HR Services, Employee Experience and Artificial Intelligence (AI) privacy notice

Who does this notice apply to?

This privacy notice applies to all Council staff and tells you what to expect when Knowsley Metropolitan Borough Council collects personal information from those seeking to be employed, are employed or otherwise engaged to work within the Council. During the course of its employment activities, the Council collects, stores and processes personal information about job applicants, current employees, former employees, workers (including agency, casual and contracted staff), elected members (councillors), volunteers, trainees and those carrying out work experience. This privacy notice is intended to provide clarity around what types of information we process, collect and share and for what purposes we do this. It is not an exhaustive list of all aspects of employment information, so if you would like additional explanation, please speak to your manager in the first instance or HR.

Who will own my data once I submit it?

Knowsley Council

Why do you need my information?

The Human Resources (HR) Service processes personal information to support the Council's employment responsibilities, workforce management activities and organisational development initiatives.

We use your information to:

Recruit, assess, appoint and onboard employees, apprentices, trainees, graduates, agency workers, volunteers and other individuals engaged by the Council, including processing and reporting on recruitment and selection information relating to successful and unsuccessful applicants, and to administer employment-related and remuneration records for elected members (councillors) where applicable.
Monitor and report on recruitment activity, outcomes and equality information relating to job applicants to support workforce planning, equality monitoring and statutory reporting requirements.
Manage employment contracts and employment records throughout the employee lifecycle.
Administer payroll, pensions, benefits, salary sacrifice schemes and other employment-related services.
Verify identity, right to work, qualifications, professional registrations, references, security vetting and other pre-employment checks.
Monitor attendance, absence, performance, conduct, capability and employee wellbeing.
Manage employee relations matters, including grievances, disciplinary matters, capability procedures, complaints, investigations and dispute resolution.
Support occupational health, health and safety, safeguarding, reasonable adjustments, family leave and employee wellbeing services.
Provide, administer and evaluate learning, development and training opportunities, including apprenticeships, graduate programmes, talent and succession planning initiatives.
Administer access to learning management systems, e-learning platforms and training delivered by approved third-party providers.
Conduct employee engagement, culture, wellbeing, pulse and staff surveys, focus groups and other employee voice activities.
Analyse workforce feedback, survey responses and employee experience data to identify themes, measure engagement and satisfaction, and support organisational improvement.
Support workforce planning, organisational development, service improvement and strategic decision-making.
Develop and deliver equality, diversity, inclusion and belonging initiatives, including employee network groups and related activities.
Meet statutory and regulatory obligations, including workforce reporting, equality monitoring, safeguarding duties and employment-related compliance requirements.
Prevent, detect and investigate fraud, misconduct and other unlawful activity.
Process employment-related, compensation, insurance and other work-related claims.
Respond to complaints, legal proceedings, court orders, employment tribunals and other statutory processes.
Participate in data matching and assurance exercises, including the National Fraud Initiative, where required by law.
Demonstrate compliance with legislative, regulatory and professional standards and requirements.
Administer and maintain HR, payroll, workforce and related information technology systems.
Use approved Artificial Intelligence (AI) tools to assist with administrative tasks, workforce analysis, employee survey analysis, document drafting, information retrieval and service improvement.

We may use anonymised or aggregated workforce information to identify trends, develop policies, improve services, support workforce planning and inform organisational decision-making. Where AI tools are used, they support Council officers in carrying out their duties and do not replace human decision-making in employment matters.

Any AI tools used by the Council are designed to support staff in carrying out their duties and do not replace human decision-making in employment matters.

What personal information do we collect?

Depending upon the service being provided, we may collect:

Personal and contact information

Full name.
Address.
Date of birth.
Contact telephone number.
Email address.
Emergency contact details.
Family and dependant information.

Employment information

Employee number.
Job title and employment details.
Recruitment and selection information.
Work history and previous employment details.
References.
Right to work documentation.
Professional memberships, registrations and licences.
Security vetting information.
Career development, talent and succession planning information.
Apprenticeship, graduate and early talent programme information.
Councillor and elected member information held for payroll, allowances, governance, statutory reporting and related administrative purposes.

Pay, benefits and pensions

National Insurance number.
Bank account details.
Payroll information.
Pension information.
Benefits and salary sacrifice information.

Learning and development

Training and qualification records.
Learning platform usage and training participation information.

Workforce management and employee relations

Attendance and absence records.
Performance and appraisal information.
Employee feedback and comments.
Employee engagement and wellbeing data.
Disciplinary, grievance, capability and other employee relations records.
Flexible working, family leave, caring responsibilities and reasonable adjustment information.
Health and safety incident information.
Information provided through organisational development, employee engagement, employee voice, staff networks and organisational development activities, including workshops, focus groups, survey responses and participation information.

Equality, diversity and inclusion information

Protected characteristics.
Equality monitoring information.
Care leaver status.
Military service information.

