Staff – Privacy notice

Published: 20 January 2021
Review date: 20 January 2022
Policy owner: Data Protection Officer

The North Yorkshire Police, Fire and Crime Commissioner (the Commissioner), is committed to protecting your personal information.

This Privacy Notice contains important information about what personal details we collect; what we do with that information; who we may share it with and why; and your choices and rights when it comes to the personal information you have given to us.

We may need to make changes to our Privacy Notice, so please check our website for updates from time to time. If there are important changes such as changes to where your personal data will be processed, we will contact you to let you know

This version of our Privacy Policy was last updated on 20 January 2021.

Who are we?

This Privacy Notice is provided to you by the Police, Fire and Crime Commissioner, which is the data controller for your data.

Your personal data – what is it?

“Personal data” is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address).  Identification can be directly using the data itself or by combining it with other information which helps to identify a living individual (e.g. a list of staff may contain personnel ID numbers rather than names but if you use a separate list of the ID numbers which give the corresponding names to identify the staff in the first list then the first list will also be treated as personal data).  The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the General Data Protection Regulation (the “GDPR) and other legislation relating to personal data and rights such as the Human Rights Act.

The data we may collect about you

Personal Data that we may collect includes:

  • Name, Address and any other contact details such as email address and telephone numbers
  • Health and Disability
  • Annual leave and sick leave details
  • Performance details
  • Emergency contact details
  • Banking information
  • National Insurance and tax information
  • Pension details 

What is the legal basis for processing your personal data?

The Police, Fire and Crime Commissioner may process for personal data for the following reasons:

  • The performance of a contract with you, the data subjects, in order to meet your annual leave entitlements or to ensure that are being paid for the work that you do.
  • To meet a legal obligation, for example to ensure you have the continued right to live and work in the United Kingdom
  • With your consent in terms of any information you may provide about your health so we might make reasonable adjustments and support you in anyway.

Further information in relation to the use of consent can be found in the Consent statement.  

The Commissioner will comply with data protection law. This says that the personal data we hold about you must be:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept and destroyed securely including ensuring that appropriate technical and security measures are in place to protect your personal data to protect personal data from loss, misuse, unauthorised access and disclosure.

Sharing your personal data

We may engage the services of commercial companies to store and manage your information on our behalf. Where we have these arrangements, there is always a contract, memorandum of understanding or information sharing agreement in place to ensure that the requirements of the GDPR on handling personal information are met.

North Yorkshire Police, Fire and Crime Commissioner will also disclose personal information to other bodies or individuals when required to do so, this could be under an act of legislation, by a rule of law, or by court order. This may include:

  • Child Maintenance Service;
  • Children and Family Courts Services;
  • Home Office;
  • Courts;
  • Any other Regulatory Body who can demonstrate that there is a legitimate purpose for the processing of your personal data.

How long do we keep your personal data?

Personal Data is kept in kept in line with our retention policy.   

How do we keep your information secure

We are committed to ensuring that your personal data is safe. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information that we hold about you. These include:

  • Secure work areas
  • Information security awareness for our staff
  • Access controls on all systems
  • Encryption of personal data
  • Testing, assessing and evaluating the effectiveness of technical security controls 

Your rights and your personal data

You have the following rights in relation to your personal data:

  • Right to be informed
  • Right to Access
  • Right to Request Rectification
  • Right to Erasure
  • Right to Restrict Processing
  • Right to Data Portability
  • Right to Object
  • Rights Relating to Automated Decision Making

Find out more about your personal rights    

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.  Where and whenever necessary, we will seek your prior consent to the new processing.

Changes to this notice

We keep this Privacy Notice under regular review.

Contact Details

Addendum – COVID-19

In line with our policy as above to regularly review this Privacy Notice, we have now updated this Privacy Notice accordingly in light of the COVID-19 pandemic. Please note the following:

What personal information do we collect?

For these purposes the OPFCC may collect:

  • Name and contact details
  • Current job role and responsibilities
  • Medical Information, age or any other personal information which would mark a vulnerability to the virus
  • Recent history of contacts with other individuals whilst at work or with service users; or any other personal information which could help prevent or trace transmission of the virus.
  • Any other personal information which the OPFCC is asked to be collected by the relevant health or government authorities to mitigate the risks associated with Coronavirus (covid-19) this includes health risks, economic risks and social risks.

Why do we collect your personal information?

The OPFCC will collect this information to:

  • Provide a duty of care to its employees
  • Enable the OPFCC to operate effectively
  • Ensure the OPFCC can act effectively to protect the health and wellbeing of the local community

Who do we share this information with?

The OPFCC may need to share this information with organisations such as:

  • Central government
  • Health authorities
  • Relevant partner organisations

How long do we keep your information for?

Information will be kept for as long as necessary for the purposes for which it is processed. The OPFCC will destroy or archive information when the risks from Coronavirus (covid-19) have been appropriately reduced.

What is our lawful basis for processing your information?

The legal basis the OPFCC relies on will be determined by the specific process. However, it is likely that the OPFCC will process this personal data under the legal bases of:

  • Article 6(1)(b) – Contract
  • Article 6(1)(c) – Legal Obligation
  • Article 6(1)(d) – Vital Interests
  • Article 6(1)(e) – Public Task

Some of the personal data processed by the OPFCC will be information defined as special category data. Which requires an article 9 condition to process the OPFCC will be relying on the legal bases:

  • Article (9)(2)(b) – Employment, social security and social protection
  • Article (9)(2)(c) – Vital interests
  • Article (9)(2)(g) – Reasons of substantial public interest (with a basis in law)
  • Article (9)(2)(h) – Health or social care (with a basis in law)
  • Article (9)(2)(i) – Public health (with a basis in law)

Changes to this notice

We keep this Privacy Notice under regular review.

First published: 17 May 2018
Updated: 20 January 2021