A lovely meal for Will at Indian Ocean, who is leaving us at the end of May. Good Luck Will!
Compliance
GDPR Explanation
EU General Data Protection Regulation (GDPR)
The GDPR is an EU regulation that came into effect on 25th May 2018 and introduced new data protection obligations for organisations and new rights for individuals (you). It has enhanced the current Data Protection Act (DPA) and aims to ensure that businesses adopt a more stringent and effective approach to data protection. The GDPR has introduced a set of new rights for individuals including:
The right of consent
Consent must be clear and affirmative and freely given, businesses in this case Streamline Services Consultancy Limited (here after known as SSCL) will no longer be able to rely on implied consent, silence, or inactivity as a means of consent. The GDPR gives you the right to withdraw consent for your personal data to be processed at any time. You should be informed of this right at the time that you give consent, withdrawing consent should be as easy as giving consent.
The right to be informed
The GDPR will require SSCL to give specific information to you when processing your personal data. The type of information SSCL will be required to give will be dependent on whether we obtain the personal data directly or indirectly from you the individual. Directly means obtaining data from you, and indirectly means obtaining personal data about you from another data controller or third party (job boards, like Linkedin). For personal data obtained both directly and indirectly, we will need to provide you the individual with the following information:
· The contact details of the data controller and the data protection officer;
· The purpose and legal basis for the processing;
· If applicable, the legitimate interests pursued by the data controller or third party where data has been processed lawfully;
· Any recipient of the personal data;
· If applicable, details of the data controller’s transfer of personal data to a third country;
· How long personal data will be stored (otherwise known as ‘the retention period’);
· The existence of the individual’s right to erasure (see ‘The right to erasure’ below);
· The individual’s right to bring a complaint with a supervisory authority (the ICO within the UK);
· The right to withdraw consent at any time where personal data has been processed lawfully;
· Information about the existence of automated decision-making and profiling, as well as information regarding the significance and consequences of processing data in this way for the individual.
Additionally, only for personal data obtained directly from you the individual, SSCL will also need to provide:
· Information about the nature of personal data provisions (whether they are statutory or contractual, whether they are mandatory and the consequences for an individual if they fail to provide their personal data;
Also, only for personal data obtained indirectly, SSCL will also additionally need to provide:
· The categories of personal data
· Information about where the personal data originates from and information about whether it was obtained from a public source;
Time periods (for the right to be informed)
The time periods for when SSCL have to provide this information will again differ depending on whether SSCL obtained personal data directly or indirectly from you the individual.
If SSCL obtain personal data directly from you, then SSCL will need to provide all the above information at the time of first obtaining this information. If SSCL obtain an individual’s personal data indirectly, then SSCL will need to provide the above information to you the individual either:
· Within one month of obtaining your personal data; or
· When first contacting the you; or
· In circumstances where your personal data is shared with a recipient, before sharing the personal data is shared.
All information SSCL provide to you an individual will need to be concise, easily accessible, transparent, written in plain language and free of charge. It must be provided in a machine-readable form, meaning that it must be easily extracted for use by other data controllers.
The right to data portability
This will enable you to move, transfer, receive and reuse their personal data across different IT systems, this only applies to the following:
· Only data provided by you the individual
· Only data that is processed with your consent or on the basis of a contract
· When processing is carried out through automated means
However, if the process is on the basis of a legal obligation, then it will not be subject to the right of data portability.
The right to object
The GDPR will also give you the right to object to the processing of your personal data. The right to object can only be granted in relation to two types of personal data processing and these include:
· Personal data which is processed on legitimate interests or the performance of a task in the public interest (which includes profiling for these purposes); or
· Personal data which is processed for direct marketing purposes, or for scientific/historical or statistical research.
If a you object to the processing of your personal data, SSCL will need to stop all data processing unless:
· SSCL can show a compelling legitimate ground that overrides your rights and freedoms; or
· If SSCL process the personal data for the purpose of legal claims.
Remember when first making contact with candidates, you will need to inform them about their right to object (see ‘The right to be informed’ above). You will also need to communicate this to them in plain language and distinguish their right to object from other pieces of information.
