Privacy notice - Employees, volunteers, and contractors

Special categories of personal data include:

• race
• ethnic origin
• politics
• religion
• trade union membership
• genetics
• biometrics (where used for ID purposes)
• health
• sex life
• sexual orientation

Nottinghamshire Healthcare NHS Foundation Trust (the Trust) is a major provider of mental health, intellectual disability and specialist mental health services, and community physical health for both adults and children. The Trust also provides care in our low, medium and high secure hospitals including Rampton Hospital.

The Trust works in partnership with other healthcare providers and is also involved in a number of collaborations relating to research and innovation with the Institute of Mental Health, the University of Nottingham, and other partners.

The Trust has approximately 9,600 staff who carry out a wide range of roles, working together to provide integrated and coordinated care and support to those using our services.

The Trust is registered to collect and process personal information. For this responsibility, the Trust is known as a ‘Data Controller’.

To safeguard your information and support your rights, and in accordance with the UK GDPR, the Trust has appointed a Data Protection Officer (DPO).

The role of the DPO is to monitor internal compliance, inform and advise on data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs), and to act as a contact point for data subjects and the supervisory authority (Information Commissioner’s Office).

The DPO can be contacted via DPOEnquiries@nottshc.nhs.uk

The European Union General Data Protection Regulation came into force on 25 May 2018 and was designed to bring laws for the use of information up to date throughout the European Union (EU).

The UK Government also introduced the Data Protection Act 2018.

Since leaving the EU, the UK Government has further updated our data protection laws through the UK General Data Protection Regulation (UK GDPR).

The legislation:

• Introduced special protection of children’s (defined to be under 13) personal data
• Requires ‘explicit’ consent to be necessary for processing special category personal data  (unless very specific and limited circumstances apply)
• Expanded the definition of ‘personal data’ to include IP (computer) addresses, internet cookies and DNA
• Updated and strengthened data protection law to reflect the changing nature and scope of the digital economy
• Makes it easier and free for individuals to require an organisation to disclose the personal data it holds about them
• Makes it easier for individuals to move data between service providers
• Makes it simpler to withdraw consent for the use of personal data
• Allows people to ask for their personal data held by companies to be erased

For more information about data protection and how the Trust processes your personal information, please see the Information Governance Data Security and Data Protection Service pages on Connect: download.cfm 

The Trust is registered with the Information Commissioner and the Trust’s registration number is Z8086442. You can find out more about the work of the Information Commissioner’s Office and view their register on their website: Information Commission's Office

The UK GDPR requires Data Controllers and organisations that process personal data to demonstrate compliance with its provisions. This involves publishing the bases for lawful processing.

As personal data is processed for the purposes of the Trust’s statutory functions, the Trust’s legal bases for the processing as listed in Article 6 of the UK GDPR include:

• 6(1)(b) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• 6(1)(c) - Processing is necessary for compliance with a legal obligation
• 6(1)(d) - Processing is necessary to protect the vital interests of the data subject or of another natural person
• 6(1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, such as the delivery of health or care
• 6(1)(f) Legitimate interests: the processing is necessary for the Trusts legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. Public authorities (including the Trust) can only rely on legitimate interests if they are processing for a legitimate reason other than performing their tasks as a public authority

If none of the above legal bases are applicable, the Trust will seek to obtain the explicit consent of the data subject (section 6 (1) (a)).

Where the Trust processes special categories of personal data, its additional legal bases for processing such data as listed in Article 9 of the UK GDPR are as follows:

• 9(2)(b) - Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
• 9(2)(c) - Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
• 9(2)(d) Processing is carried out in the course of its legitimate activities, with appropriate safeguards by a foundation, association, or any other not-for-profit body. Article 9(2)(e)
• Processing relates to personal data which are manifestly made public by the data subject;
• 9(2)(f) - Processing is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity
• 9(2)(g) - Processing is necessary for reasons of substantial public interest, on the basis of law
• 9(2)(h) - Processing is necessary for the purposes of occupational medicine, for the assessment of the working capacity of the employee, or the management of health and social care systems and services
• 9(2)(i) - Processing is necessary for reasons of public interest in the area of public health
• 9(2)(j) - Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

If none of the above legal bases are applicable, the Trust will seek to obtain the explicit consent of the data subject (section 9(2)(a)).

The Trust keeps records about you for the purpose of your employment, training and workforce planning if you are an employee, and for the management of your contract, if you are a contractor.

