Workforce privacy notice

This privacy notice applies to Durham Constabulary personnel, collectively, police officers under the direction and control of the chief constable and police staff, including PCSOs in the employment of the chief constable, but also volunteers (including special officers), agency employees (vetted and carrying work on the instruction of Durham Constabulary) and contractors (vetted but tasked with specific tasks, for instance station or ICT maintenance/repairs, or Portable Appliance Testing (PAT) testing). These will be referred to collectively as “staff” throughout the privacy notice. 

The chief constable of Durham Constabulary is committed to protecting your personal information.

This Privacy Notice contains important information about:

• what personal details we collect
• what we do with that information
• who we may share it with and why
• your choices and rights when it comes to the personal information you have given to us

We may need to make changes to our Privacy Notice, so please check our website for updates from time to time. If there are important changes such as changes to where your personal data will be processed, we may contact you to let you know.

Durham Constabulary and your personal data

This Privacy Notice is provided to you by the Chief Constable of Durham Constabulary who is the controller (previously known as the Data Controller) of this personal information (also known as Personal Data).

“Personal data” is any information about a living individual which allows them to be identified.  Identification can be directly using the data itself, or by combining it with other information which helps to identify a living individual. The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the Data Protection Act 2018 (DPA 2018); this Act incorporates the UK General Data Protection Regulation (the “UK GDPR”) and other legislation relating to personal data and rights, such as the Human Rights Act 1998.

The data we may collect about you

Below is a list of the types of personal data we could collect about you. Please note, this is in no way exhaustive and not all of the data will be collected in all circumstances. The data and the level of detail collected will depend on the purpose for which it is collected.

Personal Data that we may collect includes:

• Personal details such as name, date of birth, gender, address, ID numbers and contact details, including emergency contact details
• Next of kin
• Durham Constabulary user details such as collar number
• Bank account details and payroll records
• Salary and grade details
• Records of any compensation payments
• Education and work history
• Proof of Identity
• Marital status, family circumstance and dependents
• A photograph and/or biometric data
• CCTV footage and swipe card records
• Data from force radios and emails
• Records containing your performance and training
• Records of any complaints made, associated investigations, disciplinary proceedings, and criminal proceedings
• Sickness and other absence details including emergency leave and annual leave
• Your contract and terms and conditions of employment
• Records of grievances
• Health and safety records
• Welfare records
• Information about your use of Durham Constabulary systems

Under certain circumstances we may collect special category personal data. Such data, where collected, even though we may not explicitly ask for it, could reveal the following to differing extents:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade Union membership
• Medical records including physical or mental health
• Sex life or orientation
• Genetic or biometric data

Some of this information may be collected for equal opportunity monitoring purposes.

Please note, any member of staff issued with a device that they set up to use with fingerprint or facial recognition will be required to accept the terms and conditions and provide consent to the provider when setting up functions involving fingerprint or facial recognition.

Durham Constabulary will use the minimum amount of personal information necessary to carry out a particular activity.

Why we use your information

We may process your data to enable us to carry out functions relating to:

• Personnel Management – to carry out all functions relating to your employment, including general administration of your contract or terms and conditions, but also for the management of the workforce. This may include:
  • Payment of salary and allowances
  • Time management and timesheets
  • Performance management and conducting performance reviews
  • Education, training and development requirements
  • Making decisions about your continued employment or engagement
  • Dealing with statutory Disclosure and Barring Service (Darlington) employment requests or College of Policing Authrorised Professional
  • Practice (APP) employment requirements
  • Health and safety
  • Dealing with legal disputes involving you, including accidents at work and injury award claims
  • Providing employment-related benefits to you, such as occupational sick, adoption, maternity, paternity, shared parental and annual leave
• Occupational Health – to look after your wellbeing and welfare.
• Payroll – to manage your wages.
• Pensions – to administer and manage your pensions.
• Departmental Administration and Management – to provide business continuity, business and workforce planning, to compile a staff directory, inventory data and make travel bookings.
• Staff services – to provide services such as reward systems and childcare services.
• Communications and Staff Awareness – to draw your attention to key organisational information.
• Staff recognition – to acknowledge the good behaviour and conduct of our staff.
• Internal Monitoring and Auditing – to monitor your use of our information and communication systems to ensure compliance with the Data Protection Act 2018, and also our relevant policies, including security policies in place to ensure the security of Durham Constabulary staff, visitors, property and information, preventing unauthorised access to our computer and electronic communication systems and preventing malicious software distribution. Any staff member using information for a non-business reason (such as for a personal use), will be committing a criminal offence under Section 170 of the Data Protection Act 2018.
• Professional Standards – Complaint and Counter Corruption matters, disciplinary and criminal investigation matters and grievances including gathering evidence and complying with any connected statutory Disclosure and Barring Service (Darlington)/College of Policing Authorised Professional Practice (APP) employment requirements
• Equality and Diversity – to compile workforce demographic and diversity analysis, monitoring and reporting.
• Health and safety – we may engage in functions which require us to take actions such as, but not limited to, carrying out individual risk assessments, display screen equipment assessments, work station assessments to identify reasonable adjustments, and creating and updating accident/incident records in line with Health and Safety in the workplace legislation.
  Transport – to monitor your use of Durham Constabulary vehicles and radios.
• Continuous Improvement – to identify areas to continuously improve the wellbeing of staff, identify areas of focus to enhance our commitment to staff and improve our services to the public. For example, feedback including surveys.

