Employee Privacy Notice

June 2018

Introduction

  1. This Privacy Notice (the Notice) is to help you understand how and why we collect personal information about you and what we do with that information. It also explains the decisions that you can make about your own information.
  2. Reach2 Academy Trust (the Trust) is ultimately responsible for how the Academy handles your personal information. In this privacy notice, the term ‘Trust’ means the Academies and the Trust.
  3. If you have any questions about this notice please contact Peter Noskiw, Interim Data Protection Officer. He can be contacted at noskiw@reach2.org.
  4. This Notice is aimed at all Trust staff, governors, trustees, experience/placement students, volunteers, certain contractors and agency staff and applicants for employment vacancies. This Notice does not form part of a contract of employment and the Trust may amend this Notice at any time.

What is personal information?

  1. Personal information is information which is about you and from which you can be identified.
  2. This includes your contact details, next of kin and financial information. We may also hold information such as your religion or ethnic group for the purposes of equalities monitoring. CCTV, photos and video recordings of you are also personal information.

What personal information does the Trust hold about you and how is this obtained?

  1. We set out below examples of the personal information the Trust holds about you and where this personal information comes from.
  2. Information about you is gathered during the recruitment process:
    1. 8.1   when you provide certain information to us for example, information about your education, qualifications and professional achievements, on your application form and during any interviews;
    2. 8.2   when we receive your personal information from you and third parties in carrying out pre-employment checks for example, references, confirmation of your fitness to work, your right to work in the UK and criminal records checks.
  3. We will hold information about your job performance. This includes information about skills, achievements, career progression, performance and disciplinary related matters.
  4. We hold and use your financial information, such as your bank details, your salary and pension details.
  5. The Trust will have information that you may have volunteered, such as your religious beliefs and practices or if you do not eat certain foods.
  6. We will hold information about any physical or mental health condition you have which is disclosed to the Trust during the recruitment process or at any stage during your employment.
  7. We will hold information about any protected characteristics you may have, eg. a disability, which you provide on the Equal Opportunities Monitoring Form or at any time during your employment.
  8. Personal information will be created internally by the Trust during the course of your employment. An email from the Headteacher to a member of staff complimenting them on class management would be an example of this.
  9. Personal information may be acquired from outside the Trust community - from occupational health practitioners or from public authorities such as the Police or the Local Authority Designated Officer (LADO).
  10. Parents or carers may provide us with personal information, for example, emails about how you are supporting a pupil at school.
  11. Personal information will also be held on the Single Central Register.

Our legal bases for using your information

  1. This section contains information about the legal bases that we are relying on when handling your information.
  2. The two tables below contain a general description of the different legal bases and the colour code system shows which bases we are relying on for each.
  3. If we do not have a contract with you, for example, if you are a governor, trustee or volunteer, we will not rely on the contractual basis ("CT") to use your information.
Contractual obligation ("CT")

We will need to use your information in order to comply with our contractual obligations under your employment contract with the Trust. For example:

  • we need your name and bank details so that we can pay your salary;
  • we need your name and bank details so that we can pay your salary;
  • we may need to provide your personal information to a pension provider so that you can benefit from your pension entitlement;
  • we may also need to use your personal information to provide contractual benefits.
  • If accommodation is provided under your Contract of Employment we will use your personal information as part of this provision.
Legal obligation ("LO")

We have to comply with various laws and this entitles us to use your information where necessary.
For example:

  • to verify that you have the right to work in the UK;
  • to fulfil our duty of care to you and your colleagues;
  • to fulfil our safeguarding duties towards pupils; and
  • sometimes we will be legally obliged to disclose your information to third parties such as the DBS, local authorities or the Police.
Vital interests

We may use your information where this is necessary to protect your vital interests or someone else's. For example, to prevent someone from being seriously harmed.
Performance of a task carried out in the public interest ("PI")

The following are examples of when we use your information to perform tasks in the public interest:
  • looking after your welfare and development and the welfare and development of others (this includes equal opportunities monitoring);
  • safeguarding and promoting the welfare of our pupils;
  • providing pupils with an education;
  • ensuring the security of the school site which may involve issuing you with photo ID card;
  • making sure that you are complying with your employment obligations;
  • facilitating the efficient operation of the Trust; and
  • ensuring that we comply with all of our legal obligations.
Legitimate interests ("LI")

This means that the Trust is using your information when this is necessary for the Trust's legitimate interests except when your interests and fundamental rights override our legitimate interests.