Safeguarding and compliance information

Information relating to criminal convictions, allegations, offences and Disclosure and Barring Service (DBS) checks, where required.
Fraud investigation, safeguarding or other compliance-related information, where required.

We may also collect special category personal data where necessary and lawful, including:

Health and medical information.
Occupational health records.
Disability information.
Trade union membership.
Racial or ethnic origin.
Religious or philosophical beliefs.
Sexual orientation, where voluntarily provided and lawful to process.

Survey responses will normally be reported in an aggregated and anonymised format wherever possible. However, in some circumstances, identifiable information may be collected where this is necessary to investigate concerns, provide support, or where an employee chooses to identify themselves.

What allows you to use my information?

The lawful basis which allows the Council to process your personal data falls under the UK General Data Protection Regulation (UK GDPR).

Article 6(1)(a) Consent

"The data subject has given consent to the processing of their personal data for one or more specific purposes."

In limited circumstances, the Council may rely on consent where participation is voluntary and individuals are able to withdraw their consent without detriment. This may include certain optional employee engagement activities, promotional activities, photographs, testimonials or other initiatives where consent is appropriate.[BC1.1]

Article 6(1)(b) Contract

"Processing is necessary for the performance of a contract to which the data subject is party."

Article 6(1)(c) Legal Obligation

"Processing is necessary for compliance with a legal obligation to which the controller is subject."

Article 6(1)(e) Public Task

"Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

Article 6(1)(f) Legitimate Interests

“Processing is necessary for the purposes of a legitimate interests pursued by the controller.”

Where special category data is processed, the Council relies upon:

Article 9(2)(b)

"Processing is necessary for carrying out obligations and exercising specific rights in the field of employment, social security and social protection law."

The relevant processing condition under the Data Protection Act 2018 is Schedule 1, Part 1, Paragraph 1, Employment, social security, and social protection.

Article 9(2)(g)

"Processing is necessary for reasons of substantial public interest."

The relevant substantial public interest processing conditions under the Data Protection Act 2018 are as follows:

Schedule 1, Paragraph 6, Statutory and Government purposes.
Schedule 1, Paragraph 8, Equality of opportunity or treatment.
Schedule 1, Paragraph 9, Racial and ethnic diversity reporting at senior levels.
Schedule 1, Paragraph 21, Occupational pensions.

Article 9(2)(h)

"Processing is necessary for occupational medicine, assessment of the working capacity of an employee, medical diagnosis or the management of health or social care systems and services."

Where employee surveys are undertaken and special category data is collected, processing will only take place where a lawful basis exists, and appropriate safeguards are in place.

The relevant processing condition under the Data Protection Act 2018 is Schedule 1, Part 1, Paragraph 2, Health or social care purposes.

Where AI tools are used, personal information will only be processed where there is a lawful basis to do so, and appropriate safeguards have been implemented.

Who will my information be shared with?

Your information may be shared with:

Council services and authorised officers who require access to carry out their duties.
Payroll providers.
Pension administrators, including Additional Voluntary Contribution (AVC) providers.
Occupational Health providers and other healthcare professionals.
Learning and development providers, including universities, colleges, training providers and apprenticeship providers.
Recruitment agencies, assessment providers, coaching, mediation and other employment-related consultants.
Disclosure and Barring Service (DBS) and organisations involved in vetting and safeguarding processes.
HM Revenue and Customs (HMRC).
Department for Work and Pensions (DWP).
Department for Education (DfE).
Education and Skills Funding Agency (ESFA).
Government departments, agencies and public bodies where information sharing is required by law or necessary for the performance of public functions.
Regulatory, inspection and professional bodies, including those responsible for overseeing professional standards and statutory compliance.
External auditors and assurance providers.
Legal advisers, courts, employment tribunals and other judicial bodies.
Police forces, emergency services and other law enforcement agencies where required by law or to protect individuals or the public.
Trade unions and employee representatives, where appropriate and lawful.
Current, former or prospective employers for the purposes of employment verification and references.
Financial organisations, benefits providers and salary sacrifice scheme administrators.
Local Government Association (LGA), Office for National Statistics (ONS) and other organisations involved in workforce research, benchmarking, reporting or statutory data collections.
Employee survey providers appointed by the Council.
Approved technology suppliers, including cloud service providers, learning management system providers and Artificial Intelligence (AI) service providers where required.
Other partner organisations where information sharing is necessary to deliver services, fulfil contractual obligations, protect individuals, investigate concerns, prevent fraud, or comply with legal and regulatory requirements.

Information will only be shared where there is a lawful basis to do so and where appropriate contractual, security and confidentiality arrangements are in place.

Survey results will generally be reported in an aggregated format to protect individual confidentiality. Where response numbers are very low, results may be combined with other groups to reduce the risk of identification.

