Privacy: Corporate services

This Privacy Notice is designed to help you understand how we use personal information when delivering our corporate services, we have set out below the services types, the information we may use to deliver the services, who we may share it with, and how long we will keep it.

What services are covered by this privacy notice?

Accommodation and Travel Bookings

Provides travel and accommodation services to meet business needs.

Business Continuity

Provides Emergency Planning and Resilience and Business Continuity services.

Corporate Health and Safety

Provides advice on health and safety management.

Electronic Disclosure and Barring (eDBS)

Provides DBS checks for employment and pre-employment contracts.

Democracy Team/Democratic Services

Provides support to council committees including Full Council and provides direct support to councillors through the group offices.

Essex Pensions

Pension Administration Service provided by Essex Pension Fund to Essex County Council and Police Uniform and Firefighters schemes.

Organisational Development and People

Provides an HR and organisational development service for Essex County Council and its employees.

Recruitment, Payroll, Contracts and Processing

Provides a service to Essex County Council and its employees for recruitment, payments and contracts.

Leadership and Talent

The provision of personal, professional, management and leadership development and consultation support services.

Member Enquiries

Provides advice, support and prepare responses to requests for information for council members, Cabinet Members and Chief Executive Officer.

Partnerships

Events and communications management to transform how we work with different communities, groups and businesses to plan our future and tackle disadvantage.

Finance Transactional Services

Provides transactional services for Essex County Council (ECC), payments to suppliers; manages the income team and provides financial assessments for social care.

Vehicle Lease Car Provision Scheme

Provides vehicle lease management for ECC staff for the Car Provision scheme.

What personal information do we hold?

We only collect and use the minimum personal information required to deliver your service. Wherever possible we use non-identifiable personal information.

The services may use some or all of the personal information below:

  • Names, address and contact details
  • Family relationships and friendships
  • Lifestyle and social circumstances
  • Employment and education
  • Date of birth
  • Marital status
  • Occupation
  • National Insurance number
  • Driving licence details
  • Gender
  • Disclosure of criminal convictions and offences (including alleged offences)
  • Criminal proceedings, outcomes and sentences
  • Referee and emergency contact information including, name and contact details, relationship to you, job title
  • Health information
  • Financial details
  • Pensions information
  • Beneficiaries information
  • Ethnicity and or nationality
  • Visual images, personal appearance and behaviour
  • Religious or other beliefs of a similar nature
  • Licences and permits held
  • Goods and services information
  • Business activities
  • Trade union membership
  • Political party membership and affiliations
  • Case file information

We get most of this information from you, but we may also get some of this information about you from health and education providers, commissioned partners, family members, your legal representative, referees, employers, regulatory bodies, Police, other local authorities.

How do we use your personal information?

We use your information for one or more of the following reasons:

  • Deliver the service, or handle your query
  • To manage and support you as an employee/volunteer
  • To enable us to contact someone for you in case of an emergency
  • To plan and improve the service we offer
  • To detect and prevent crime or fraud
  • For research, however this would be in anonymised form unless we ask for your consent to use your personal information for this purpose
  • To evidence employment to secure funding grants

Who else might we share your personal information with?

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law.

We will only share the minimum information for each circumstance. We may sometimes need to share some of your personal information with one or more of the following:

  • Central Government departments e.g., the Health and Safety Executive, HMRC, DWP, Home Office, DVLA
  • Regulatory bodies, e.g. HCPC, GIC
  • Trade Unions
  • Pension service providers
  • Police (only for the purposes of preventing or detecting crime or fraud)
  • Essex Fire and Rescue (Emergency Planning)
  • Other Local Authorities
  • Health agencies/providers
  • Prospective employers
  • Commissioned partners (who deliver services on our behalf)
  • Your legal representatives (e.g. a Solicitor/Advocate)
  • Cornerstone OnDemand Limited
  • Debt collection agencies
  • Debt enforcement agents

We may also use Data Processors to support these activities, for example by providing the systems we need or delivering services on our behalf. These include:

Who is the data controller for this processing?

Essex County Council is the Data Controller for this processing with the exception of Essex Pensions Service, where ECC is a Joint Data Controller with:

  • Essex Pension Fund (Pension Administrators)
  • Barnett Waddingham (Scheme Actuary)
  • Prudential (Scheme AVC Provider)
  • Standard Life (Scheme AVC Provider)
  • Equitable Life (Scheme AVC Provider)
  • Ernst Young (Scheme Auditor)
  • South Yorkshire Pension Authority (LGPS National Insurance Database)
  • The Department for Work and Pensions
  • The Governments Actuary’s Department
  • The Cabinet Office (National Fraud Initiative)
  • HM Revenue and Customs
  • The Courts of England and Wales (Pension Sharing)

Before we provide services to you we may undertake checks for the purposes of preventing fraud and money laundering and to verify your identity. These checks require us to process personal data about you.

