Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council for the purpose of Health & Safety
Introduction
This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC’, ‘Council’, ‘Local Authority’, ‘we’) will use (or ‘process’) personal data about individuals for the purpose of Health and Safety.
This notice should be read in conjunction with;
The Data Controller
The Council is the data controller for the personal data processed for the purposes of Health & Safety.
The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.
Queries relating to this privacy notice
If you have any questions or queries relating to this privacy notice please contact the Health & Safety Team:
By email : healthandsafetyteam@rctcbc.gov.uk
By telephone : 01443 425531
In writing : Health and Safety Team, Human Resources, Ty Elai, Dinas Isaf East, Williamstown, Tonypandy. CF40 1NY
Who we are what we do
The Council has a legal obligation for ensuring the health and safety of its employees and members of the public who access Council services and premises, or who may be affected by its activities.
Part of this legal obligation is met by ensuring that the Council has proper policies and procedures in place to manage the Councils incident / accident process, by:
- Centrally recording all incidents
- Investigating certain incidents / accidents
- Identifying trends and making recommendations to help prevent further incidents / accidents.
This function is conducted throughout all Council service areas. The Health and Safety Team has overall responsibility for this, and also acts as the ‘responsible person’ for reporting required incidents / accidents to the Health and Safety Executive.
Whose personal data we process
The information the Council collects and uses for the above purpose will vary depending on the type of incident or accident that has taken place and who is involved. This may involve employees, agency workers, contractors, visitors, clients, members of the public, and include pupils and other young persons.
As part of our review of the incident /accident and any investigation we may also need further information such as:
- Witness information such as statements of what they saw, their name, address, contact details and if relevant, information about their relationship with the person involved in the incident
The categories of personal data we process
We may process the following categories of personal data for the purposes of Health & Safety;
- Name
- Address
- Telephone number
- Email address
- Date of birth
- Occupation
- Status i.e. Service User/ Pupil/ Visitor etc.
- Details of incident i.e. Location, date, time etc.
- Details of injuries, first aid/ hospital treatment received
- CCTV images
- Health information
- Education/ training details
Why we process the personal data
We process the personal data for the purposes of Health & Safety. This may include but is not limited to the following activities;
- INCIDENTS AND ACCIDENTS (recording, reporting and investigations)
Collate data regarding incidents and accidents that occur either on Council premises or as a result of Council activities. The data is (usually) recorded on standard forms and will be gathered locally by other employees of the Council (such as managers, Head Teachers etc.) and forwarded to the Health and Safety Team. The team examines every form received and where the data refers to a Council premise or activity, data will be stored either on personal files (and some detail on iTrent) and in an excel spreadsheet. The team produces various statistical reports from the data for sharing with relevant managers.
Certain incidents / accidents will be further investigated by the Health and Safety Team and in such instances additional data (to that originally provided on the submitted form) may be gathered and stored, usually electronically in a Word document. Any subsequent report will be shared with the relevant management.
Where submitted forms do not relate to a Council premise or work activity the forms are destroyed after a maximum period of 3 months.
A copy of each completed form is kept at the specific location (either where the accident occurred or the fixed base of the employee, if peripatetic employee involved) – the Council has received approval from the Department for Works and Pensions to utilise this file as our ‘accident book’.
Whilst Line Managers are responsible for investigating all incidents / accidents that occur as a result of their work activities, occasionally the Health and Safety Team will also undertake an independent investigation, dependent upon the circumstances and possible outcomes of the incident (this may be where any lessons learned will be of benefit to the wider Council, for example, other teams, service areas etc.). In these instances, additional personal data such as qualifications and experience, together with health / medical information (if this arises from or had an influence on the incident / accident) may be processed. Reports are shared with the relevant line manager, Head of Service, Director.
Where statistical information is shared, for example, with Trade Unions etc. all personal detail is anonymised.
All stored records are kept electronically if a paper copy is received it is disposed through confidential waste following transfer to electronic records. The electronic records are kept for a minimum of 3 years after the date of the incident / accident.
The Council has a legal obligation to notify and report certain work related incidents, accidents and cases of ill-health to the Health and Safety Executive (HSE - the enforcing authority for the Council). The Health and Safety Team acts as the ‘responsible person’ and formally undertakes this function on behalf of the Council. In practice this duty is met by completing an HSE generated on-line form, which, when in relation to an individual, will contain personal data.
Our lawful basis for processing the personal data
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data for the purposes of Health and Safety is;
- Legal Obligation (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The primary legislation, regulations and guidance that supports this includes, but is not limited to;
Who or where we get the personal data from
We may receive the personal data from the following categories of individuals or organisations;
- Incident/ accident report form (HS5(A)
- Violence at Work Form (HS(V1)
- Witness statements
- CCTV
- Medical records
Who we share personal data with
We may share the personal data with the following key organisations for the purpose of Health & Safety;
When sharing the personal data, we only share the minimum amount necessary in relation to the purpose.
|
Who
|
Purpose
|
|
Relevant Managers
|
To afford managers the opportunity to learn lessons from incident and where necessary introduce control measures to prevent re-occurrence
To enable managers to determine whether additional control measures are needed.
|
|
Insurance Section
|
To support any claims process
|
|
Emergency Services/GP
|
If urgent medical treatment is required
|
|
Law enforcement e.g. Police
|
If an incident needs to be reported, for example if it is a criminal matter
|
|
Health and Safety Executive
(RIDDOR only)
|
Legal requirement
|
Data Processors
A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.
The categories of data processors we use for the purpose of Health and Safety is/are;
- IT system suppliers etc.
How long we retain the personal data
We retain the personal data contained within Health and Safety records for:
|
Length of time
|
Reason
|
|
Accidents - Current year + 3
|
Time limit for claims
|
|
Health and safety Inspections -Current year +6
|
Good business practice
|
|
Risk assessments/
Safe systems of work - Keep whilst still relevant/ until superseded
|
Good business practice
|
|
Training records - Period of employment
|
Good business practice
|
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Not all personal data is retained. Only personal data that is relevant to the record is retained for the entire retention period. Information that has no long term or evidential value is routinely destroyed in the normal course of business.
Your data protection rights
The General Data Protection Regulation (GDPR) gives individuals important rights, including the right of access to the personal data that the Council holds about you.
Click here for further information on your information rights and how to exercise them.
Your right to make a data protection complaint to the Council
You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.
You can do this by contacting the Health and Safety Team directly via one of the following communication methods. Most concerns can be resolved relatively quickly through a simple phone call or email;
- By email: healthandsafetyteam@rctcbc.gov.uk
- By telephone: 01443 425531
- In writing: Health and Safety Team, Human Resources, Ty Elai, Dinas Isaf East, Williamstown, Tonypandy. CF40 1NY
Alternatively, you can raise a formal complaint via the Council’s Customer Feedback Scheme using the following link (Make a comment, compliment or complaint online) or you can contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk.
Your right to make a data protection complaint to the ICO
You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.
The ICO can be contacted:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk