Data Controller
NHS West Yorkshire Integrated Care Board
Purpose
The ICB holds personal and confidential information of its staff for administering sick leave and pay, managing absence, managing a safe working environment and ensuring fitness for work.
Lawful basis
The ICB’s lawful basis for processing personal data under the UK GDPR is Article 6(1) b - - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
For special category data the basis is article 9(2) h - assessment of the working capacity of the employee.
Type of information used
Personal data: your name, the organisation you work for and your pay amounts.
Who we will share the information with (recipients)
The ICB uses a third party provider to undertake its Occupational Health function. Therefore, your personal human resources information will be shared with South West Yorkshire Partnership NHS Foundation Trust.
In addition to the above sharing, information which is required to be disclosed by law will be disclosed to the relevant organisation, for example the Department for Work and Pensions in line with their statutory obligations relating to the working capacity of an employee.
Do we use any processors
The Health Informatics Service (THIS), and West Yorkshire ICB Leeds IT and Leeds City Council IT Integrated Digital Service (IDS) our IT suppliers who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
How we collect (the source) and use the information
The types of information that the ICB processes include personal information contained within your HR record which you provided us with when you started working for the ICB.
How long we will keep the information
6 years after the staff member leaves or the 75th birthday, whichever is sooner.
Your rights
Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the ICB holds about them. Not all rights apply equally to all our processing activities as certain rights are not available depending on the lawful basis for the processing.
If you require further detail each link below will take you to the Information Commissioner’s Office website where further detail is provided in the section ‘When does the right apply’.
These rights are:
- The right to be informed about the processing of your data
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to have your data transferred to another organisation (data portability)
- The right to object to processing
- Rights in relation to automated decision making and profiling
Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.
If you have an enquiry in relation to your data protection rights please contact wyicb.