Staff privacy notice

The University of Plymouth (the “University”) is committed to protecting your personal and sensitive personal data, working in accordance with current data protection legislation. We are registered as a data controller with the Information Commissioner’s Office under registration number Z7546246 and our Data Protection Officer can be contacted at dpo@plymouth.ac.uk 

This privacy notice outlines how the University collects, processes and uses your information. This notice is applicable to all employees (current, past or prospective) and other colleagues who have a temporary or ongoing association with the University, including visiting faculty, honorary appointees and Emeritus Professors.

Why do we collect your data?

The University collects information in order to fulfil its obligations as an employer. There is always a lawful basis for processing of your information including, but not limited to, the performance of an employment contract and compliance with the University’s legal obligations, which are outlined below. Where information is not provided by employees, the actions below will not be able to be undertaken. The University will not process personal data for marketing purposes or transfer personal data outside of the EU framework and data is not subject to automated data processing. 

It is important that the information held about you is accurate and current. Please ensure you update your information through Employee Self Service when necessary.

What type of data do we collect?

The following are examples of personal data (not exhaustive) which may be collected, stored and used:

• Personal contact details such as name, date of birth title, addresses, telephone numbers, and personal email addresses
• Marital status and dependants
• Gender
• Next of kin and nominated emergency contact information
• National Insurance number, bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Copy of driving licence where your employment involves driving for the University
• Recruitment information (including copies of right to work documentation, references and other information included in an application form, CV or cover letter or as part of the application process)
• Employment records (including job titles, conflicts of interests, work history, working hours, training records and professional memberships)
• Compensation history, including allowances and bonus payments
• Salary benchmarking and pay modelling
• Personal development information (including PDR, training and progression)
• Disciplinary, grievance, sickness absence and performance management information
• Information relating to maternity, paternity, shared parental or adoption leave
• CCTV footage and other information obtained through electronic means such as swipe/identity card records
• Information about your use of our information and communications systems
• Photographs
• Passport and UKVI information
• Information relating to Research Passports in order to facilitate research in the NHS

We may also collect, store and use the following types of special category personal data:

• Information related to protected characteristics as defined within the Equality Act for monitoring and institutional reporting, for example, our Annual Equality Report, Equal Pay and Athena SWAN submissions
• Trade union membership
• Information about your health, including any medical condition, health and sickness records, and disability information
• Information about criminal convictions and offences

When and how do we collect your data?

The University will collect your information in different ways prior to and during its relationship with you. These will include:

• Information you provide directly to us such as through the application or recruitment process or during your period of employment
• Information provided by other sources such as employment agencies, referees or former employers (some of which may be post- employment e.g. in relation to tax and/or pension).

How do we use your data?

The University requires this information to manage the employment relationship with staff and the obligations and responsibilities, which arise from this. For example, the University may use your information to:

• recruit and select new and existing employees, temporary workers and consultants including matching to future vacancies
• carry out any necessary checks to ensure that staff have the right to work in the UK and are eligible to work with children, patients or other vulnerable individuals and have suitable references in relation to previous employment etc.;
• administer contracts of employment and other contractual arrangements related to temporary and casual workers, consultant and voluntary or honorary appointees;
• maintain accurate information for current members of staff in the HR databases, including Employee Self Service
• pay staff and ensure they are receiving the pay or other benefits (including pensions and reimbursement of travel and subsistence expenses) to which they are entitled and that the necessary deductions are being made i.e. tax, student loans etc.
• provide staff benefits and administer salary exchange arrangements i.e. childcare vouchers, cycle to work etc.
• manage the health and wellbeing of staff through maintenance of emergency contact details, pre-employment medical details, health screening for relevant roles, information related to disability, incident records, Personal Emergency Evacuation Plans, personal risk assessments and staff survey monitoring etc.
• record staff absence including sickness, parental leave, jury service etc. and maintain absence management procedures for effective workforce management and employee wellbeing i.e. fitness to work and reasonable adjustments
• record and monitor staff performance, training, development and career progression
• operate and keep a record of disciplinary, grievance and other employee relations processes including employment tribunals to report on internal performance metrics and identify patterns or concerns in specific areas;
• report and monitor data relating to protected characteristics to inform and develop action plans that promote equality, diversity and inclusion at the recruitment stages and within the workplace;
• process specific reports and returns and participate in general statistical surveys for Governmental or regulatory bodies such as relevant Pension Providers, HMRC, HESA or the Office for Students;
• facilitate internal day to day communications relevant to your employment with the University and promotion of your work details on the staff directory which also covers managing the security and car parking through photographic staff ID cards;
• fulfil and monitor legal responsibilities and obligations, for example, within the Equality Act, immigration and health and safety legislation;
• provide references on request for current and former employees;
• provide relevant management information to support the University with its effective financial forecasting, workforce management and business planning;
• support staff with making applications for research or other funding and regulatory approvals;
• support teaching and learning and staff development with audio or video recording of lectures, presentations or training events;
• manage joint contracts of employment / secondments which require information to be shared with the honorary / host employer (usually NHS partners for clinical academic appointments).

