Who is collecting and using your personal data?
Calderdale Council of Town Hall, Crossley Street, Halifax, HX1 1UJ is registered with the information Commissioners Office (ICO) under the provisions of the Data Protection Act 2018. The Council takes its responsibilities under the Act very seriously.
The Health and Safety Team provides expert and proportionate advice in all aspects of health and safety management, through its team of advisers and, as such, it is necessary under the Data Protection Act 2018 for Calderdale Council acting as Data Controller to collect and process personal information about you.
This notice tells you about the personal information we collect and how it may be used.
Who does the Privacy Notice apply to?
This Privacy Notice applies to all employees (and former employees) on permanent or fixed term contracts, workers (including agency, casual, contracted staff and those workers covered by the Intermediaries Legislation IR35), volunteers, trainees and those carrying out work experience, the general public and school employees/pupils.
What is Personal Information?
Personal information is information about someone which allows that person to be identified from that data or a combination of data available to us. Examples include: name, address, employee/payroll number, national insurance number, photo, email address or mobile phone number. Some personal information is classified as special category data. This may include information about your race or ethnic origin, physical or mental health conditions, alleged or real offences, proceedings for any alleged or real offence, sexuality, religions or beliefs.
How do we collect your personal information?
We may receive information about you from the following sources:
- Directly from you
- Institute of Occupational Safety and Health (IOSH) for training purposes
- CLEAPSS - school name and pupil numbers
- EVOLVE system for School's activities and trips
- DVLA – driving licence checks
- Insurance teams acting on behalf of Academies
- Emergency services such as fire/police for incident/accident investigation
- The Council's insurers for insurance/legal purposes
- The Council's contracted alcohol and drug test service providers
What types of information will be collected?
- Name, address and contact details
- gender
- date of birth
- health conditions
- information relating to accidents/incidents
- driving licence checks
- results of alcohol and drug tests
- Staff Training Records
- Yearly Health & Safety audit information
Our staff are trained to handle your information correctly and protect your confidentiality and privacy.
We aim to maintain high standards, adopt best practice for our record keeping and regularly revisit our working practices with any updates in guidance, regulations or best practice.
Why are we collecting personal data?
Calderdale Council are legally obliged to report RIDDOR accidents to the Health and Safety Executive (HSE) when certain criteria is met and we may report incidents of violent behaviour towards our staff to the police in line with the Council's Violence and Aggression policy.
We also collect your personal data for the following purposes, to:
- Enable us to comply with statutory requirements to report injuries of a specific nature under RIDDOR, to ensure legal compliance.
- Allow us to investigate harm you may have suffered at work or from Council related activities, to prevent similar occurrences from reoccurring in the future.
- Allow us to record details of witnesses to incidents and record witness
- Comply with the Equality Act with respect to hate crime or violent behaviour towards Council
- Provide the information required for the recording and where necessary the reporting of accidents and incidents.
- Provide robust risk assessments for ensuring, so far as is reasonably practicable, the health, safety and wellbeing of those affected by the Council's activities
- Provide effective systems for the monitoring of health and safety performance throughout the Authority together with means for reporting and responsibility for instigating any corrective measures found necessary.
- Provide a robust audit and review process designed to measure safety performance generally and the compliance with the Council's policies and relevant statutory provisions.
- Provide appropriate levels of information, instruction, training and supervision to ensure that all employees are aware of any hazards to which they may be exposed and the measures used to control any significant risks arising
- Support services to benefit the wellbeing of employees
- Assist in managing the health and safety of school pupils including whilst on educational
- For the potential defence/prosecution incorporating legal services for potential criminal or civil
Who do we share information with?
We may share your information internally with other departments/services of the Council and with external organisations where appropriate. This includes:
- The Health and Safety Executive (HSE) and Care Quality Commission (CQC).
- Police, Fire and Rescue
- The Council's Alcohol and Drug testing service
- Public Health
- The Council's Insurers and Legal
- The Council's Occupational Health Service and Human Resources
- Directors, Heads of Service and Unit Managers to enable them to fulfil risk assessment and risk management responsibilities under health and safety legislation.
Your information is never collected or sold for direct marketing purposes.
The Lawful Basis for the processing of your personal data
Depending on the processing activity, we rely on the following lawful basis provisions of Article 6 of the General Data Protection Regulation (GDPR):
- Article 6(1)(c) - Processing is necessary for the Council to comply with the law as listed below*
- Article 6(1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Article 6(1)(f) - Processing is necessary for the purposes of the legitimate interests pursued by the
We process special category data under the following conditions listed in Article 9 of the GDPR:
- Article 9(2)(b) - Processing is necessary for carrying out obligations under employment, social security or social protection law or a collective agreement
- Article 9(2)(f) - Processing is necessary for the establishment, exercise or defence of legal claims or judicial acts.
- Schedule 1, part 1 (1) - processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
*We process your data in order to comply with the following legislation:
- Data Protection Act
- Health and Safety at Work Act 1974.
- Management of Health and Safety at Work Regulations 1999
- The Control of Substances Hazardous to Health Regulations
- Reporting of Injuries, Diseases and Dangerous Occurrences Regulations
- Regulatory Reform (Fire Safety) Order
- Health and Safety (Display Screen Equipment) Regulations 1992 as amended by the Health and Safety (Miscellaneous Amendments) Regulations 2002.
How long do we keep your personal data?
All information is held in line with our Health & Safety records retention and disposal schedule which can be viewed here: Health & Safety Records - retention and disposal schedule
- Most information is held for 6 years from the date of the trigger period, for example the date of an incident/accident, (this does not include potential cases involving asbestos, HAVs, noise and pesticides where symptoms may appear later in life, in which case information is held for up to 40 years from the last date of employment).
- Staff training records not concerned with asbestos, HAVs, noise and pesticides will be held for 6 years after last date of employment (this is for legal purposes in the event of future legal proceedings and need for defence).
Information will be held for the length of time documented after which it will be securely disposed of, unless there is a legal reason to prevent disposal.
Individual Rights:
Data protection laws give individuals the right in respect of the personal information that we hold about you. These are:
- To be informed why, where and how we use your
- To ask for access to your information that we
- To ask for your information to be corrected if it is inaccurate or
- To ask for your information to be deleted or removed where there is no legal reasoning for us to continue processing it.
- To ask us to restrict the use of your
- To ask us to copy or transfer your information from one IT system to another in a safe and secure way without Impacting the quality of the information.
- To object to how your information is used should you think it is being used
- To challenge any decisions made without any human intervention (automated decision making)
In summary, you have the right to see what information is held about you, to have inaccurate information corrected and to have information removed from our system unless we are required by law or a statutory purpose to keep it by writing to the Health and Safety Manager, Calderdale MBC, Human Resources, Westgate House, Westgate, Halifax, HX1 1PS. You have the right to complain to the Data Protection Officer if you feel that your data has not been handled in accordance with the law.
You can contact the Council’s Data Protection Officer at information.management@calderdale.gov.uk.
You also have the right to lodge a complaint with the Information Commissioner’s Office at www.ico.org.uk.