Suffolk County Council’s Safety, Health and Wellbeing Team are responsible for providing competent health and safety advice and support to the organisation and facilitate systems to help manage the organisation’s health and safety responsibilities. On occasion we may need to collect and use personal data so that
we can fulfil these duties.
Why we collect and use this information
The Suffolk County Council Safety, Health and Wellbeing Team collects, processes, holds and shares personal data in relation to three areas of responsibility:
- Health and safety incident, and safety concern reporting which relates to the work undertaken by the Council. The information is captured to enable monitoring of the health and safety culture within the organisation; to help prevent future incidents of a similar nature; and to comply with legal requirements.
- The provision of lone working and personal safety devices to staff as part of the risk management for our staff. The lone working system collect personal data from employees who need emergency assistance if they are at risk of assault, are taken ill, if they have fallen or otherwise been injured. The devices and solutions enable staff to covertly summon assistance.
- The cloud based EVOLVE portal to support and advise subscribing schools in their safe management of educational visits, school trips and learning outside the classroom.
What data do we collect, process, hold and share?
For health and safety incident, and safety concern reporting, we collect:
- Basic personal information about the injured person (name, address, phone number, email address, job title)
- Health details where relevant for the reported incident, including injury details and treatment. This type of information is known as special category data because it is more sensitive.
This information is captured whenever a health and safety incident or safety concern is reported which involves employees of Suffolk Council or members of public
affected by the work of Suffolk County Council including, though not limited to:
- Pupils and parents at Suffolk County Council maintained schools.
- Service users, customers or members of public meeting Suffolk County Council employees whether at Council premises or elsewhere.
- Contractors or subcontractors attending the Council’s premises.
- Councillors, volunteers, temporary and agency workers and consultants working on our behalf as well as anyone else working on behalf of Suffolk County Council.
For the personal safety device provision, we may collect the following information for staff:
- Personal information about employees such as name, work email address, work phone number, car registration number, and physical description of themselves
- Health and other sensitive information (e.g. domestic abuse) where relevant for a potential emergency.
For the EVOLVE portal, we collect:
- Personal information for participants on trips (Name, emergency contact details, job role, work email address).
- Health details which may have an impact on their daily attendance at school and on school trips.
The information is captured for pupils attending trips, staff and volunteers registered on the portal and/or attending trips.
The lawful basis on which we use and share this information
The lawful basis for holding and processing personal information for the purposes of health and safety incident and safety concern reporting is that it is necessary for the Council to comply with a legal obligation.
The lawful bases for holding and processing special category data for the purposes of health and safety incident and safety concern reporting are as follows:
- where processing is necessary to comply with obligations under employment law
- where processing is necessary for reasons of substantial public interest, specifically, where it is necessary for the exercise of statutory functions.
Suffolk County Council, as an employer, has a responsibility under the Management of Health and Safety at Work Regulations 1999 to monitor and review the preventive and protective measures both for employees and members of public, who may be affected by our undertaking.
Suffolk County Council also has a legal obligation to report certain types of incidents to the Health and Safety Executive (HSE) as per the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013.
The legal basis for holding and processing the information for the personal safety devices is an employment contract agreement. The council has a legal responsibility to do all that is reasonably practicable to keep employees safe as per the Health and Safety at work Act (etc.) 1974 and the Management of Health and Safety at Work Regulations 1999.
Due to this responsibility, the legal basis for holding and processing special category data for the purpose of the personal safety devices is based on the UK General Data Protection Regulation Article 9(2)(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law. The legal basis for holding and processing the information on the EVOLVE portal is Legitimate Interest under the General Data Protection Regulation, Article 6(1)(f) with the Reasons of Substantial Public Interest with the condition of Safeguarding of children and of individuals at risk, from the Data Protection Act 2018, Schedule 1, para 18.
Legitimate interests
The legitimate interest basis under the UK GDPR permits processing of personal data in ways that you would reasonably expect and that have minimal impact on you, or where there is a justified reason for processing your data.
The Safety, Health and Wellbeing team have a legitimate interest in providing support and advice to schools to ensure safe management of educational visits, school trips and learning outside the classroom, and to ensure that all risks associated with learning outside the classroom are considered when assessing the safety of a trip. This includes the risks that can arise from medical conditions of participants. This is in the best interest of the individual participant.
We only rely on legitimate interests when processing personal data is necessary to achieve that legitimate interest and where it does not override you rights.
Who do we share this information with, and why?
The personal information and health related details captured for health and safety incident and safety concern reporting are captured for internal use. However, they may be shared outside the organisation with the HSE if the incident needs to be reported to them in accordance with the Reporting of Injuries, Diseases and
Dangerous Occurrences Regulations 2013 and/or the HSE is investigating the incident or related incidents. It may also be shared with relevant people as part of the evidence in relation to a legal claim.
The personal information, health and other sensitive information for the provision of the personal safety devices is captured on our provider’s secure online portal and the provider has access to all the data on the portal. This is to enable the provider’s Alarm Receiving Centre, which may be provided by a subcontractor, to identify the person requesting assistance and to check they are ok or if they need assistance. The data will also be used to verify that the person responding to the Alarm Receiving Centre is the employee, not a perpetrator pretending to be an employee. Any medical data may be passed on to emergency responders if appropriate to ensure appropriate and safe emergency assistance.
The personal information and health related details captured on the EVOLVE portal are uploaded by the schools and are shared with eduFOCUS, as the providers of the EVOLVE portal. This is to enable them to provide technical support to the management of the portal.
The information is also shared with EVOLVE Advice, who have access to the EVOLVE portal to provide support and advice in their capacity as our commissioned Educational Visits Advisor, and to provide admin support to schools, who are signed up to the service.
Storing this information
Your information will be held securely by the Health and Safety Team. We will only keep it for as long as we need to fulfil our obligations and to comply with national standards for keeping certain types of data. Once the relevant retention periods are reached, the data will be securely and permanently destroyed.
Automated decision-making and profiling
The Safety, Health and Wellbeing Team does not use automated decision-making processes or profiling in respect of your information for any of the services we provide.
Storing this information
Your information will be held securely by the Health and Safety Team. We will only keep it for as long as we need to fulfil our obligations and to comply with national standards for keeping certain types of data. Once the relevant retention periods are reached, the data will be securely and permanently destroyed.
At no point will the data be transferred abroad.
Your rights
Under data protection law, you have the right to request access to the information that we hold about you. If you would like to make a request to access your personal information, please contact data.protection@suffolk.gov.uk.
You also have other rights regarding your personal data which are set out in Suffolk County Council’s corporate privacy notice.
If you have a concern about the way we are collecting or using your personal data, please raise your concern with us in the first instance, by writing to the Health and Safety Team at healthandsafety@suffolk.gov.uk or by post to:
Safety, Health and Wellbeing Team
Constantine House
5 Constantine Road
Ipswich
IP1 2BX
Alternatively, if you would like independent advice about this privacy notice or other matters about personal information, including complaints, you can contact the Information Commissioner’s Office.