The right to automated decision-making and profiling
Finally, you will have the right not to be subject to any decision based solely on automated processing which produces legal or significant effects. SSCL can only make decisions based on automated processing and profiling if:
· It is necessary for entering into or the performance of a contract between the data controller and the individual;
· It is authorised by Member State law to which the data controller is subject; or
- It is based on your explicit consent.
In the circumstances above where, automated decision-making or profiling are used, SSCL must ensure that we implement suitable safeguards such as ensuring that you can obtain human intervention, can express your point of view and can contest the decision.
The right to rectification
Under the GDPR, you will have the right to have your personal data rectified if it is inaccurate or incomplete. If SSCL distribute or share your personal data with a third party, SSCL will also need to inform any third parties of this rectification. As recruiters, we will be handling personal information that may be subject to rectification, for example, qualification changes. If you make a request to rectify your personal data, SSCL will need to respond within one month of your notification. This can be extended to two months if the request is particularly complex.
The right to erasure
The GDPR will give you the right to have your personal data erased entirely for any one of the following purposes:
· The personal data is no longer necessary for the purpose for which it was originally processed;
- You withdraw consent;
· You object to the data processing (and there exists no legitimate interests to override this right);
· The personal data was processed unlawfully (thus, breaching the GDPR);
· A legal obligation requires that the personal data be removed;
· The personal data was collected in relation to the offer of information society services.
Under the DPA if you want your personal data erased, you must demonstrate that it caused you substantial distress or damage. The right to erasure must also apply to all existing copies, links or replications of the personal (including both online and hardcopies). If SSCL are distributing your personal data to third parties, it will be our responsibility to ensure that we notify the third parties of your request of right to erasure. As recruiters we will typically distribute your personal data to end-user clients, SSCL will need to notify end-user clients of your request for your personal data to be removed. The right to erasure can only be prevented under specific grounds. Personal data will thus not be erased if processing takes place:
- In order to exercise freedom of expression;
· In order to comply with a legal obligation, or for the performance of a public interest task;
- For public health purposes;
· Archiving purposes, or statistical, historical or scientific purposes in the public interest; or
- In order to defend a legal claim(s).
What constitutes as Personal Data
|
DPA |
GDPR |
|
Personal Data · Data that identifies a living individual · Expression of opinion about the individual · Any indication of the intentions of the data controller or any other person in respect of the individual |
Personal Data · Posts on social networking websites, medical information and computer IP addresses |
|
Sensitive Personal Data
· Religious beliefs or other beliefs of a similar nature
· Physical or mental health or condition
|
Sensitive Personal Data · Includes genetic data, biometric data |
|
“Pseudonymised” data |
Right of access / subject to access (SAR’s)
You can make a subject access request (SAR) to any organisation that you believe is processing your personal data. The GDPR makes a few significant changes to the response time and fees for SARs which are explored below.
· Fee: The GDPR will remove the right to charge a fee for SARs. For subsequent requests however, a reasonable fee may be charged but this fee will have to be based on administrative costs.
If a request is excessive due to being repetitive, SSCL can:
· Charge a fee (taking into account administrative costs); or
- Refuse to act on the SAR
It will be SSCL’s responsibility to demonstrate that the SAR was excessive.
Response time: The time period for responding to SARs has also be reduced from 40 days to one month. The one-month period can be extended to two months but only in circumstances where the SAR is particularly complex. If SSCL extend the one-month period, SSCL will be required to inform you within one-month of first receiving the SAR and will have to provide an explanation as to why a two-month period is necessary. If requests by the data subject are made online, then the above information should be provided in a ‘commonly used electronic form’ i.e. email.
Retention Periods
SSCL must keep your personnel and financial records in order to run our business efficiently and to comply with statutory requirements. The type of record will determine the length of time the record must be kept for.
Remember that:
· All records must be kept in accordance with data protection laws . Extra care should be taken with ‘sensitive personal data’ i.e. data relating to race, ethnic origin, political or religious opinions or philosophical beliefs, trade union membership, data concerning health or a person’s sex life or sexual orientation or criminal records.
