Guidance

Civil Service Human Resources (CSHR) Expert Services directorate – Digital Meetings – Privacy notice

Updated 31 December 2021

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

Civil Service Human Resources (CSHR) Expert Services directorate is hosted by Cabinet Office.

We provide expert Human Resources (HR) services to our customers, Civil Service (CS) departments.

Your data

The information we process will be provided via recording a meeting, either as part of the Expert Services Directorate Call, or through an Expert Service Share and Learn. In some cases attendees will be required to complete a consent form prior to attending. Recordings will either take place through MS Teams, Google Hangouts, or Quick Time.

In providing your consent, and depending on what information you provide we may process the following personal data:

• name
• gender
• employment status, job title, grade and work pattern
• location
• opinions
• video recordings
• audio recordings

In providing your consent, and depending on what information you provide we may also process the following special category data:

• racial or ethnic origin
• religious or philosophical beliefs
• trade union membership
• health
• sexual orientation

Purpose

Our main purpose for processing your personal data is to support the government workforce and help departments and professions to build a modern, effective and digital Civil Service.

We require your data in order to:

• lead and promote the adoption of ‘digital by default’ service delivery within the directorate
• enhance both the performance of colleagues in their role, and their ability to represent our wider business when consulting with our collective customers
• provide a long term directorate learning and development offer to current and future employees
• secretariat function for distributing meeting papers - agenda, minutes, newsletters

Recordings may also be required as part of an individual’s workplace adjustment. Where this is necessary, it will be done with the purpose of meeting the individual’s administrative duties, such as minute taking.

Legal basis of processing

Our lawful basis for recording a meeting will either be consent or a legal obligation.

In certain cases, depending on individual circumstances, recording a meeting is a necessary reasonable adjustment for a disabled colleague under the Equality Act 2010. In these cases, your consent will not be required.

Otherwise, we rely on your consent to record you and process your personal data.

Special category data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Where we are recording a meeting as a reasonable adjustment for a disabled colleague, our lawful basis for processing special category data will be that it is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights, under employment law, social security law or the law relating to social protection (para 1, schedule 1, Data Protection Act 2018).

We otherwise rely on your consent to process any special category personal data. Where consent is required, it must be freely given, specific, informed, and unambiguous. As such an explicit consent form will be provided for data subjects to complete, with an affirmed written statement where special category data is involved. All consent forms will be kept as evidence of consent, however it will be clear that consent can be withdraw and how to withdraw consent.

Recipients

Your personal data may be shared with other employees within the directorate as part of a final version of a recording. This will, in some circumstances, involve sharing the special categories of personal data that you have provided.

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email and document management and storage services to us.

Retention

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Recordings will be amended to focus only on those delivering content. The original recording will be deleted within a week of the final document being published. Rolling consent forms will be held for as long as required to achieve the purpose of the data collections, and this will be reviewed annually. Those who consented to recordings may be contacted annually to reaffirm consent.

Recordings made as part of workplace adjustments will be deleted within a week of the recording completing its intended purpose.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

Where we rely on consent:

You have a right to withdraw your consent.

International transfers

As your personal data is stored on our IT infrastructure, and shared with our processors, including survey providers, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision or the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF 0303 123 1113 casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall, London
SW1A 2AS

Public Enquiries: Online Contact Form

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties.

Last updated: December 2021