities and obligations as an employer and volunteer manager we handle, as relevant, data in relation to:

• Personal demographics (including gender, nationality, ethnicity, sexual orientation, religion, disability)

• Contact details such as names, addresses, telephone numbers and Emergency contact(s)

• Employment history and pre-employment checks (including, where relevant, Disclosure and Barring Service (DBS) checks, professional membership, academic and vocational qualifications, references, ID checks and proof of eligibility to work in the UK, checks in relation to whether or not you have a criminal record)

• Bank details and National Insurance number

• Pension details

• Medical information including physical or mental health condition(s) that you have

  shared with your manager and/or the Health at Work Service (occupational health

  information)

• Information relating to health and safety

• Trade union membership, where staff make subscription payments via the Trust

  payroll, or where staff advise us they are a trade union member for

  representation purposes

• Information about a criminal record, if applicable

• Employment Tribunal applications, complaints, accidents, and incident details

• Training records

• Terms and conditions of employment

• Information about volunteer roles and shifts

• Payroll records and tax status information

• Details of periods of leave, including holiday, sickness absence, family leave,

  special leave and the reasons for the leave

• ID photographs

• Vehicle details

• Biometric data in relation to attendance records for certain groups of staff

• Details of any disciplinary or grievance procedures in which you have been

  involved including any warnings issued to you and related correspondence

• Assessments of your performance and future potential, including appraisals,

  performance reviews and related correspondence, including in relation to talent management initiatives

  How do we collect personal data?

  The Trust collects your personal data in a variety of ways. For example, data can be collected through application forms, CVs, your passport or other identity documents such as your driving licence, from your referees and from forms completed by you at the start of or during employment (such as benefit nomination forms), from correspondence with you, or through interviews, meetings or other assessments. We also process personal data received from employment agencies and personal services companies in relation to agency workers and contractors.

  Why does the Trust process personal data?

  For employees (and associated groups), the Trust needs to process employee and job applicant data to enter into an employment contract with you and to meet any subsequent obligations under your employment contract. This is covered under General Data Protection Regulation 6(1)b, ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’. For example, the Trust needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer payments and benefits. In some cases, the Trust needs to process data to ensure that it protects an employee’s vital interests (General Data Protection Regulation 6(1)d) or that it is complying with the organisation’s legal obligations (General Data Protection

Regulation 6(1)c), or public interest requirements (General Data Protection Regulation 6(1)e). For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

For volunteers (and associated groups), the Trust processes your Personal Data under the lawful basis of consent (General Data Protection Regulation (6(1)a)) for processing new volunteers, communicating with volunteers effectively and other related activities. At the juncture of agreeing to volunteer at the Trust you will specifically be prompted to give your consent to the Trust for processing the relevant data for this purpose. Once you are registered as a volunteer, the Trust processes existing volunteers Personal Data under the lawful basis of legitimate interest (General Data Protection Regulation (6(1)f)) for managing your volunteer details and other related activities. For more information on these lawful bases, please contact the Trust’s Data Protection Officer via the information below.

In the case of Trust applicants, volunteers and independent contractors (and associated groups), we need to process your personal data in order to undertake the equivalent of ‘pre-employment’ checks, as required in line with NHS Employers Employment Checks Standards, which are also applicable to volunteers (General Data Protection Regulation 6(1)e). This is for the purpose of safeguarding the interests of the Trust, its patients and staff.

Processing personal data allows the Trust to:

• Run recruitment and promotion processes

• Maintain accurate employment, volunteer and contractor records and contact

  details (including who to contact in the event of an emergency)

• Operate and keep a record of disciplinary and grievance (and, for volunteers,

  problem solving) processes

• Operate and keep a record of employee performance and related processes

• Obtain occupational health advice, to ensure it complies with duties in relation

  to individuals with disabilities and meets its obligations under health and

  safety law

• Operate and keep a record of all types of leave, to allow effective workforce

  management, to ensure that the trust complies with duties in relation to leave entitlement and to ensure that employees are receiving the pay or other benefits to which they are entitled

• Provide references on request for current or former employees or volunteers

• Respond to and defend against legal claims

• Maintain and promote equality and diversity in the Trust

• Undertake pension scheme administration

• Assist with crime prevention, detection of fraud and prosecution of offenders

• Comply with obligations as an NHS employer, such as making returns to

  Government bodies/departments

  The Trust processes special categories of personal data (sensitive personal data such as ethnic origin, trade union membership, biometric data, information about

your health, sexual orientation) for a number of purposes, including the following:

• Equal opportunities monitoring

• Administration of sick pay and sick leave, managing sickness absence,

  administering maternity leave and maternity pay

• Managing a safe environment and ensuring fitness to work

• Provision of Health at Work Service

• Payment of trade union membership fees

  What is the legal basis for collecting and processing your personal information?

  We collect and use your information under the following lawful bases:

• Where we have your consent

• Where it is necessary for performance of an employment contract or contract

  for services

• Where it is necessary for compliance with a legal obligation

• Where it is necessary for the purposes of legitimate interests pursued by the

  Trust or by a third party

• Where processing is necessary to protect your vital interests or the vital

  interests of another person

• Where it is necessary for the performance of a task carried out in the public

  interest or in the exercise of official authority vested in the Trust

  Where the personal data we collect about you is special category personal data, we will only process it where at least one of the relevant provisions of Article 9 of the General Data Protection Regulation applies and where necessary the additional provisions of the Data Protection Act 2018 are also applicable. For more information, please contact the Workforce and Organisation Development team or the Trust Information Governance Manager. Where the personal data we process about you is data relating to criminal convictions and offences, we will only process it in accordance with Article 10 of the General Data Protection Regulation and in accordance with the relevant provisions of the Data Protection Act 2018 and related legislation.

  Sharing your Information

  The Trust may obtain and share personal data from / with a variety of other bodies, which may include:

  • Her Majesty’s Revenue and Customs

  • Criminal Records Disclosure and Barring Service

  • Home Office

  • Child Support Agency

  • Internal Audit

  • NHS Counter-Fraud Agency

  • Department of Health

• Central Government, government agencies and departments

• Local authorities and public bodies

• Ombudsman and other regulatory authorities

• Financial institutions, e.g. banks and building societies, for approved

  mortgage references

• Educational and training bodies

• Professional bodies, for example the General Medical Council or Nursing and

  Midwifery Council

• Law enforcement agencies including the Police

• Department for Work and Pensions

• Assets Recovery Agency or Other Competent Authority

  There are a number of reasons why we share information. This can be due to:

• Our obligations to comply with the law

• Our duty to comply with any Court Orders which may be imposed

• Our obligations as an NHS employer

  Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the disclosure of your personal data to such persons.

  In order to comply with our obligations as an employer and volunteer manager, the Trust may use electronic platforms provided by external companies to process your personal information.

  From 2020, volunteer personal information will be processed via the Better Impact platform, hosted by Better Impact Software Ltd. Personal data collected and/or processed through Better Impact Personal will be processed in a manner compliant with the ICO and the GDPR. It will be stored in Canada, which the ICO has determined as having adequacy in terms of data protection legislation. For more information, please see the Better Impact Privacy Notice here: https://www.betterimpact.com/privacy-policy/

  Recruitment applications are processed via the TRAC or NHS Jobs platforms. These platforms are hosted by external companies, such as TRAC Systems Ltd and, in the case of NHS Jobs, by NHS Business Services Authority which provides NHS Jobs via its contractor Jobsite UK (Worldwide) Limited. Some aspects of the Trust recruitment process are carried out by TRAC employees on behalf of the Trust, and they will process your personal information on behalf of the Trust. For more information, please see Schedule 1 – Guidance Notes for Job Applicants.

  Information about bank doctors working via the Temporary Staffing Office (TSOD) is processed via the NHSP Connect platform.

  Personal information which you provide during the course of your employment (including the recruitment process) and your payroll record will be held on the

national NHS Electronic Staff Record (ESR) system, which is hosted by an external provider, IBM.

If you transfer into the Trust from another NHS employer, then we will ask your permission to obtain information from your previous employer via the ESR Inter Authority Transfer automated process, including:

Name, date of birth, home address, nationality, NI number, previous salary and grade/band, employment dates, sickness absence dates, qualifications, training records, NHS service dates, NHS pension record.

We will also ask your permission to provide information via the ESR Inter Authority Transfer process to any future NHS employer you join after leaving this Trust.

We may need to share your Personal Data with our Trusted Data Processor, Think Associates Ltd, for the purposes of processing and storing your training records, learning activities and appraisal documentation. When we do so, your information will remain in the UK and will always be securely encrypted, both in transit and at rest. Your Personal Data is processed for these purposes under the contractual obligation lawful basis as pursuant to UK GDPR, Article 6(1)b. For more information on how your Personal Data is processed, please see Think Associates Ltd’s website, available here: https://www.think-learning.com/

It should be noted that should you require computer access, your Personal Data will be processed by Microsoft, Accenture, NHS Digital and other NHSMail Data (Sub-) Processors as may be required for the purposes of the creation of your user account and for the facilitation and management of your user activities.

We may need to share information about you in the event that the provision of certain services is directed to be transferred to another NHS Trust. We will only do so where the law requires us to do so and when under the supervision of NHS Special Commissioners.

Where departments are using the Health Roster system to roster staff, then some personal information will be held about staff on this system, which is hosted by an external provider, Allocate Software. Limited personal information about bank and agency workers is also held on the Health Roster system.