It helps us to:

• Undertake recruitment and selection
• Carry out pre-employment checks such as identity checks, having the right to work, reference checks, registration checks, DBS checks, and occupational health checks
• Fulfil our obligations as an employer
• Pay you the correct remuneration
• Manage your training and education during your employment.
• Identify workforce planning targets
• Maintain patient safety through the management of performance concerns
• Comply with legal and regulatory responsibilities, including revalidation
• Plan and manage our service provision
• Contact you about training opportunities, events, surveys, and share information that may be of interest to you
• Support employees in the engagement of services such as occupational health and staff counselling
• Provide data as required by regulatory bodies such as the Department of Health, NHS Pensions, Inland Revenue
• Respond to Freedom of Information requests

Sometimes, we keep records to help investigate incidents for example, CCTV images of incidents during which a member of staff is harmed. These data may be used during internal investigations and may also be shared with the police.

• Name, address, date of birth, National Insurance Number and next of kin
• Identification information such as photographs, biometric data, and CCTV images (at specific sites)
• Ethnicity, required for monitoring
• Nationality, required for monitoring
• Disability and health data
• Professional registration number(s)
• DBS Disclosure Number
• Personal contact details
• Bank details
• Special Category data (see section 2)
• Vehicle information such as vehicle registration number, insurance status, and MOT status
• Offences (including alleged offences), criminal proceedings, outcomes, and sentences
• Employment Tribunal applications, complaints, accidents, and incident details

The processing of personal data complies with the UK GDPR and the Data Protection Act 2018 in line with the Trust’s data protection registration held with the Information Commissioner’s Office.

The personal data we process may be held as an electronic record on information systems or as a securely stored paper record.

Information is accessed on a need to know basis. Systems where your personal data may be held include:

• Electronic Staff Record (ESR)
• NHS Jobs
• TRAC - for the recruitment and selection of employees
• E-Expenses system
• NHS Pensions Authority systems
• NHS Secure Directory Services for Registration Authority functions (for NHS smart cards)
• Licence Bureau and Fleetwave systems
• Allocate
• Library membership and related external services systems such as Athens
• ICT User Account systems such as Microsoft Active Directory, Directory Manager
• The Trust’s Mandatory Training Database
• SARD, for Medical Revalidation
• VISACC - to register, monitor and process visitors to specific sites within secure areas
• BTS Telephone Directory as accessed via Connect
• Clinical Information Systems such as RiO, SystmOne
• Central and / or local storage of CCTV images which is time limited

The security of your personal data is assured through the implementation of the Trust’s Information Security and Information Governance policies.

The Trust completes an annual mandatory information assurance return to NHS England known as the Data Security and Protection Toolkit. The Data Security and Protection Toolkit is an online self assessment tool that enables NHS organisations to measure and publish their performance against the National Data Guardian's ten data security standards. Data Security and Protection Toolkit

Whilst we make every effort to keep your personal information accurate and up to date, we are also reliant on you, as the data subject, to notify us of any necessary changes to your personal data. If there any changes to your personal information, it is your responsibility to directly update electronic systems (where appropriate) or notify your line manager.

We will keep personal data for no longer than necessary, in line with the NHS records retention schedule within the NHS Records Management Code of Practice. See their website for more information: Records Management Code of Practice - NHS England Digital.

Your personal information is not routinely processed outside of the EU by the Trust for the purpose of your employment.

We may need to share your personal data with other third-party organisations in line with the legal basis / bases for processing as detailed in section 5.

These organisations may include, but are not restricted to:

• Social Services
• Police
• Courts
• Local authorities
• Inland Revenue
• NHS Counter Fraud Authority
• Professional Bodies such as the General Medical Council, Nursing & Midwifery Council
• Care Quality Commission
• Coroner’s Office
• Information Commissioner’s Office

Your Rights

The UK GDPR introduced an enhanced concept of transparency, meaning the Trust has a duty to provide you with information in relation to how your personal and special category data is collected, stored, and processed. This is provided within this document. Should you have any additional questions, please contact DPOEnquiries@nottshc.nhs.uk

The UK GDPR extends and strengthens your rights as a data subject. Under the UK GDPR you have the right to request the rectification of inaccurate personal data and the right to request the erasure of your personal data. However, the rights to rectification and erasure are not an absolute right and it may be that it is necessary for the Trust to continue to process your personal data for lawful and legitimate reasons.

You have the right in certain circumstances to ask the Trust to stop processing your personal data in relation to any Trust service. You can also stipulate that you do not wish to receive information from the Trust. However, the right to object to, or restrict processing is not an absolute right and it may be that it is necessary for the Trust to continue to process your personal data for lawful and legitimate reasons.

