Privacy Notice for Staff

Legal basis for collecting your data

Necessary for LSTM to comply with a legal obligation

We process data about you under this legal basis when we need to comply with UK legislation, such as in the areas of employment for tax purposes or to comply with the Equality Act, or laws around health and safety in the workplace.,

Necessary for LSTM to perform a contract with you

We process your data in order to carry out the contract of employment we have with you, or to enter into it in the first place – for example, ensure you can work in the UK, pay you a salary and keep records of LSTM procedures that may concern you such as grievance proceedings, disciplinaries and changes to your employment such as promotion, pay rises, location changes. These examples are not exhaustive.

To meet our public task

 We process your data to ensure that we can carry out our role as an educational and research establishment, meeting legal, moral and contractual obligations.

We process data to meet this public task role when we carry out activities to meet our teaching, learning and research obligations such as:

• Making recordings of webinars and other similar teaching activities
• Quality assurance processes around development and upkeep of courses / modules

Necessary for the purposes of the LSTM’s legitimate interests

Sometimes we will process your data because we have identified a ‘legitimate interest’ in doing so. The legitimate interests we identify are determined through an assessment made by weighing our requirements against the impact of the processing on you. This is done to make sure that our legitimate interests will never override your right to privacy and the

freedoms that require the protection of your personal data. Examples of when we will process your data in our legitimate interests are:

• To take photographs and recordings of events at the university to record the occasion, celebrate success and promote LSTM and its activities,
• To highlight the public profile of staff and students at LSTM including projects they have worked on, publications and grants obtained,
• Monitoring use of IT services to ensure adherence to LSTM’s Acceptable Use Policy
• Enabling effective communications to you about security or operations and to keep you informed and involved with what’s happening at LSTM. This may continue after you have left LSTM if we feel the occasion is applicable to leavers.

You have given us your consent to process your data for a specific purpose

We may sometimes ask for your consent to do something that involves use of your personal data. We will do this where no other lawful basis applies and where it makes sense to give you the highest level of control over how your data is used by us.

For this reason, we will not ask for your consent very often where your data is being processed for employment reasons because one of the other lawful bases listed above will often be more appropriate. However, you would be asked to specifically consent to the processing of your data if, for example, wished to send you marketing, or to process your data where we cannot rely on one of the above bases.

Necessary to protect your vital interests or those of another person

On rare occasions, we may need to access or share your information (including special category data) to protect your life or that of another person, for example in an emergency situation where we cannot gain your consent or to do so could endanger life. We will only rely on vital interests in extremely limited circumstances when no other legal basis is available.

Processing your ‘special category’ personal data

Sensitive personal data, called “special category” data in the legislation, receives extra protection under data protection law. LSTM can only process it if we have an additional lawful basis to rely on and meet higher standards for safeguarding it.

Special category data is defined as information which reveals:

• Your race or ethnicity, religious beliefs, sexual life / orientation, or political opinions.
• A trade union membership.
• Information about your health, including:
  • Any medical condition, health and sickness records
  • Occupational health referrals
  • Records of decisions to leave employment due to ill-health, injury or disability
  • Information required for medical physicians and / or pension providers
  • Details of absences from work (other than holidays) including time on sick leave or statutory / family leave.

Processing is necessary for us to carry out our obligations or exercise our (or your) rights under employment, social security and social protection law

This applies when we:

• Keep a record of reasonable adjustments for a disability to allow us to meet our obligations under the Equality Act
• Ensure that you are physically fit to work in a particular role
• Set up voluntary salary deductions to a trade union

Processing is necessary for purposes of preventive or occupational medicine and to assess your working capacity as an employee

This applies when we obtain advice from medical professionals, such as occupational health or GPs, with regards to adjusting your working practices due to a health condition.

Processing is necessary for statistical purposes

We use this when we collate and analyse data to improve our internal processes or to meet external initiatives such as Athena Swan. We always ensure that your right to data protection is respected, and we ensure that only the minimum of data needed is used for these purposes.

