Workforce Privacy Notice

We use school workforce data to:

• Enable the development of a comprehensive picture of the workforce and how it is deployed (including, but not limited to, internal management planning and forecasting, and statistical analysis such as diversity or gender pay gap analysis as required by law)
• Inform the development of recruitment and retention policies
• Enable individuals to be paid
• Enable us to carry out specific functions for which we are responsible
• Ensure the safeguarding of students and staff and comply with relevant legislation
• Ensure we comply with relevant legislation e.g. Health and Safety at Work Act
• To operate school systems e.g. cashless catering/security systems e.g. door entry systems and swipe-cards
• Supporting the work of the School Teacher Review Body and the School Support Staff Negotiating Body
• Enable us to deal with any disciplinary action and grievances
• Share news about our work and promote our services
• Assess the quality of our service
• Fulfil our contractual obligations
• The purposes of crime prevention and security

We must make sure that information we collect and use, is in line with the UK GDPR and Data Protection Act. This means that we must have a lawful reason to collect the data and that if we share it with another organisation or individual, we must have a legal basis to do so.

Under the UK GDPR, processing of the data held is lawful if at least one lawful basis applies. The bases which we rely on for processing personal information, which is collected and used for the reasons listed above, are as follows:

• Consent (Article 6(1)(a)) – we have permission from you to process the personal data. You do have the right to withdraw your consent at any time.
• Contract (Article 6(1)(b)) – we collect and process personal data necessary for the performance of a contract.
• Legal Obligation (Article 6(1)(c)) – we collect and process personal data so we can comply with the law.
• Vital Interests (Article 6(1)(d)) – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk.
• Public Task (Article 6(1)(e)) – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours.

We process personal data in order to meet the requirements set out in UK employment, academy and safeguarding law, including those in relation to the following:

• Academy Funding Agreement and Articles of Association
• Academy’s legal and statutory framework
• Safeguarding Vulnerable Groups Act 2006
• The guidance “Keeping Children Safe in Education”
• The Childcare (Disqualification) Regulations 2009

Where we are required to collect special category data, we will use the following lawful bases of the UK GDPR which permits us to process special category data:

• Explicit Consent (Article 9(2)(a)) – we may request explicit consent from individuals to process special category data for specific purposes, such as, using biometric information to identify individuals to school IT systems
• Employment, Social Security, and Social Protection (Article 9(2)(b)) – we may process special category data necessary for fulfilling obligations in the fields of employment law, social security, or social protection, such as medical conditions, allergies, or disabilities, to comply with laws that require them to ensure a safe environment.
• Vital Interests (Article 9(2)(c)) – in situations where processing is essential to protect someone’s life, such as during a medical emergency, schools may process special category data without prior consent.
• Made public by the data subject (Article 9 (2)(e)) – to process special category data if that data has been manifestly made public by the data subject.
• Legal claims (Article 9(2)(f)) – where the processing is for the purposes of establishing, exercising, or defending legal claims or by courts when they are acting in their judicial capacity.
• Substantial Public Interest (Article 9(2)(g)) – we often process special category data in the public interest, for instance, to comply with equality legislation, ensure diversity and inclusion.

In addition, we rely on processing conditions of Schedule 1 part 1 of the Data Protection Act 2018. This relates to the processing of special category data for employment purposes.

Beckfoot Trust collects information about you from the following sources:

• Directly from you
• From an employment agency
• From referees, either external or internal
• From security clearance providers
• From Occupational Health and other health service providers
• From Pension administrators and other government departments, for example tax details from HMRC
• From your Trade Union
• Images from our own Surveillance Systems (CCTV)

Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection legislation, we will inform you whether you are required to provide certain school workforce information to us or if you have a choice in this.

In accordance with the UK GDPR, data is only stored for as long is necessary for the purpose it was originally collected. We hold data securely for the set amount of time shown in our data retention schedule.

We will not transfer your data outside the European Economic Area (“EAA”).

All personal information is kept securely either on encrypted, password protected devices and systems, or paper copies kept on the school site. Once the deadline for retaining information has passed, data stored electronically is deleted and paper copies destroyed.

We routinely share this information with:

• Our Local Authority
• The Department for Education (DfE)
• Trust staff
• The pupil’s family and representatives
• Parents or carers of Trust school students
• Educators and examining bodies
• Ofsted
• Suppliers and service providers – to enable them to provide the service we have contracted them for
• Financial organisations
• Central and local government
• Our auditors
• Survey and research organisations
• Health authorities
• Health and social welfare organisations
• Professional advisers and consultants
• Charities and voluntary organisations
• Media publications
• Police forces, courts, tribunals

We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment educational attainment.

We are required to share information about our workforce with the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

The workforce data that we lawfully share with the Department for Education (DfE) through data collections:

• informs the Department for Education (DfE) policy on pay and the monitoring of the effectiveness and diversity of the school workforce
• links to school funding and expenditure
• supports ‘longer term’ research and monitoring of educational policy

The department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

• Conducting research or analysis
• Producing statistics
• Providing information, advice, or guidance

The Department for the Education (DfE) will only share your personal data where it is lawful, secure, and ethical to do so and has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of public benefit, proportionality, legal underpinning and strict information security standards.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For more information about which organisations the Department of Education (DfE) has provided information, (and for which project) please visit the following website: https://www.gov.uk/contact-dfe

Under the terms of UK GDPR, you’re entitled to ask the Department for Education (DfE):

• if they are processing your personal data
• for a description of the data they hold about you
• the reasons they’re holding it and any recipient it may be disclosed to
• for a copy of your personal data and any details of its source

If you want to see the personal data held about you by the Department of Education (DfE), you should make a ‘subject access request’.

Further information on how to do this can be found within the Department for Education’s (DfE) personal information charter that is published at the address below:

Personal information charter – Department for Education – GOV.UK (www.gov.uk)

or

Page not found – GOV.UK (www.gov.uk)

To contact the Department for Education (DfE): Contact the Department for Education (DfE) – GOV.UK (www.gov.uk)

The UK GDPR gives all individuals certain rights about how their information is collected and used. To make a request for your personal information, contact the Data Protection Lead at the relevant school.

You also have the following rights:

• Right to be informed – to be informed about how and why we process your personal information.
• Right of access – to ask for copies of your personal data that we hold about you, this is known as a subject access request (SAR), data subject access request or right of access request.
• Right of rectification – to ask us to change any information you think is not accurate or complete.
• Right to erasure – to ask us to delete your personal information.
• Right to restriction of processing – to ask us to stop using your information.
• Right to object to processing of your information, in certain circumstances.
• Right of data portability – allows individuals to obtain and reuse their personal data for their own purposes across different services.
• Rights related to automated decision-making including profiling.
• Right to withdraw consent at any time (where relevant).
• Right to complain to the Information Commissioner if you feel we have not used your information in the right way.

There are legitimate reasons why we may refuse your information rights request, which depends on why we are processing it. For example, some rights will not apply:

• Right to erasure does not apply when the lawful basis for processing is legal obligation or public task.
• Right to portability does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests.
• Right to object does not apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t have the right to object, but you have the right to withdraw consent.

Complaints and Concerns If you would like to discuss anything on this Privacy Notice or are, unhappy with the way your request for information has been dealt with or think your data has been misused or not held securely, please contact:

Data Protection Officer

Tel: 01274 771444

Email: [email protected]

If you are unhappy with the outcome of your query or complaint, you can escalate your complaint please contact the Information Commissioner’s Office (ICO). ICO helpline, Telephone: 0303 123 1113