Do I have to provide this information, and what will happen if I don't?

In most cases, you are required to provide information that is necessary for the Council to:

Enter into and manage your employment contract.
Pay you correctly.
Provide employment-related services and support.
Meet statutory obligations.

Participation in employee surveys is normally voluntary unless otherwise specified.

Failure to provide relevant employment information may result in the Council being unable to employ you, administer your employment, provide support services or fulfil its legal obligations.

Choosing not to participate in employee surveys will not affect your employment, pay, terms and conditions, or access to services.

What do I do if I no longer want you to hold this information?

In most circumstances the Council processes your information because of legal and employment obligations rather than consent.

If you have concerns about the processing of your information, please contact:

Human Resources Service, Knowsley Council

Or contact the Council's Data Protection Officer using the details provided below.

How long will you keep this data for and why?

Information is retained in accordance with the Council's Retention Schedule and legal requirements. Details of retention periods can be found within the Council's Corporate Retention Schedule and HR-specific retention arrangements.

Retention periods vary depending on the type of information held and the purpose for which it was collected.

Personnel and employment records are retained in line with business, legal and regulatory requirements.

Employee survey data will usually be retained only for as long as necessary to analyse results, monitor trends and support workforce planning and organisational development activities. Survey retention periods will be determined in accordance with the Council's Retention Schedule and the purpose of the survey.

Information will be securely deleted or anonymised when it is no longer required.

The Council may continue to retain and process certain information relating to former employees where required for pension administration, employment references, legal obligations, claims management, audit requirements or other statutory retention requirements.

How will my information be stored?

Your personal data will be stored on the Council's secure systems and networks.

Access is restricted to authorised staff who require access to carry out their duties.

Appropriate security measures are in place including:

Role-based access controls.
Audit trails and monitoring.
Encryption.
Secure Microsoft 365 environments.
Information governance controls.
Cyber security safeguards.

Where approved AI systems are used, the Council will ensure suitable technical and organisational measures are in place to protect personal information.

Will this information be used to take automated decisions about me?

No.

The Council does not make solely automated decisions about employees or job applicants that produce legal or similarly significant effects.

Employee survey information may be analysed using reporting tools and approved AI technologies to identify themes, trends, patterns and sentiment across the workforce. This analysis is used to support organisational development, workforce planning and service improvement and will not be used as the sole basis for making decisions about individual employees.

Where AI tools are used to assist HR processes, these tools support staff by providing recommendations, analysis or draft content. Any employment-related decisions will be reviewed and approved by appropriately authorised officers.

Use of Artificial Intelligence (AI)

The Council recognises the opportunities that Artificial Intelligence (AI) can provide in improving efficiency and supporting service delivery.

Within HR, approved AI tools may be used to assist with:

Drafting reports, correspondence, policies and procedures.
Summarising information and meeting notes.
Workforce reporting and analysis.
Analysing employee survey responses and free-text comments.
Identifying themes, trends and workforce insights.
Supporting knowledge management and information retrieval.
Improving administrative efficiency and service delivery.

The Council will:

Ensure human oversight of all significant employment decisions.
Undertake appropriate Data Protection Impact Assessments (DPIAs) and AI risk assessments where required.
Monitor AI systems for accuracy, fairness, bias and security.
Maintain appropriate technical and organisational security controls.
Comply with UK GDPR, the Data Protection Act 2018, employment legislation and the Public Sector Equality Duty.

AI systems are used to support officers in their work. Accountability for employment decisions remains with authorised Council officers and not the AI system itself.

Employee survey data processed using AI technologies will be analysed to identify trends, themes and organisational insights. AI-generated outputs will be reviewed by authorised officers and will not be used as the sole basis for making decisions about individual employees.

Will my data be transferred abroad and why?

Your information is not routinely transferred outside the United Kingdom.

Where approved systems process information outside the UK, appropriate safeguards will be in place to ensure compliance with UK GDPR requirements.

Where cloud-based survey, AI or technology providers are used, any international transfers will be subject to appropriate contractual safeguards and legal protections.

What rights do I have when it comes to my data?

Under the Data Protection Act 2018 and UK GDPR, you have the following rights regarding your personal information:

The right to be informed.
The right of access.
The right to rectification.
The right to erasure (where applicable).
The right to restrict processing.
The right to data portability (where applicable).
The right to object.
The right not to be subject to solely automated decision-making and profiling.

To find out more about your rights under the Data Protection Act 2018 and UK GDPR, please visit the Information Commissioner's Office website.

To request a copy of your information or ask questions about how it is used, please contact:

Data Protection Officer
Knowsley Council
Nutgrove Villa
Westmorland Road
Huyton
L36 6GA

Email: Inforights@knowsley.gov.uk

Who can I complain to if I am unhappy about how my data is used?

You can complain directly to the Council's Data Protection Officer by writing to: