Privacy Notice for House of Lords Staff
1. Scope of privacy notice
The House of Lords collects and processes personal data about people who work for the House. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.
This privacy notice sets out information about how we process your personal data if you work for the House of Lords, in other words if you are:
- our employee (current or former)
- a House of Lords office holder
- a committee specialist adviser
- agency staff
- a secondee
- a volunteer
- a work experience student
- a sandwich student
- an apprentice
2. Controller and Data Protection Officer
The House of Lords’ Controller is the Corporate Officer (Clerk of the Parliaments). The Data Protection Officer is the Head of Information Compliance. The Data Protection Officer can be contacted at holinfocompliance@parliament.uk or on 0207 219 5693.
3. What personal data do we collect?
We collect and process a range of information about you. This may include:
- your name, address and contact details, including email address and telephone number, date of birth and gender
- the terms and conditions of your employment
- details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the Administration
- information about your pay, including entitlement to benefits such as pensions
- details of your bank account and national insurance number
- information about your marital status, next-of-kin, dependants and emergency contacts
- information about your nationality and entitlement to work in the UK
- information about any criminal convictions you may have
- details of your days of work, working hours and attendance at work
- details of periods of leave taken by you, including holiday, sickness absence, special leave, career breaks, sabbaticals and the reasons for the leave
- details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence, including information collected in the course of preliminary investigations that do not progress to a formal procedure
- assessments and evidence of your performance, including appraisals, performance reviews and ratings, performance improvement plans and related correspondence
- training records
- information about any awards for which you have been nominated in the context of your employment by the House
- diversity data (if you choose to supply it)
- socio-economic background (if you choose to supply it), including the type of school you attended and your eligibility for free school meals
- information about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments
- confidential information about your use of the Parliamentary Health & Wellbeing Service
- photographs of you in connection with your work
- images captured by the security cameras operating on the Parliamentary Estate
We may collect this information in a variety of ways. For example, data might be collected through application forms or obtained from your passport or other identity documents such as your driving licence when you provide us with such documents; from forms completed by you when you begin work at the House of Lords (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.
In some cases, we may collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks permitted by law.
Our security camera policy (pdf, 323KB) is published on the Parliamentary website.
4. Why we process personal data and our legal basis for doing so
We need to process personal data to enter into an employment contract or other type of contract or agreement with you, to meet our obligations under that contract or agreement and to ensure that you meet yours. For example, we need to process your data to provide you with a contract, to pay you in accordance with the contract and to administer your pension and entitlements.
In some cases, we need to process data to ensure that we are complying with our legal obligations where, for example, we need to check your entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable you to take periods of leave to which you are entitled.
In other cases, we process your personal data:
- to protect your vital interests
- because we have a legitimate interest in doing so
- to fulfil a legal obligation
Here is a list of the ways that we may use your personal data, and of the legal bases we rely on to do so. This is also where we tell you what our legitimate interests are. (There is more information about the law in the Annex on page 7.)
| Purpose | Legal basis and legitimate interests (where applicable) |
| Run recruitment and promotion processes, including pre-employment checks and reference requests | Performance of a contract |
| Maintain accurate and up-to-date employment records and contact details and records of your contractual and statutory rights | Performance of a contract |
| Making salary and expense claim payments and deductions | Performance of a contract |
| Operate and keep a record of disciplinary and grievance processes and other complaints (made by or about you) to ensure acceptable conduct within the workplace |
Performance of a contract Legitimate interests Our legitimate interest is that it is necessary for the purpose of thoroughly investigating the conduct of staff and/or others, for ensuring that all staff and/or others are treated with dignity and respect and to enable us to provide essential information in the case of litigation. |
|
Operate and keep a record of your performance and related processes, to plan for career development, and for succession planning and workforce management purposes |
Performance of a contract |
|
Operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that you receive the pay or other benefits to which you are entitled |
Performance of a contract |
|
Run staff recognition schemes, including assessing information received in award nomination forms |
Legitimate interests |
|
Obtain occupational health advice, to ensure that we comply with our duties if you have a disability, meet our obligations under health and safety law, and ensure that you receive the pay or other benefits to which you are entitled |
Legal obligation |
|
Operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with our duties about leave entitlement, and to ensure that you receive the pay or other benefits to which you are entitled |
Performance of a contract |
|
Contact next of kin in the event of an emergency |
To protect your vital interests |
|
Provide references on request for current or former employees |
Consent Legitimate interests Processing is necessary for the legitimate interests pursued by the prospective employer in ensuring they employ suitable staff. |
|
Respond to and defend against legal claims
|
Legitimate interests Processing is necessary for the purposes of responding to and defending legal claims. |
|
Maintain essential functions during and after an incident, for example a security alert on the Parliamentary estate (business continuity) |
Legitimate interests Processing is necessary for the purposes of contacting staff and/or keeping staff informed in the event of an incident |
|
Maintain and promote equality, diversity and inclusion in the workplace |
Legitimate interests Your consent Data we use for these purposes is collected only with your express consent, which can be withdrawn at any time. You are free to decide whether or not to provide such data and there are no consequences of failing to do. Our legitimate interest is that it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained. |
|
Collect information about employees’ socio-economic backgrounds in order to help the Administration to become as inclusive as possible and be representative of the society we serve, as part of the diversity monitoring process |
Your consent Data we use for these purposes is collected only with your express consent, which can be withdrawn at any time. You are free to decide whether or not to provide such data and there are no consequences of failing to do. |
5. Who we share personal data with
Your information may be shared internally, including with members of the HR Office and the Payroll team, your line manager, managers in the business area in which you work and limited IT and Parliamentary Archives’ staff if access to the data is necessary for performance of their roles.
