This Specific Privacy Notice has been created to make it easier for you to understand what personal data Essex Police processes about you, how and why it will be used in connection with your employment. It is a requirement of the General Data Protection Regulation (UK GDPR).
It is subordinate to, and should be read in conjunction with, the appropriate high-level Privacy Notice for Essex Police.
The high-level Privacy Notice provides you with complete details of the rights you have relating to the personal data we hold about you now and any personal data we might collect about you in the future.
If you require this Specific Privacy Notice in Braille or in another language, please contact the Force’s Data Protection Officer (contact details below).
Who is the Controller (the person who determines the purpose and means by which your personal data is processed) and what are their contact details?
The Controller for Essex Police is:
Chief Constable of Essex Police Essex Police HQ PO Box 2 Chelmsford CM2 6DA
UK GDPR Article 13(1)(a) and Article 14(1)(a)
What are the contact details of the Data Protection Officers (DPO)?
The DPO for Essex Police is:
Data Protection Officer Essex Police HQ PO Box 2 Chelmsford CM2 6DA
For what purpose(s) is my personal data intended to be processed by Essex Police?
To manage your employment, and all activities in respect of your employment with either of the forces.
UK GDPR Article 13(1)(c)
Whose personal information do we obtain and use via the HR process?
The development and delivery of human resource management is achieved collaboratively across Essex Police. We will manage the personal data of those who apply to work within either force in any capacity and equally those who have subsequently left our organisation:
Contractors or consultants.
What types of personal information do we handle via the HR process?
Essex Police will collect personal information about you to enable us to discharge our responsibilities as an employer. Types of personal data that we will collect, and use includes, but is not limited to:
your contact details and date of birth;
the contact details for your emergency contacts;
your marital status and family details (for tax allowance purposes and the assignment of pension benefits in the event of death in service);
information relating to your contract of employment, performance and behaviour at work;
Special Category data:
Racial or ethnic origin;
Physical or mental health or condition;
Offences (including alleged offences);
Criminal proceedings, outcomes and sentences;
Physical identifiers including DNA, fingerprints and other genetic samples;
UK GDPR Article 14(1)(d)
What is the lawful basis for processing my personal data?
The lawful basis for processing personal data is that it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject on entering into a contract (Article 6(b) UK GDPR) and processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(f) UK GDPR), namely managing employment and resourcing.
The lawful basis for processing special category personal data is that you, the data subject, have given explicit consent to the processing of those personal data for one or more specified purposes, namely employment (Article 9(2)(a) UK GDPR) and processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment (Article 9(2)(b) UK GDPR), as well as processing is necessary for reasons of substantial public interest (Article 9(2)(g) UK GDPR) (DPA 2018, Sch.1, Part 1 and Sch.2, S.6, S.9-11, and S.21).
UK GDPR Article 13(1)(c) and Article 14(1)(c)
Where do we obtain personal information from for the HR process?
Essex Police obtains, through recruitment and the HR process, personal information is supplied by you. In addition as part of the recruitment and vetting process, personal information relating to creditworthiness is obtained from credit reference agencies for vetting purposes, reference information is provided by referees identified by you or previous employers. Personal information relating to criminality (alleged or otherwise) is provided by other law enforcement agencies, and from existing Essex Police-held information.
How will my personal data be processed?
The personal information obtained through the HR process and subsequent activity is handled in accordance with the data protection legislation. In particular we ensure that personal information is handled fairly and lawfully with appropriate justification. We strive to ensure that any personal information used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up-to-date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. All associated data rights are respected.
If my personal data is obtained by Essex Police from someone else what are the categories of personal data collected?
See Part 1 section 4 on the high-level privacy notice on the website
UK GDPR Article 14(1)(d)
Who will my personal data be disclosed to by Essex Police?
See Part 1 section 9 on the high-level privacy notice on the website
In order to carry out the purposes described under section 1 above, we may disclose some personal information provided by applicants to other police forces and credit reference agencies for vetting purposes, and to individuals providing references in support of any application.
In certain cases the forces will use third parties to provide education services. Where you have provided your personal data to us for the purposes of the police constable recruitment process, we will provide your name, email address, and candidate ID to the third party to enable the confirmation of your identity.
We will also disclose personal information to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order.
UK GDPR Article 13(1)(e) and Article 14(1)(e)
Does Essex Police intend to transfer my personal data out of the U.K. or to an international organisation?
No, all personal data remains within the UK.
UK GDPR Article 13(1)(f) and Article 14(1)(f)
If Essex Police intends to transfer my personal data out of the U.K. or to an international organisation what safeguards are there to protect my personal data?
UK GDPR Article 13(1)(f) and Article 14(1)(f)
How long does Essex Police retain personal information obtained for the HR process?
Essex Police keeps personal information as long as is necessary for the particular purpose or purposes for which it is held.
Your personal data will form part of your personnel record with Essex Police, and will be retained by the force for a minimum of six years after you leave our employment.
UK GDPR Article 13(2)(a) and Article 14(2)(a)
What are my rights under the UK GDPR?
Full details of those rights and how to exercise them can be found in Part 2 on the high-level privacy notice on the website
Details can also be obtained from:
Information Rights Team Essex Police HQ PO Box 2 Chelmsford CM2 6DA
You may wish to initially raise any concerns with the Data Protection Officer.
UK GDPR Article 13(2)(d) and Article 14(2)(e)
Am I required to provide my personal data under a statutory or contractual requirement, or a requirement necessary to enter into a contract, or am I obliged to provide it?
If you choose not to provide us with certain personal data you should be aware that we may not be able to fulfil our legal obligations, or provide the necessary HR functions to/for you. For example, if you do not provide us with your bank account details we may not be able to pay you. It might also stop us from complying with certain legal obligations and duties which we have, such as to pay the right amount of tax to HMRC or to make reasonable adjustments in relation to any disability you may have.
UK GDPR Article 13(2)(e)
Will my personal data be used for automated decision-making, including profiling?
Essex Police does not generally utilise a fully ‘automated decision’ in the recruitment process; with the exception of the following three situations which can result in automated de-selection:
If required to be over 18 years old and the answer is ‘No’;
The applicant states they are a member of a political party, terrorist group or organisation banned under UK law;
If the requirement for a particular job is to hold a full UK driving licence with fewer than 6 penalty points and the applicant does not possess this.
All other application criteria are physically checked given the variables involved.
UK GDPR Article 13(2)(f) and Article 14(2)(g)
If my personal data will used for automated decision-making, including profiling what logic will be involved and what significance and consequences will there be for me from the automated decision-making?
Where an application is de-selected in this way the applicant will be notified and offered the opportunity to contact the relevant force in order to provide any further information or discuss the decision further.