Processing in the substantial public interest

To secure insurance cover for the general protection of LSTM and its staff, maintaining and administering that cover and processing any claims that may arise as a result, which enables our staff to access LSTM’s insurance whilst on approved business or field trips abroad.

Establishment, exercise, or defence of legal claims

Examples of this processing include processing relating to any employment tribunal or other litigation.

Processing is necessary for public health 

For example, in relation to LSTM’s processing of data in response to the Covid-19 pandemic.

Archiving, research and statistical purposes

For example, when collected as part of a research project.

Processing Criminal Convictions and Offenses Data

For certain roles, we are required to seek information about past criminal convictions, working with children or vulnerable adults, and/or your fitness to practice in certain regulated professions.

In cases where a DBS or other criminal record check is required for employment in the position you are applying for or are employed in, we may also receive information regarding criminal convictions and offences.

LSTM may process special category and criminal offence data under Article 10 of the GDPR and in line with the following purposes set out in the following paragraphs of Part 2 of Schedule 1 to the DPA 2018:

• paragraph 6 Statutory etc and government purposes
• paragraph 8 Equality of opportunity or treatment
• paragraph 10 Preventing or detecting unlawful acts
• Paragraph 11 Protecting the public from dishonesty
• paragraph 12 Regulatory requirements relating to unlawful acts and dishonesty etc.
• Paragraph 17 Counselling
• paragraph 18 Safeguarding of children and individuals at risk

How is your information collected?

Personal data that LSTM holds is primarily provided by you through the application process and then then onboarding process for successful applicants. Further information is generated during your employment with LSTM.

• We may generate data ourselves (such as your employee ID and username), or we receive it from third parties, such as: HM Revenue and Customs (HMRC)
• Pensions scheme providers
• Pre-employment checks and assessments. DBS Service, Occupational Health,
• Employment agencies,
• Referees,
• Information may be added by you to the LSTM Research Information System. 

People within LSTM buildings are recorded on CCTV according to our CCTV Code of Practice. Those staff that have registered on the Parkable App will also have their car registration details scanned to access the car park. More information is available from their website – click here

Who will your information be shared with?

Within LSTM, access to your personal data is restricted to those who have a business need to access it.

In some instances, LSTM shares your personal data with others, this includes, but is not limited to:

• HMRC;
• Online identity checks through a digital Right to Work provider;
• External reference provider;
• HR information systems provider, where necessary;
• Global shadow payroll and tax specialists;
• Pension provider;
• DBS check providers;
• LSTM auditors;
• Research England;
• Higher Education Statistics Agency (HESA) their collection notice is published online;
• Occupational health providers;
• UKVI if sponsored by LSTM to work in the UK;
• LSTM legal advisors;
• Police;
• Travel companies or hotel and flight providers if travelling for work;
• Health and insurance providers;
• Third party training providers;
• Third parties when you have requested that data is shared e.g. mortgage companies and reference requests.

LSTM may also share personal data such as your name, job title, personal biography, research interests, etc on externally facing websites such as the LSTM Research Portal and LSTM website.

LSTM may also have to share personal data such as your name, employment dates and current salary with funding bodies/partners who are leading a funding application and their appointed auditors. Data may be shared when we apply for funds to support your employment, or during LSTM and our funders’ audit processes. We will provide the minimum amount of data required in each case and your data will only be provided if your salary is supported by the funder.

LSTM will also share your personal information if there is a legal obligation to do so.

Whenever LSTM shares personal information, it will share a proportionate amount and take steps to ensure that the data is shared securely.

For current staff, we will use any emergency contact information you have provided in ESS should there be a serious concern for your welfare. It is your responsibility to ensure their contact details are accurate. You can add multiple contacts and update the information at any time.

Your rights and how to find out what information we hold about you

The GDPR gives individuals the following rights, please note these rights are not an absolute:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure (to be forgotten)
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling