Privacy notice for employees

The types of information we will collect, store and use about you include:

• your name, address and contact details, including your telephone number, and email address;
• your photograph;
• details of your qualifications, skills, experience and employment history;
• evidence of your nationality and eligibility to work in the UK;
• information about your criminal record;
• information about your terms and conditions of employment as detailed in your appointment letter and contract of employment;
• correspondence with or about you, for example, letters to you about any changes to your terms and conditions, or with your permission, a letter to your mortgage company confirming your salary;
• information needed for payroll, benefits and expenses purposes such as your bank details, national insurance number and tax status;
• emergency contact details;
• records of holidays, sickness and other absence for example if you support strike action;
• records of working hours, such as timesheets or flexitime records, overtime records, flexible working requests, post-approval requests, participation in industrial action and allocated workload for academic staff;
• equality monitoring information such as information about your nationality, legal sex, gender identity, ethnic origin, sexual orientation, disability, carer responsibility, marital status, religion or belief;
• information about your health such as reasons for absence, return to work interviews, Occupational Health reports and medical information or records of any meetings held as part of the sickness absence policy;
• records relating to your career history such as job applications, CVs, references, probationary reviews, training records, professional development, PDPR and applications for positions or promotion, exit questionnaires;
• records relating to external work or consultancy activities undertaken and declared under the University’s Exclusivity of Service procedure;
• records relating to any disciplinary, grievance or capability processes involving you (whether or not you were the subject of those proceedings).

Most of the information we hold about you will have been provided by you, but some may come from other internal sources, such as your manager, or in some cases, external sources, such as referees.

Data will be stored in a range of different places, including your personal file, the University HR information system and in other IT systems, such as the University’s email system.

The University operates a CCTV system for security and crime prevention purposes, to maintain a safe environment and to investigate complaints or concerns regarding safety or security. The CCTV system covers University buildings (inside and outside) and public areas across our campuses. Your images are likely to be captured by the CCTV system while you are on, in, or near University premises.

The GDPR requires that we only use or process your personal data with specific legal basis.

The University needs to process data to enter into an employment contract with you and to comply with our contractual obligations, (GDPR Article 6 (b)) for example, processing your salary payments. LJMU also need to process your data in order to comply with legal obligations (GDPR Article 6 (c)), for example, reporting salary and tax data to HMRC or payment of maternity pay.

The University also needs to process employee’s personal data to pursue its legitimate business interests (GDPR Article 6(f)) in addition to ensuring the performance of your employment contract.  Processing personal data allows the University to:

• operate recruitment and promotion processes;
• maintain accurate and up-to-date employment records and contact details, including who to contact in an emergency;
• operate and keep a record of disciplinary and grievance processes to manage any conduct issues in the workplace;
• operate and keep a record of performance processes, to plan for career development and workforce management;
• operate and keep a record of absence procedures, to ensure effective management and to ensure employees received the benefits to which they are entitled;
• obtain Occupational Health advice, to ensure that the University complies with its duties in relation to individuals with disabilities and health and safety law;
• operate and keep a record of other types of absence and/or leave, to ensure effective management of the University including the provision of academic delivery and to ensure that the University meets its statutory and contractual obligations;
• provide references on request for current and former employees;
• maintain and promote equality in the workplace. 

We sometimes process special categories of personal data, such as those relating to your ethnicity, religious beliefs, trade union membership, sexual orientation, or gender identity.  We do this were we have a lawful basis to do so for example where it is necessary in the course of your employment with us, where it is  required by law or the information is required to protect your health or the health of someone else in an emergency situation (. In some situations we will ask you for your explicit consent to use your special category personal data. If we ask for your consent to process a special category of personal data, then we would explain the reasons for the request.  You do not have to consent to such use, and you have the right to withdraw your consent at any time, by contacting the Data Protection Officer.

The University processes emergency contact details under the basis of legitimate interest to ensure that we can protect and support staff members in an emergency situation. However, as you are providing the name and contact details of your emergency contact to us you should inform them that you have passed on their information to us. Emergency contact details are held securely and will not be used for any other purpose than that stated above.

Your photograph will be used on your staff ID card to ensure secure access to our buildings. It will also be used as your profile picture associated with your MS 365 account to help staff and students to be able to easily identify you. The University will publish your uploaded profile picture as the default image within your LJMU supported network accounts. You have the right to subsequently edit or remove this image from your MS 365 account if you wish.

The University may monitor computer/telephone/mobile phone usage, as detailed in its Policy on the IT Service Conditions of Use.

CCTV footage will be used to maintain the security of the University community, enhance public safety, prevent and detect crime and apprehend and prosecute offenders. It will also be used in the investigation of complaints and allegations made under the University’s rules, regulations, procedures and codes of practice. Further information is available in our CCTV Privacy Notice.

Your information may be shared internally, including with members of HR, Payroll, IT, Finance, Research and Innovation Services (RIS), your line manager, sickness administrators and senior managers when the data is necessary for performing their roles or for University business, one example of this may in the production of grant and project proposals that may include financial information. Another example may be the sharing of information related to absence with managers to ensure that they can effectively manage academic delivery for our students and ensure a safe campus.

In some cases it may be necessary to share your personal data, or information that you have told us in confidence, with support staff or third parties for the purposes of safeguarding you, or young people and adults who we consider to be vulnerable. Where this is required, we would always discuss this with you where possible. Further details can be found our policies including the Domestic Abuse Policy.

Where the University contracts with external companies to ensure the effective maintenance of information systems, the external companies do so on the basis of written instructions, are under a duty of confidentiality and must ensure that they have appropriate technical and organisational measures in place to keep the data secure

Depending on your role, you may be referred to on the University intranet, website or other University documents produced by you and your colleagues in the course of carrying out your duties, for example, programme/module handbooks, departmental webpages and staff profiles. Please contact the communications team if you have any concerns about content on the university websites which constitutes your personal data. You should discuss any staff profiles and pictures with the research team.

We will only disclose information about you to third parties if we are legally obliged to do so or where we need to comply with our contractual obligations, for instance, we may need to pass on certain information about you to the relevant pension scheme. The University also shares data with third parties that process data on its behalf, for example, the provision of occupational health services.  The University shares personal data with HESA to comply with its reporting obligations and to provide statistical returns to HESA as part of benchmarking exercises.  Details on how HESA processes your personal data are set out in the HESA Staff Data Collection Notice.

Where an LJMU employee is undertaking a secondment hosted by another organisation, we will retain all of your employee records, however, we will need to share some of your data with the host organisation. This may include your identity and contact details, your right to work in the UK, your emergency contacts, details of health issues requiring adjustments to your work place and equality and diversity information.

LJMU participates with outside partners in a number of projects each year that are financed in part through either the European Regional Development Fund or European Social Fund. This can mean that the salaries of our staff participating in the project will be funded in part by the Government, and we need to tell them what we are doing and allow them to audit and evaluate the project.

If your contract becomes financed by such Government funding we will write to you to tell you more details of the arrangement and how long it will continue for.

In addition to our usual use of your personal data, we may be asked to provide information, including your name and details of your salary to Government departments. We do this because it is a legal obligation of obtaining this funding. When this occurs, the Government, through the Department for Levelling Up, Housing and Communities (DLUHC) (formerly the Ministry for Housing, Communities and Local Government), or the Department of Work and Pensions will become the data controller of this information. In turn, they may be required to share it with the European Commission, and other independent third parties for the purposes of audit and evaluation. 

The University takes the security of your data very seriously, and has internal policies and controls in place to try and ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessible except by its employees in the performance of their duties.  For more information, please see the University’s Data Protection Policy.

Where the University asks third parties to process data on its behalf, for example, Occupational Health or pension providers, they do so based on written instructions, are under a duty of confidentiality and must ensure that they have appropriate technical and organisational measures in place to keep the data secure.

Your personal data will be stored throughout your employment at the University, and for a period of six years after you have left the University’s employment.  Some types of data, such as pension records, will need to be retained for up to 75 years after you have left. Further information on the University’s approach to record retention can be found in the University’s Records Retention Schedule.

As a data subject, under the GDPR and DPA, you have various rights in relation to your personal data. You can:

• access your own data by making a subject access request;
• ask the University to correct any inaccuracies in the data;
• request that we erase your personal data where we are not entitled by law to process it or it is no longer needed for the purpose it was collected;
• request the transfer of your personal information to another party;
• request that processing of your data is restricted;
• challenge our legitimate interests and request that we stop this processing.

In most situations, we will not rely on your consent as a lawful basis for processing your data.  If we do request your consent to process your data for a specific purpose, you have the right to withdraw that consent at any time.  This will not affect the lawfulness of processing before your consent was withdrawn.

If you wish to make a subject access request or assert any of the rights detailed above, please contact the Institutional Data Protection Officer using the contact details below.

If you would like to exercise any of these rights, please contact the Data Protection Officer: DPO@ljmu.ac.uk.

Certain information, such as contact details, your eligibility to work in the UK and bank details are required to allow the University to enter into an employment relationship with you.

You have certain obligations under your employment contract to provide the University with data. For example, you must report absences from work and you may also have to provide the University with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements.  Failing to provide that data may mean that you are unable to exercise your statutory rights.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit) or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our staff).

Generally, we do not send your personal data outside the UK. However, in some specific cases, we may transfer the personal data we collect to countries outside the UK in order to perform our contract with you/or a contract with another organisation that requires your personal data i.e. a collaboration agreement with a university based outside of the UK. Where we do this, we will ensure that your personal information is protected by way of an ‘adequacy regulation’ with the UK or by putting alternative appropriate measures in place to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the UK laws on data protection. For example model contractual clauses, data sharing/data processing agreement and binding corporate rules (where applicable).

No employment decisions are based on automated decision-making.

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations.  The Information Commissioner can be contacted:

By post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.

By telephone:  0303 123 1113.

By email: contact can be made by accessing www.ico.org.uk

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.