We have a legitimate interest in using your information to:

  1. promote the Trust including fundraising and publicity;
  2. preserve historical school records.
The Trust must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex or orientation. The bases that we are relying on to process special categories of personal information are set out below:

Employment, social security and social protection ("ESP")

The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Trust and staff in the field of employment, social security or social protection. For example, sometimes this would allow us to disclose your information to third parties such as the Disclosure and Barring Service (DBS) or occupational health services.

Vital interests

To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.

Legal claims ("LC")

The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.

Medical purposes ("MP")

This includes medical treatment and the management of healthcare services.

Substantial public interest ("SPI")

The Trust is also allowed to use special categories of personal information where doing so is necessary in the substantial public interest. This is similar to "Public interest" in the table above, for example the Trust may use special categories of information when providing an education to pupils, looking after the welfare of pupils or when the Trust is inspected.

Why does the Trust use your personal information?

  1. The letters highlighted in different colours below refer to the legal bases we are relying on, please see the section above for an explanation of each.
  2. We commonly use personal information for:
    1. 22.1   providing education and support to pupils - PI, SPI;
    2. 22.2   ensuring that we provide a safe and secure work environment - PI, ESP, SPI;
    3. 22.3   providing employment services, such as payroll and references - CT, PI, SPI;
    4. 22.4   providing training and support - PI, SPI;
    5. 22.5   personnel, administrative and management purposes and to enable us to meet our legal obligations as an employer for example, reporting - CT, LO, PI, ESP, SPI;
    6. 22.6   safeguarding and promoting the welfare of all staff and pupils - ESP, SPI; and
    7. 22.7   fulfilling our contractual and other legal obligations - CT, LO, PI, ESP, SPI.
  3. Some specific examples of when the Trust uses your personal information are set out below:
    1. 23.1   We use your personal information to consider your suitability to work in your role at the Trust - LO, PI, SPI.
    2. 23.2   We check that you have the right to work in the UK by reviewing your identification documents and keeping copies on your personnel file - LO, PI, SPI.
    3. 23.3   We may use your personal information in addressing any performance or disciplinary concerns which arise - PI, SPI.
    4. 23.4   We use information relating to any medical condition you may have in order to verify fitness to work, monitor sickness absence and comply with our duty of care towards you - PI, MP, SPI.
    5. 23.5   We may use your information when dealing with complaints and grievances with which you are involved (eg. from other staff and parents) - PI, SPI.
    6. 23.6   We may use your information when responding to an incident, for example, if something is published on social media which concerns the Trust - PI, LI.
    7. 23.7   We often use photographs and video recordings of staff, for marketing and promotion purposes, including Trust publications, in social media and on the Trust's websites - LI.
    8. 23.8   We will also allow external publication of certain media where it’s appropriate for example, a photograph or article in a local newspaper - LI.
    9. 23.9   We may also make recordings for teaching purposes for example, recording a lesson to provide feedback to you or pupils. We may also record lessons for pupils who were not able to attend in person - PI, SPI.
    10. 23.10   We use CCTV recordings for the purposes of crime prevention and investigation and also in connection with our obligation to safeguard the welfare of pupils, staff and visitors to an Academy site - PI, SPI.
    11. 23.11   The Trust regularly monitors and accesses its IT system for purposes connected with the operation of the Academy or the Trust. The IT system includes any hardware, software, email account, computer, device or telephone provided by the Trust or used for Trust business. The Trust may also monitor staff use of the Trust telephone system and voicemail messages. Staff should be aware that the Trust may monitor the contents of a communication using the Trust’s systems, such as the contents of an email - PI, SPI.
    12. 23.12   The purposes of such monitoring and accessing include:
      1. 23.12.1   to help the Trust with its day to day operations. For example, if a member of staff is on holiday or is off sick, their email account may be monitored in case any urgent emails are received - PI, SPI; and
      2. 23.12.2   to check staff compliance with the Trust's policies and procedures and to help the Trust fulfil its legal obligations. For example, to investigate allegations that a member of staff has been using their email account to send abusive or inappropriate messages - PI, SPI.
    13. 23.13   Monitoring may be carried out on a random basis and it may be carried out in response to a specific incident or concern - PI, SPI.
    14. 23.14   The Trust may also use software which automatically monitors the IT system. For example, it would raise an alert if a member of staff visited a blocked website or sent an email containing an inappropriate word or phrase - PI, SPI
    15. 23.15   If anything of concern is revealed as a result of such monitoring then this information may be shared with legal advisers and may result in disciplinary action. In exceptional circumstances concerns will need to be referred to external agencies such as the Police - PI, SPI.
    16. 23.16   We may keep some old school records for a long time or even indefinitely, for example, to enable the history of an Academy to be kept - LI.
  4. If you fail to provide certain information when requested, we may not be able to perform our obligations under the contract of employment or agreement we have entered into with you, such as paying you or providing a benefit. Alternatively, we may be prevented from complying with our legal obligations, such as to ensure the health and safety of our workers.