Where we process special categories of personal data (such as information about ethnic origin, sexual orientation, health or religion or belief), only a limited number of HR staff will have access to this data.
We share your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service.
Where necessary we may share your personal data with the House of Commons Service (for example the Pass Office and the Parliamentary Health & Wellbeing Service).
We share your data, where necessary, with third parties, in connection with the provision of services such as pension benefits, occupational health or administrative services (for example, printing and posting of information to your address). It should be noted that the organisations providing these services are separate Controllers and they should be contacted directly if you wish to exercise any of your rights relating to personal data they hold about you.
We may also share your data with third parties when data protection legislation permits us to do so or when there is a legal requirement to do so.
6. Transfer to third countries
Some personal data controlled by the House of Lords Administration are held outside the UK. These data are predominantly held in data centres within the European Economic Area, for the purpose of hosting and maintenance. If personal data are transferred to third countries outside the EEA, the adequacy of the data protection regimes of those countries and organisations holding the data is assessed to ensure appropriate safeguards are in place.
7. How we protect your data
We take the security of your data seriously. We have in place internal policies and controls to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties.
Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
8. How long we keep personal data
In general, we will hold your personal data for the duration of your employment. In some cases, we will hold your personal data for a shorter period or beyond the end of your employment with us. For full details of the periods for which your data are held, please see Parliament’s Authorised Records Disposal Practice (ARDP).
9. Automated decision-making
Employment decisions are not based on automated decision-making.
10. Your rights
As a data subject, you have a number of rights. You can:
- access and obtain a copy of your data on request
- request us to change incorrect or incomplete data
- request us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
- object to the processing of your data where we are relying on our legitimate interests as the legal basis for processing
- withdraw your consent to us processing your data where we are relying on consent
More information about these rights is available on the parliamentary website.
If you would like to exercise any of these rights, please contact the Data Protection Officer. There may be other occasions where it is necessary to process your personal data that are not detailed in this privacy notice; please do contact your manager or the Data Protection Officer if you would like these explained.
Should you be dissatisfied with our processing of your personal data, you have the right to complain to the Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. What if you do not provide personal data?
You have some obligations under your employment contract to provide us with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under your duty of good faith to your employer.
You may also have to provide data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable us to enter lawfully into a contract of employment with you. If you do not provide other information, this will hinder or even frustrate our ability to administer the rights and obligations arising as a result of the employment relationship.
November 2022 v.5
Annex - our legal bases for processing your personal data
Here are more details of the legal reasons, referred to above, which allow us to process your personal data under the UK General Data Protection Regulation (“the UK GDPR”):
Performance of a contract: Article 6(1)(b) and 9(2)(b) of the UK GDPR
- The processing is necessary for the performance of a contract to which you are a party, or in order to take steps on your behalf before entering into a contract; and
- (in the case of special categories of personal data) the processing is necessary for carrying out obligations and exercising rights under employment, social security or social protection law.
Legal obligation: Articles 6(1)(c) and 9(2)(b) of the UK GDPR
- The processing is necessary for compliance with a legal obligation; and
- (in the case of special categories of personal data) the processing is necessary for carrying out obligations and exercising rights under employment, social security or social protection law.
Your vital interests: Articles 6(1)(d) and 9(2)(c) of the UK GDPR
The processing is necessary to protect your vital interests.
Our legitimate interests: Articles 6(1)(f) and 9(2)(b), (f) and (g) of the UK GDPR
- The processing is necessary for our legitimate interests; and
- (in the case of special categories of personal data) the processing is necessary for:
- carrying out obligations and exercising rights under employment, social security or social protection law;
- the establishment, exercise or defence of legal claims; or
- reasons of substantial public interest set out in law – namely paragraph 8 of Schedule 1 to the Data Protection Act 2018 which allows processing of special categories of personal data (with the consent of the data subject) for identifying or keeping under review equality of opportunity or treatment.
Notes
“UK GDPR” means the UK General Data Protection Regulation.
“Special categories of personal data” means information about your:
- racial or ethnic origin
- religious or philosophical beliefs
- trade union membership
- genetic and biometric data
- health data
- sex life or sexual orientation