Where you have contact with the Trust Employee Relations Advisory Service (ERAS), for example in relation to a grievance, disciplinary or sickness absence issue, some personal information will be recorded on the Employee Relations Tracker system, which is hosted by an external provider, Selenity.

Part of the national response to the Covid-19 pandemic is recording the details of who has been vaccinated against Covid-19 and when. Normally, vaccinations are undertaken in GP settings. However, with Covid-19, this will be undertaken in a variety of care settings and for the majority of health and care staff will be managed by “lead providers” on behalf of local health and care organisations. It remains the choice of the individual whether to have the vaccine, but we need to be able to share staff details with the lead providers to ensure all staff are given the chance to receive their vaccination as part of the early cohort and we must record the details of the vaccination and share that to your GP, so your health records are kept up to date.

In addition, with the Covid-19 vaccination, we may have an obligation to let your employer know that you have been vaccinated to support their obligation to safety in the workplace. The lawful basis for this processing is found at Articles:

6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,

Across the East of England a variety of lead providers and existing local/national systems for booking/recording and sharing of the necessary information will be used to enable the ability to rapidly roll-out this vaccination programme to staff.

For more information on the COVID-19 vaccination programme, please see the National COVID-19 and Flu Vaccination Programme Privacy Notice, available at: https://www.england.nhs.uk/contact-us/privacy-notice/national-flu-vaccination- programme/

The Trust will deploy StarLeaf as its Videoconferencing tool during the response to the COVID-19 pandemic, to protect our staff and facilitate social distancing and working from home scenarios.

This will involve sharing your name, email address and location data with StarLeaf, our Data Processor and provider of internal videoconferencing services.
Personal Data in the form of audiovisual likeness may also be processed, but this is not stored by the Trust or StarLeaf on a long-term basis.

If you have any questions or concerns about how your Personal Data is being used, please contact the Trust’s Data Protection Officer via: dataprotection.enh- tr@nhs.net.

For more information on how StarLeaf process your Personal Data, please see their Privacy Notice: https://support.starleaf.com/legal-information/starleaf-privacy- notice/

Attend Anywhere

The Trust will deploy Attend Anywhere as its Virtual Consultation tool during the response to the COVID-19 pandemic, to protect both our patients and our staff and facilitate social distancing and working from home scenarios.
This will involve sharing your name, email address and location data with Attend Anywhere, our Data Processor and provider of virtual consultation services. Personal Data in the form of audiovisual likeness may also be processed, but this is not stored by the Trust or Attend Anywhere on a long-term basis.

If you have any questions or concerns about how your Personal Data is being used, please contact the Trust’s Data Protection Officer via: dataprotection.enh- tr@nhs.net

For more information on how Attend Anywhere process your Personal Data, please see their Privacy Notice: https://www.attendanywhere.com/privacy.html

How long do we keep your information? Job and volunteer applicants

The information collected in relation to unsuccessful job/volunteering applicants and successful applicants who then do not take up a role are kept electronically and/or in hardcopy for 12 months from the date of application. The record is then deleted. Information provided to Health at Work Service by candidates who then do not take up an offer of employment is kept electronically for six months from the date of application and is then deleted. Similarly, DBS check information is stored for six months from the date of application and is then deleted. If you are a successful applicant, key items of your data may be retained in your personnel file. For more information, please see Schedule 1 – Guidance Notes for Job Applicants.

Trust employees, volunteers and leavers

The main staff or volunteer personal file is kept for six years after the employee or volunteer leaves the Trust, in line with the Records Management Code of Practice for Health and Social Care 2016. For staff that joined the Trust before 2014, this may be a combination of paper and electronic files. For staff that joined the Trust from 2014 onward, staff files are in electronic format. All volunteer files are in electronic format. For volunteers who joined Mount Vernon prior to 2020, records may be a combination of paper and electronic files. For volunteers who join Mount Vernon after 2020, files are in an electronic format. For volunteers who volunteered at Lister, all files are in electronic format.

One year after the employee has left the Trust, any paper file will be archived in secure off-site storage facilities. The personal file (paper or electronic) is usually destroyed six years after the employee or volunteer leaves the Trust, although ex- employees’ summary information will be retained on the Electronic Staff Record until the individual’s 75th birthday. Volunteer files are destroyed six years after the volunteer leaves the Trust.

Employee Relations Advisory Service (ERAS) case files are usually kept electronically for 10 years, and are then destroyed. Formal warnings are retained on the staff personal file as a record of employment history.

Health at Work Service health records are retained for six years following the last note entry on the record. Those work health records with health surveillance information will be retained for 40 years following the last note entry.

Minor records of the sort that would normally be held in the line manager’s departmental file are normally retained for at least two years.

available for current staff via the NHS Pension tab in the ‘My Total Reward Statement’ in ESR Self Service. Leavers should contact the NHS Pension Scheme directly via the following website: https://www.nhsbsa.nhs.uk/nhs-pensions.