What is the lawful basis for processing personal data?

The University processes staff data for the above purposes under the following conditions: 

• Where consent has been provided
• In order for the University to fulfil its obligations under the contract of employment
• Where the University needs to comply with a legal obligation (for example, the detection or prevention of crime and financial regulations)
• Where it is necessary for the University’s legitimate interests (or those of a third party) and the interests and fundamental rights of the member of staff do not override those interests
• To protect the vital interests of the member of staff or of another person (for example, in the case of a medical emergency)
• In order to perform a task carried out in the public interest

The University will only process special category data with the member of staff’s explicit consent or under the following conditions:

• For the purposes of the member of staff and/or the University carrying out its obligations in the field of employment providing appropriate safeguards are in place to protect the individual’s fundamental rights and interests;
• For the establishment, exercise or defence of legal claims;
• When it is needed to protect the member of staff or another person’s vital interests and the member of staff is not capable of giving your consent (for example, in an emergency);
• For reasons of substantial public interest; or
• Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

If your consent is required for any specific use of your personal data, it will be collected at the appropriate time.

Who internally has access to your data?

Information is held by Human Resources and is carefully controlled with access being granted only if it is needed for a legitimate business requirement i.e. related to one of the activities listed in the section on how we use your data. For example; 

• For operational and business continuity purposes, your personal data may be shared with other relevant members of the University including Senior Managers
• Your personal data is also shared across relevant IT systems and databases to facilitate the management and delivery of University services, legal requirements and equality reports
• Finance have access to certain information they require for effective forecasting and to process BACS payments
• Research and Innovation have access to certain information they require for the purposes of grant / project funding proposals
• Reporting Managers have access to certain information through Manager Self-Service to fulfil their obligations and manage your employment
• Managers have access to certain information following incident reports in order to fully investigate those incidents and ensure appropriate control measures are in place
• If your contract is a joint contract (e.g. with the NHS) or you are on secondment, then certain information will be shared with the host/ honorary employer in accordance with your contract

Staff can access their personal details through Employee Self-Service.

Who do we share your data with outside of the University?

The University will disclose certain personal detail to external bodies for the legitimate interests of the University or of third parties as detailed below.

How long do we keep your data?

Your personal information will be kept as long as necessary for the purpose(s) for which is was collected in line with the University’s Records Retention Schedule and will be securely destroyed when no longer required.

What rights do I have?

As a data subject you have a number of rights in relation to your personal data. You can:

• access and obtain a copy of your data on request
• require the University to amend incorrect or incomplete data
• require the University to stop processing your data, for example where the data is no longer necessary for the purposes of processing
• object to the processing of your data where the University is relying on its legitimate interests as the legal ground for processing
• require us to erase your personal data
• require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.

Please note that the above rights are not absolute, and the University may be entitled to refuse requests where exceptions apply. 

If you wish to exercise any of these rights or if you have a complaint about the way you believe your data is being processed, in the first instance, please email: dpo@plymouth.ac.uk.

If you have a complaint and you remain dissatisfied with how your complaint has been dealt with you can take your complaint to the Information Commissioner’s Office (ICO) for a review. They can be contacted at casework@ico.org.uk

Changes to this notice

This privacy notice is reviewed annually or when required to ensure compliance with data protection legislation. If significant changes are made to this notice and the way we treat your personal information we will make this clear and may seek to communicate this directly to you

Reminder of individual’s responsibility

Individuals also have a responsibility for the security of their data. Please remember the University will never ask you to share your username and password and nor should you share them with anyone else. University policy and guidance on information security can be found at https://www.plymouth.ac.uk/your-university/governance/information-governance/information-security