· Businesses collecting personal data must register with the Information Commissioner’s Office;
· SSCL are not required to keep the original of all documents – copies can be stored but they must be stored in writing, including in electronic format.
· If erasing or destroying records, then destruction must be done securely.
|
Document type |
How long to keep for (and source of requirement) |
|
· Work-seeker records including application form/CV, ID checks, terms of engagement (see also below), details of assignments, opt-out notices and interview notes for unsuccessful candidates. · Hirer records including client details, terms of business (see below), assignment/vacancy details. |
· 1 year from the last date of supply or introduction to SSCL client (Conduct of Employment Agencies and Employment Businesses Regulations 2003 (Conduct Regulations)) |
|
· Terms of engagement with temporary · Worker and terms of business with clients |
· 6 years in order to deal with any civil action in the form of contractual claim (Limitation Act 1980) (5 years in Scotland). · Please note that 6 years is not a minimum legal requirement but is the time period in which a contractual claim can be made. SSCL will still have to establish why it is necessary to keep these records. |
|
· 2 years from the time they were created |
|
· Annual appraisal/assessment records |
· No specific period – under data protection laws SSCL should only keep records for as long as is necessary. |
|
· Under data protection laws, only keep records for as long as is necessary. However, the Conduct Regulations require references to be kept for 1 year following the introduction or supply of a work- seeker to a client. |
|
· Records held relating to right to work in the UK |
· 2 years after employment or engagement has ended – must not be alterable. |
|
· Criminal records checks/ Disclosure Barring checks |
· There is no longer a 6-month time limit on how long DBS certificates can be kept for. When it comes to handling and storing certificates the new DBS Code requires registered bodies to ‘handle all information provided to them by DBS, as a consequence of applying for a DBS product, in line with the obligations under Data protection Act 1998’ . |
|
· National Minimum Wage documentation. · Total pay by the worker and the hours worked by the worker.
· Any deduction or payment of accommodation. · Any absences e.g. rest breaks, sick leave, holiday. · Any travel or training during working hours and its length. · Total number of hours in a pay reference period. |
· For HMRC purposes: 3 years after the end of the pay reference period following the one that the records cover (National Minimum Wage Act 1998) · Or 6 years (5 in Scotland) in order to show that SSCL have paid at least national minimum wage rates if a breach of contract claim is brought against SSCL. |
|
· Sickness records – statutory sick pay |
· Records can be kept in a flexible manner which best suits your business but should be kept for payroll purposes (see below). |
|
· Statutory maternity, paternity, adoption pay |
· 3 years from the end of the tax year to which it relates. |
|
· Pensions auto-enrolment (including auto- enrolment date, joining date, opt in and opt out notices, contributions paid) |
· 6 years except for opt out notices which should be kept for 4 years. For further information please see the Pensions Regulator’s detailed guidance for employers . |
|
· 1 year (but the statement must be kept on the Government website and SSCL’s own website for 3 years). |
|
· 3 years from the end of the tax year – please see CIS record-keeping and PAYE record-keeping guidance on the Gov.uk website. |
Within SSCL performance interests with our clients and third parties, occasionally we are required to forward your personal data, this data can include:
· Work history / CV
· Date of birth
· Proof of NI Number
· Proof of right to work
· Proof of address
· Contact details, phone number, email address, home address
· Certificates & qualifications
· Driving licence, Digital Tachograph card, DCPC card
· Criminal record declaration
· Accident declaration
· DVLA reports
· In relation to DBS checks; family name, work and residential history, nationality, ethnic origin
At any time, you have the right to withdraw consent for SSCL to forward any of your data, to do this you must contact SSCL by either phone/email/SMS message and advise of your wish to withdraw consent.
For more information on what the GDPR is and how it effects your life in the future, you can look at the following web sites:
· European Union GDPR - www.eugdpr.org
- Information Commission office – www.ico.org.uk
If you have any question you can also contact us on: compliance@streamlineservices.co.uk