The organisation collects this information in a variety of ways. For example, data is collected from:

• application forms
• CVs
• identity documents such as passport or driving licence
• forms completed at the start of and during employment
• correspondence, or through interviews, meetings or other assessments

Information may also be collected from outside and internal sources, for example, members of the public or colleagues who may express concern about an employee’s conduct, or from Disclosure and Barring Service (DBS) Darlington.

Data is stored in a range of different places, including in your personnel file, in the force HR management system, in the force’s Professional Standards complaint or counter corruption systems and in other IT systems including e-mail and Teams.

The legal basis for processing your personal data

Some of the purposes for using your data will overlap and there can be several lawful conditions for processing your personal data.

The Chief Constable of Durham Constabulary may process personal data for the following reasons:

• You have given consent for your personal data to be processed, or
  to comply with employment related legislation such as the Health and Safety Act 1974, and ensure we provide a Police Service during times of Business Continuity
• Contractual compliance - The performance of a contract with you, the data subject, to enable you to carry out work responsibilities as part of your employment with Durham Constabulary and also the provision of contractual pay and benefits.
• In the legitimate interest of the controller to allow force employees to show their appreciation for your good work.
• It is necessary for carrying out employment obligations in connection with employment law, including not discriminating against employees, identifying and making reasonable adjustments, not unfairly dismissing, assessing fitness to return to work or for fitness for work, complying with Health and Safety obligations, and pay statutory sick pay.
• It is necessary for performance of a public task, including law enforcement.

Each of the above reasons for processing personal data again provide an equal legitimate basis for the necessary, and proportionate processing of personal data. The DPA 2018 (this Act incorporates the UK GDPR) recognises that because of the imbalance of power between an employer and employees, consent will rarely be considered sufficiently freely given, to then be valid, for the necessary need of processing of human resources personal data. For the Force’s public task processing needs, for example for the Force’s Professional Standards Command’s investigation work, an employee’s consent is not required or will rarely be sought.

Where we process special categories of personal data (special category data was previously defined as sensitive personal data), we will do so in accordance with the specific conditions of processing set out in Data Protection legislation, this includes the following:

• You have given explicit consent for your data being processed; and/or
  It is necessary in the context of employment law, or laws relating to social security and social protection – the Force is legally obliged to comply with any request received from statutory and/or regulatory  and/or Government Bodies, such as the Inland Revenue, the Child Maintenance Service, the Department of Works and Pensions, the Health and Safety Executive, and the Financial Conduct Authority.
• It is necessary to protect individuals’ vital interests.
• The processing is carried out in the course of the legitimate activities of a charity or not-for-profit body, with respect to its own members, former members, or persons with whom it has regular contact in connection with its purposes.
• The processing relates to personal data which have been manifestly made public by the data subject.
• It is necessary for the establishment, exercise or defence of legal claims, or for courts acting in their judicial capacity.
• It is necessary for reasons of substantial public interest and occurs on the basis of a law that is proportionate to the aim pursued and protects the rights of data subjects.
• The processing is required for the purpose of medical treatment undertaken by health professionals, including assessing the working capacity of employees and the management of health or social care systems and services.
• The processing is necessary for reasons of public interest in the area of public health.
• The processing is necessary for archiving purposes in the public interest, for historical, scientific, research or statistical purposes, subject to appropriate safeguards.

