This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver our recruitment service, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- name and contact details
- National Insurance number
- copies of passports or other photo ID
- education history (for example, qualifications)
- employment details
Special category information may include:
- equalities information (so that we can monitor workplace equality)
- health information
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland Checks)
Why do we collect your personal information and what is our lawful basis for processing?
Service
Disclosure and barring
Purpose
Your prospective or current employer will identify if you require a DBS check. You will be asked to complete an online application form and submit relevant identification documents in order to verify your identity.
Lawful basis
The council is required to process your personal data and your special category data for the performance of your employment contract or to take the necessary steps to enter in to an employment contract.
The council is also legally required to process this information as it has a duty of care towards the vulnerable adults and children that it provides services to.
Service
Recruitment
Purpose
The recruitment team, within employment support services and resourcing solutions are responsible for the administration of the recruitment process. Resourcing solutions are also responsible for promoting and recruiting volunteers within the council.
Lawful basis
UK GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
In connection with certain job roles, the council may need to collect criminal information. For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 1 of the Data Protection Act 2018 as below:
- employment, social security and social protection
When processing special category data, the council will rely on the following lawful basis.
UK GDPR Article 9(2)(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by law meeting schedule 1, part 1 of the data protection act 2018 as below:
- (1) Employment, social security and social protection
- (2) Health and Social Care purposes
UK GDPR Article 9 (2)(g) - processing is necessary for reasons of substantial public interest with processing meeting schedule 1, part 2 of the data protection act 2018 as below:
- (8) Equality of opportunity or treatment
Service
Recruitment hub
Purpose
Resourcing solutions are responsible for the administration of the recruitment process.
Lawful basis
We are required to process your personal data for the performance of your employment contract or to take the necessary steps to enter into an employment contract.
We are also legally required to process your personal data and sometimes your special category data, as defined by employment law or because the council has a legal duty to do so (for example, for equality and diversity monitoring).
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Employment Rights Act 1996 as amended
- Health and Safety at Work Act 1974
- Heath Act 2006
- The Equality Act
Who do we obtain your information from?
The majority of the information we collect is directly from yourself however, we may also obtain information for the recruitment service from your previous employer.
Who do we share this information with?
In the course of delivering our recruitment service, we may need share your information with external agencies. These include:
- DBS National
- third party assessment providers
- potential employers
- your application may need to be submitted to an assessment panel which could include individuals from other organisations. We will tell you if this is the case
- North Yorkshire Council, acting as an Umbrella Body, uses Zellis, a third party system provider, to securely host and process DBS application data. Zellis provides the online platform used to manage DBS applications and also provides North Yorkshire Council’s payroll processing system. Zellis is a UK and Ireland based provider of HR, pay, workforce management and benefits solutions
How long do we keep your information for?
Disclosure and Barring Service
| Data held | Retention period |
|---|---|
| If you are a council employee and there are no concerns | Your information will be held on your personal file and deleted 6 years after your employment ends. |
| If you are a council employee and there are concerns | Your information will be kept until retirement age or 10 years from the allegation date, whichever is longer. |
| If you are not a council employee | Your information will be shared with your employer or relevant organisation. The North Yorkshire Council DBS team will access application data for 6 months after case closure and Zellis (the system provider) will delete records after 2 years. |
Recruitment
| Data held | Retention period |
|---|---|
| If your job application is successful | 25 years from date of birth. |
| If your job application is unsuccessful | Your information will be kept for six months and then destroyed. |
| Volunteer applications if successful | Further information may be collected, with a separate privacy notice provided for specific projects. |
| Volunteer applications if unsuccessful | Your information will be kept for six months and then destroyed. |
Recruitment Hub
| Data held | Retention period |
|---|---|
| Successful applications: application form and application notes | Application forms and notes will be shared with your new employer and kept in line with their retention periods. Resourcing Solutions will retain a copy of your application for 6 years for audit purposes. |
| Unsuccessful applications: application form and application notes | Your application will be kept for 2 years to consider you for future vacancies. |
Other relevant transparency information
Volunteers are only required to provide their name, email address and whether you are over or under the age of 18 and area of interest initially but if you do become a volunteer you may need to provide some of the above information.
Personal data may be contained within documents uploaded to our AI Tools. We are the data controller of your personal data when it is used and the AI supplier/contractor is a data processor. These AI Tools will process personal data in accordance with UK GDPR alongside our various data protection policies. The AI tool does not perform any automated decision making and will not use your personal data to develop its products.
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.