Your Personal Information Rights

You have the right of access to personal information we hold about you by making a subject access request for a portable copy of your personal data, using the contact details provided below. You also have the right to rectification of any personal data which is inaccurate or incomplete. In certain circumstances you may have the right to object to the way we process your data or the right to request erasure.

How to correct any inaccuracies in your personal data

If you are a current employee and you believe that the personal information the Trust holds about you is incorrect, please check if you can update your record through ESR employee self-service. You can access the ESR portal via the Trust Knowledge Centre using your smart card. Volunteers can check and update information held about you by logging in to your Better Impact account.

If you are unable to make the change via ESR self-service, please email the Resourcing team at hradmin.enh-tr@nhs.net or Medical Workforce team at medicalworkforce.enh-tr@nhs.net and also advise your line manager of your concern.

Contact and Access to records

If you have any questions regarding the information we hold on you, or if you wish to access the personal records held about you by the Trust, please choose one of the following:

• For Medical and Dental staff, email: medicalworkforce.enh-tr@nhs.net

• For other staff groups, email: hradmin.enh-tr@nhs.net

• If you are an agency worker or a contractor, email:

  workforcegovernance.enh-tr@nhs.net

• If you are a volunteer at Lister (and associated sites), email: volunteer.enh-tr@nhs.net

• If you are a volunteer at Mount Vernon Cancer Centre, email: mailto:volunteeringmvcc.enh-tr@nhs.net

  Concerns about your records

  If you have a concern about the way we are collecting or using your personal information, you should raise your concern with us in the first instance, using the contact details above.

  If you are dissatisfied with our response, or if you have any further queries regarding how your personal data is processed, you should contact the Trust’s Data Protection Officer by emailing: dataprotection.enh-tr@nhs.net.

  Page 11 of 14 Version 7.2 – 23rd March 2021

If you are still unhappy with the outcome of your enquiry, you have the right to object to data processing in certain circumstances, which you can do by contacting the Information Commissioner’s Office.

The Information Commissioner Wycliffe House
Water Lane
Wilmslow

Cheshire
SK9 5AF
Telephone: 01625 545700

Schedule 1 – Guidance Notes for Job Applicants

Thank you for your interest in working for us. We are committed to processing any data provided as part of your recruitment application in accordance with the provisions of the Data Protection Act 2018. These guidance notes are intended to explain what we do with your personal details, and what other checks we may make to verify that information.

Employment Checks

In addition to the information provided by you, we may also need to request a Disclosure and Barring Service (DBS) disclosure about you. Further details of our policy in relation to these checks may be found in our Disclosure and Barring Service Checks and Disclosure of Information Policy, available on request.

A financial security check may also be requested for senior staff involved in the management and handling of organisational budgets.

Who sees your Personal Details?

The details provided as part of your job application will be seen by staff dealing with your application in the Resourcing team, including the DBS Disclosure certificate provided by yourself. Any health information provided to the Health at Work service will only be seen by members of that team. Members of the interview panel will only see Part B of the application form, as well as having sight of any references for their preferred candidate after interview.

Where the Resourcing Advisor dealing with your application identifies any issues of concern in relation to the DBS Disclosure and/or confidential declaration, he/she will be responsible for ensuring that a DBS risk assessment is undertaken. This may need to involve a confidential discussion about the disclosure with the recruiting manager.

How we store your Personal Details

Application Form

Electronic applications from NHS Jobs and/or TRAC are held online for 12 months, and are then deleted by the TRAC Jobs team. Electronic/paper copies of application forms are kept on the personal file of successful candidates. Paper copies of application forms for unsuccessful candidates are retained in the HR department for one year, and are then destroyed under secure conditions.

Confidential Declaration Form and DBS Disclosure Form

A copy of these forms will be retained in a secure filing system in the Resourcing department for six months from the end of the recruitment process. The form will then be destroyed under secure conditions. A file note will be retained on the file of the successful candidate to note that the Trust has been in receipt of this information as part of the recruitment process. The precise details of any declaration or disclosure will not be included on the file note. Where a risk assessment has been

completed in relation to either confidential declaration or DBS disclosure, this information will be retained in a secure filing system (not the personal file).

References

References for successful candidates are kept on the personal file of successful candidates. If provided ‘in confidence’, they will not usually be disclosed to the individual concerned without permission.

Health Records

Health screening is undertaken for candidates who are successful at interview and any health information provided to Health at Work is retained by that team in respect of individuals who become Trust employees. Records relating to candidates who do not take up an offer of employment will be destroyed after six months.

Electronic Staff Record

Key items of personal data will be stored on the Trust database, the Electronic Staff Record, for successful candidates.