Each of the above reasons for processing special category personal data provide an equal legitimate basis for the necessary and proportionate processing of personal data. Again, the DPA 2018 (incorporating the UK GDPR) recognises that because of the imbalance of power between an employer and employees, consent will rarely be considered sufficiently given, to then be valid, for the necessary processing of human resources personal data or for professional standards personal data. For example, whilst employers need explicit consent from an employee to undergo a medical examination, and then explicit consent to the release of the report, consent will not be relied upon, i.e. used, for the holding, and any other necessary use of the same report. Another example where explicit consent from an employee will not be relied upon is in relation to any alleged or proven criminal investigation case.

The Controller will comply with data protection law. This says that the personal data we hold about you must be:

• used lawfully, fairly and in the case of data processed for general ie that is non-law enforcement purposes, or for law enforcement purposes in a transparent way
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• relevant to the purposes we have told you about and limited only to those purposes
• accurate and kept up to date
• kept only as long as is necessary for the purposes we have told you about
• kept and destroyed securely, including ensuring that appropriate technical and security measures are in place to protect your personal data and to protect personal data from loss, misuse, unauthorised access and disclosure

Sharing your personal data

We may share your personal data internally with relevant departments for the purpose of fulfilling one or more of the above stated legal bases. We may also engage the services of external agencies to meet legal requirements, fulfil another lawful basis this may include obtaining professional services such as legal advice to meet our obligations. We may also disclose personal data with external organisations such as the Disclosure and Barring Service (DBS) Darlington, the Durham Police and Crime Commissioner’s Office, and the Independent Office for Police Conduct (IOPC)).

Where we have arrangements to share your personal data, there is a contract, memorandum of understanding or information sharing agreement in place or a mandatory or discretionary legal gateway to ensure that the requirements of the Data Protection legislation on handling personal information are met. Where we are required to disclose information by law, for example for safeguarding purposes or for statutory employee barring requirements, we may do so without or within these arrangements.

We engage with limited third-party processors who process some, or all, of the above-mentioned information on our instruction. We also engage with limited third-party controllers who process some or all of the above-mentioned information for their own legal entity requirements.

Durham Constabulary will take steps to ensure any disclosures of personal data are necessary, proportionate and fair, as required by law. Whenever we share your personal information, sharing options will be evaluated to ensure that your data is shared in the most secure manner.

How we keep your personal information secure

We are committed to ensuring that your personal data is safe and processed securely. In order to prevent your personal data from being accidentally lost, used or accessed in an unauthorised manner, altered or disclosed, we have put in place suitable physical, electronic and managerial measures. These include information security awareness training for our staff. We have also compiled procedures to safeguard and secure the information that we hold about you which our staff adhere to.

Access to your data

Your personal informaton will be shared internally through secure work areas and access controls and will be limited to those who have a business need to know. This may include members of the HR and recruitment team (including payroll), your line manager, managers in the business area in which you work, IT staff and other departments including Professional Standards where it is necessary for performance of their roles on behalf of the Force and/or in the Public Interest.

Your data may also be shared with employee representatives in the context of collective consultation. This would be limited to the information needed for the purposes of consultation.

Employees, contractors and other third parties who handle personal data will only process your personal information in line with our direct instructions and / or in compliance with their statutory legislative gateways. Where we employ limited suppliers (for example a survey organisation such as Durham University) to process personal data on our behalf the relevant Data Processing Agreements will be in place.

Retention of your personal information

Durham Constabulary keeps your personal information for the duration of your employment and for as long as is necessary for the particular purpose, or purposes, for which it is held. The minimum retention period applied to personal information after the end of employment is set out in the force retention schedule.

Your rights and personal data

A key area of change in the new Data Protection Act that is DPA 2018, relates to individuals’ rights. The law refreshes existing rights by clarifying and extending them and introduces new rights.

However, your information rights will be dependent on the reason why the data was collected, how the data was collected and why it is being used.

Find out more about your information rights.

Further processing

If we wish to use your personal data for a new purpose, not covered by this privacy notice, we may provide you with a new notice explaining this new use and setting out the relevant purposes and processing conditions, prior to commencing the processing.  If required by law we will seek your prior consent to the new processing if this is appropriate.

Contact details

Find out how to contact us. This includes how to submit a complaint.