If you wish to object to your information being processed, receiving information from the Trust, wish to have information rectified or erased, in the first instance, please send your request in writing via email to informationgovernance@nottshc.nhs.uk

The Trust does not use your information to make automated decisions about you, nor to undertake profiling.

You can request a copy of the information the Trust holds about you by emailing AccesstoInformation@nottshc.nhs.uk . You can also telephone us to make a request. This information is generally available to you free of charge subject to the receipt of appropriate identification. Please contact the Data Security and Data Protection Service if you need any additional information about making requests.

The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.

It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. If you wish to make such a request, please email AccesstoInformation@nottshc.nhs.uk .

If you want to complain about how we have used your personal data, please contact DPOEnquiries@nottshc.nhs.uk .

Alternatively, you can also contact the Information Commissioner if you have a complaint about our processing of your personal data:

The Office of the Information Commissioner Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

Tel: 0303 123 1113 (or 01625 545745 if you would prefer not to call an ‘03’ number, or +44 1625 545745 if calling from overseas)

Fax: 01625 524510

The Trust promotes research to improve our services for everyone who uses them or is involved in them. We are committed to offering our patients, their carers, and our staff the opportunity to get involved.

Service evaluations help the Trust to determine whether a particular service or care pathway is effective and whether it is meeting the needs of our patients. Clinical audits assess the care provided by the Trust against agreed standards.

Using data for research, service evaluations and clinical audits helps the Trust and the NHS to provide better health and care for everyone.

Most of the time, anonymised data are used; anonymised data doesn’t contain any information that could be used to identify you. The Trust will only use your confidential information for research, service evaluations or clinical audit when we are allowed to do so by law.

The majority of research projects and service evaluations that are sponsored or approved by the Trust are based on consent. This means that the participants have agreed to allow the researchers or those involved in a service evaluation to use their personal data.

If you are invited to take part in a research study or service evaluation, the team running the project will provide you with information about how your confidential personal data will be

processed. This information will help you to decide whether you want to take part or not.

You can change your decision about whether you want your confidential data to be used in a research study or service evaluation at any time, and the team running the project will provide you with information about this if you decide to take part.

The Trust will not share your personal information with insurance companies or direct marketing companies without your specific agreement.

Closed-Circuit Television (CCTV) systems are installed in Trust premises and within Trust car parks where it can be used to enhance observation and the security of the environment, and generally support patients’, staff and visitors’ safety. CCTV can also deter and detect crime and provide evidence to the police for investigations where complaints have been made about unlawful or untoward incidents.

The Trust is the Data Controller for all images captured on the CCTV systems it operates, and there is a specific policy for operation and management of CCTV systems (13.02 Closed Circuit Television (CCTV)) which includes information about how, when and where CCTV images are stored. It also contains information about when, how, and by whom recordings may be viewed and the circumstances under which copies of recordings might be provided. Your work area may also have procedures to explain how the policy is enacted within that location.

CCTV images are generally not kept for longer than a 31-day period before being overwritten, although some recordings may be kept for longer if they are needed for an ongoing investigation.

Most Trust sites operate CCTV systems in public areas such as car parks and reception areas. Some locations also operate CCTV systems in restricted areas for example, in the bedroom areas on the Cassidy 136 Suite. Clear signage will be displayed in all areas where CCTV is in operation; the signage will provide information about how you can access copies of your personal data processed within the recordings.

It is important that you work with us to ensure that the information we hold about you is accurate and up to date so please inform us if any of your personal data needs to be updated or corrected.

To learn more about how we use, manage and maintain confidentiality of your information, please speak to your manager, or contact the Data Security and Data Protection Service:  informationgovernance@nottshc.nhs.uk

Alternatively, you can find more information on the Data Security and Data Protection Service pages on Connect: Data Security and Data Protection Services | Nottinghamshire Intranet

You can find out more about the work of the Trust’s Research and Evidence Department at: Research, Nottinghamshire Healthcare's Research and Evidence Department | Nottinghamshire Healthcare NHS Foundation Trust

Call us: 0115 993 4542

E-mail us: PALSandComplaints@nottshc.nhs.uk

Write to: PALS and Complaints, Highbury Hospital, Highbury Road, Nottingham, NG6 9DR

Use this website to share your experience by completing our online survey:

• https://rebrand.ly/UserCarerFeedback

This information can be provided in other languages and formats, including large print, easy read, another language.

If you use online tools to translate this leaflet, we cannot guarantee the accuracy of the translation.