To complete these checks we will obtain personal information about you from the National Fraud Database, the Data Controller that holds this information is Cifas.

For further information regarding how your information is processed by them, view their privacy notice.

What is the legal basis for our use of your personal information?

View the tables which show the legal basis we rely on to use your personal or special category (sensitive) personal information.

View a list of the full legal conditions we may rely on by looking at our full privacy notice.

View a list of the legislation we rely on when using your personal information to meet our legal obligations or public tasks.

Where we rely on your consent to use your personal information you have the right to withdraw this consent at any time by contacting our Data Protection Officer, and advising which service you are using.

Data Protection Officer

Email: DPO@essex.gov.uk
Telephone: 0345 743 0430 (ask to speak to the Information Governance Team)

Will my personal information be accessible outside the UK?

The Essex Pension fund does have a number of overseas members who reside in countries other than the UK. The majority of these are in European Countries, USA or Australia. The Fund does not transfer data relating to overseas members to anyone other than the member and appropriate safeguards are applied.

When booking for accommodation or flights via our supplier Redfern the data will be accessible to their parent company in the United States. In order to safeguard your personal information and ensure you have the same rights as you would if your personal information was processed in the UK we have ensured that the parent company is registered with the US Privacy Shield, meaning the EU has agreed that they have an adequate level of data protection in place.

No other personal information is routinely sent or held outside the UK. Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the data.

The forthcoming HR Recruitment and Learning system (which is due to be released at the end of 2019) may need to send data to the US (classified as having “adequate” data security) and India (a contract is held guaranteeing security of the data).

In those cases the data will be used for one of the following reasons:

  • Production troubleshooting
  • Researching data flow for client data
  • Bug fixes
  • Implementation of patches
  • Client data change requests

How long will we keep your personal information?

We will only use your personal information whilst delivering the service to you and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period. In practice, this means that your personal information may be retained for:

Business Continuity

We will stop using your personal information after one year. Records relating to a major event may be held indefinitely historical public archiving purposes otherwise the data will be deleted immediately after we stop using it.

Corporate Health and Safety

We will stop using your personal information after your case concludes and it is deleted after five years.

Electronic Disclosure and Barring

We will stop using your personal information when your employment ends, and delete it after 25 years.

Elected Members

Your personal information will be maintained indefinitely and become part of the permanent and historical public records of Essex County Council that may be accessed by the public through the Essex Record Office.

Essex Pensions

We will stop using your data after you (or any beneficiary who receives benefits after your death) cease to be entitled to benefits from the Fund. Your data will be deleted 15 years or once the administrator deems that the data is no longer needed for the purpose of exercising or defending a legal claim.

Organisational Development and People

We will stop using your personal information when your employment ends, and delete it after seven years, or where an eDBS is required for 25 years.

Recruitment, Payroll, Contracts and Processing

We will stop using your personal information when your employment ends, and delete it after seven years.

Leadership and Talent

We will stop using your personal information when your employment ends, and delete it after seven years.

Member Enquiries

We will stop using your personal information when your query is resolved, and delete after two years.

Partnerships

We will stop using your personal information once an event has concluded or you have advised you no longer wish to remain on our mailing list; and will be deleted immediately.

Purchase to Pay

We will stop using your personal information when the service you receive ends, and delete it after seven years.

Vehicle Lease Management

We will stop using your personal information on the lease/hire car has been returned and it will be deleted after seven years for lease vehicles and one year for hire vehicles.

Your rights

The law gives you a number of rights to control what personal information is used by us and how it is used by us.

You can obtain further information about these rights from the Information Commissioner’s Office.

You also have the right to lodge a complaint in relation to this summary notice, the full Privacy Notice or our processing activities with the Information Commissioner’s Office.

Information Commissioner's Office

Post:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk/
Email: casework@ico.org.uk
Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate)

Contact us

If you wish to exercise any of these rights, you can contact our Data Protection Officer.

Data Protection Officer

Email: DPO@essex.gov.uk
Telephone: 0345 743 0430 (ask to speak to the Information Governance Team)

Print this page