Ceredigion County Council website

The purposes for which we use your personal data

As an employer, Ceredigion County Council collects and processes personal data relating to its employees in order to manage the employment relationship and meet our obligations under your employment contract. For example, we need to process your data to pay you in accordance with your employment contract and to administer pension and benefit entitlements.

We will keep and use your information to enable us to undertake our management and administrative functions and manage our relationship with employees effectively, lawfully and appropriately.

We will collect and use information:

• During the recruitment process;
• Whilst you are working for us;
• At the time when your employment ends; and
• After you have left

The information we collect and use enables us to comply with the employment contract, comply with any legal obligations, pursue the legitimate interests of the Council and protect our legal position in the event of legal proceedings. If you do not provide this data, in some circumstances we may be unable to comply with our obligations and we will tell you about the implications of that decision.

In some cases, the Council needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

Some special categories of personal data, such as information about health or medical conditions, are processed to carry out employment law obligations (such as those in relation to employees with disabilities).

Where the Council processes other special categories of personal data, such as information about ethnic origin, sexual orientation or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that the Council uses for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

The legal bases under the UK GDPR and DPA 2018 for the processing of your information are:

• Article 6 (1b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Article 6 (1c) Processing is necessary for compliance with a legal obligation to which the controller is subject;
• Article 9 (2a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
• Article 9 (2b) Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement

What if you do not provide personal data?

You have some obligations under your employment contract to provide the Council with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the organisation with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements.

Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the Council to enter a contract of employment with you. If you do not provide other information, this will hinder the Council's ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

What type of information do we use?

The Council collects and processes a range of information about you. This might include:

• your name, address and contact details, including email address and telephone number, date of birth and gender; the terms and conditions of your employment
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation
• information about your remuneration, including entitlement to benefits such as pensions;
• details of your bank account and national insurance number
• information about your marital status, next of kin, dependants and emergency contacts
• information about your nationality and entitlement to work in the UK
• information about your criminal record
• details of your schedule (days of work and working hours) and attendance at work
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence
• assessments of your performance, including appraisals, performance reviews and ratings, performance improvement plans and related correspondence
• information about medical or health conditions, including whether or not you have a disability for which the Council needs to make reasonable adjustments
• equal opportunities monitoring information including information about your ethnic origin, sexual orientation and religion or belief

The Council may collect this information in a variety of ways. For example, data might be collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); information supplied and entered through employee self-service, from correspondence with you; or through interviews, meetings or other assessments.

Data will be stored in a range of different places, including in your personnel file, in the Council's employee management systems and in other relevant IT systems (including the organisation's email system).

Do we use information received from other sources?

The majority of the information we hold will have been provided by you, but some information may come from other internal sources, such as your manager. In some cases, the Council may collect personal data about you from third parties, such as references supplied by former employers; information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

In addition, we monitor computer (email accounts and electronic systems); telephone/mobile telephone use, as detailed in our Information. Any user that logs on to the Corporate ICT services is formally notified that their activity will be logged and monitored. The log files are monitored for any unusual activity and will be used for any investigation of unauthorised activity either on, or using, the Council’s systems.

Transferring your information abroad

Your information will not be transferred outside the United Kingdom.

Who your information may be shared with (internally and externally)?

We may share your information with the following recipients, depending on your circumstances:

• Internally: Your information may be shared internally, including with members of the People and Organisation service, your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for the performance of their roles
• Externally: The Council may also share your data with third parties. When the Council engages third parties to process personal data on our behalf, we do so on the basis of written instructions, under a duty of confidentiality. Third party organisations are obliged to implement appropriate technical and organisational measures to ensure the security of data, e.g. Pension Providers, Occupational Health provider
• There are also other specific situations where we may be required to disclose information about you, such as:
  • Where the Council is required to provide the information by law (e.g. DBS; HMRC, DWP, National Fraud Initiative)
  • Where disclosing the information is required to prevent or detect a crime
  • Where disclosure is in the vital interests of the person concerned

As an employee of Ceredigion County Council you have access to a range of employee benefit schemes. Please be aware that the Council does not share your personal details (other than your employee number for the purpose of verification) to any of the scheme providers. If you decide to register and take up one of the schemes on offer and subsequently provide your personal information, this is done on a voluntary basis between you and the scheme provider.