How does the Trust share staff personal information with third parties?

  1. We will need to share your information with:
    1. 25.1   the DBS, or organisations with which we contract to carry out this service and / or the Teaching Regulation Agency (previously known as the National College for Teaching and Leadership) if applicable, when complying with our legal duty to carry out pre-appointment suitability checks - LO, PI, ESP, SPI; and
    2. 25.2   the DBS and / or the Teaching Regulation Agency (if applicable) if circumstances arise in which we are required to make a referral to either or both of these bodies - LO, PI, ESP, SPI.
  2. To fulfil our obligations to you as an employer we will need to share your information with medical professionals, such as occupational health services, where we are making a referral - CT, PI,SPI
  3. Occasionally we will use consultants, experts and other advisors, including legal advisors and accountants, to assist us in fulfilling our obligations and to help run the Trust properly. We may need to share your information with them if this is relevant to the work they carry out - PI, ESP, LC,SPI
  4. In accordance with our legal obligations, we will share information with Ofsted, for example, during the course of an inspection, and may need to share your information with the Department for Education - LO, PI, ESP,
  5. As an employer we must check if you can work in the UK before we employ you. Additionally, if you are sponsored by us under Tier 2 or Tier 5 in certain circumstances we will have to provide information about you to UK Visas and Immigration to comply with our duties as a sponsor - LO, PI,SPI
  6. We may share some of your information with our insurance company or benefits providers for example, where there is a serious incident or to ensure that you are able to take advantage of the benefit - CT, PI, ESP, LC,SPI
  7. We may need to share information about you with the Health and Safety Executive (a government organisation) if there is a health and safety issue at the Trust - LO, PI, ESP,SPI
  8. We may need to share your information with the Education and Skills Funding Agency e.g. if we need to make a serious incident report - LO, PI, ESP,SPI
  9. If the Trust is dealing with a complaint or grievance we may need share your information with other parties for example, appropriate staff at the Trust, a colleague or parent making the complaint and governors or trustee] - LO, PI,SPI
  10. If appropriate, we will share your information with individuals connected to the Trust who are exercising their data protection rights, for example, when responding to a subject access request - LO, PI,SPI
  11. We will share personal information about staff with the relevant statutory agencies if it is appropriate to share this information to investigate allegations of misconduct - LO, PI, ESP,SPI
  12. We may need to share your information with the LADO in accordance with our safeguarding obligations - LO, PI, ESP,SPI
  13. On occasion, we may need to share your information with the police for the prevention and investigation of crime and the prosecution of offenders. We will only do this in specific circumstances to assist the police with their investigations. In exceptional circumstances CCTV recordings may be disclosed to third parties - LO, PI, ESP,SPI
  14. If appropriate, we will share your information with parents and pupils where this is related to your professional duties, such as information about the subjects you teach - LO, PI, ESP,SPI
  15. We may need to share your information if there is an emergency for example, if you are hurt in an accident - LO, PI, ESP, MP,SPI
We sometimes use contractors to handle personal information on our behalf. The following are examples:

  • our payroll provider;
  • IT consultants who might access information about you when checking the security of our IT network; and
  • we use third party "cloud computing" services to store some information rather than the information being stored on hard drives.

Transfers of your personal information overseas

We may send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, we may:

  • store your information on cloud computer storage based overseas; or
  • organise an overseas school trip.
The European Commission has produced a list of countries which have adequate data protection rules. The list can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en
If the country that we are sending your information to is not on the list, or is not a country within the EEA (the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as there is in the UK.
We will provide you with details about the safeguards which we have in place outside of this privacy notice. If you have any questions about the safeguards in place please contact the Data Protection Officer.

For how long does the Trust keep staff personal information?

We keep your information for as long as we need to in relation to your employment. We will keep some information after you have left the Trust for example, in relation to our legal obligations.
In exceptional circumstances we will keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.
Please see our Information and Records Retention Policy for information on how long we keep your personal information for. This can be found on the REAch2 Trust website.

Processing in line with your rights

From May 2018 data protection legislation gives you a number of rights regarding your information.
Some of these are new rights whilst others build on your existing rights. Your rights are as follows:
  • Rectification: if information the Trust holds about you is incorrect you can ask us to correct it.
  • Access: you can also ask what information we hold about you and be provided with a copy of it. This is commonly known as making a subject access request.
  • Deletion: you can ask us to delete the information that we hold about you in certain For example, where we no longer need the information.
  • Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent or contract (please see "Our legal bases for using your information" above); and (c) the information is being processed by us on computer.
  • Object: you may object to us using your information where:
    • we are using it for direct marketing purposes
    • we are relying on either the legitimate interests or performance of a task carried out in the public interest basis to use it - please see the section "Our legal bases for using your information" above; and
    • we are using it for historical or scientific research purposes or archiving purposes. For example, we may keep photographs of staff for historical reasons.
  • Restriction: our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.
The Data Protection Officer can give you more information about your data protection rights. To exercise any of your rights you can submit your request in writing to the Interim Data Protection Officer at peter.noskiw@reach2.org.

Criminal offence information

We may only use information relating to criminal convictions and offences where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations or to exercise our rights.
Less commonly, we may use information relating to criminal convictions and offences where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else's) and you are not capable of giving your consent, or where you have already made the information public.

Consent

We may ask for your consent to use your information in certain ways as an alternative to relying on any of the bases in this Notice. For example, we may ask for your consent before taking or using some photographs and videos if the photograph or video is more intrusive and we cannot rely on our legitimate interests or it being in the public interest. If we ask for your consent to use your personal information you can withdraw this consent at any time. Any use of your information before you withdraw your consent remains valid. You can speak to the Data Protection Officer if you would like to withdraw any consent given.

More than one basis

As you will see from this Notice, in some cases we will rely on more than one basis above for a particular use of your information. In addition, we may move from one of the legal bases listed above to another as circumstances change. For example, as a safeguarding matter becomes more serious, we may start to rely on legal obligation to share personal information with the LADO in addition to the other legal bases which are noted for safeguarding purposes.

Further information

This Notice does not, and is not intended to, give you any rights which you did not already have.
For example, it does not give you any additional employment or contractual rights.

Contact

If you would like any further information about anything within this Notice please contact Peter Noskiw, Interim Data Protection Officer at peter.noskiw@reach2.org.
Please speak to the Data Protection Officer if:
  • you would like us to update the information we hold about you; or
  • you would prefer that certain information is kept confidential.

Information Commissioner’s Office

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office (ICO): ico.org.uk.