In summary, the majority of data is processed because it is necessary to perform a contract or to take steps at your request before entering a contract with you or your employer or to comply with a legal obligation, such as employment legislation or HESA requirements.
Some processing is carried in the public interest such as when the University is carrying out staffing reviews, wherever possible this data will be anonymised.
We hold emergency contact details which will be used to protect your legitimate and vital interest in an emergency situation. Further, occasionally we may decide that we need to process certain information about you without relying on your consent: for example, because the processing is necessary to protect your or another person’s vital interest, to safeguard the welfare of you or someone else or to comply with our legal obligations. In all cases, we will consider that the scope of data being processed and the way in which we will process it means that our approach is proportionate, and the legitimate interests are not outweighed by damage to the rights of the individuals.
Where required we will obtain your consent to use your personal information, for example to set up a job alert by email.
Some information is processed in order to ensure the security of our network and to protect data in our care.
Specifically, we rely on the following lawful basis for processing your personal data under the UK GDPR:
- performance of a contract or to take steps at your request before entering a contract.
- comply with our legal obligations.
- protect your vital interests or those of another person.
- performance of our public task.
- purposes of our or another person’s legitimate interest.
Criminal convictions and offences
Special category data
Where the information we process is special category data, for example your health data, the additional bases for processing that we rely on are:
- explicit consent.
- carrying out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights.
- protect your vital interests or those of another person where you are incapable of giving your consent.
- personal data manifestly made public by you
- establishment, exercise or defence of legal claims.
- processing is necessary for reasons of substantial public interest
- archiving purposes in the public interest or statistical purposes.
In addition we rely on the processing condition at Schedule 1 part 1 paragraph 1 of the Data Protection Act 2018. This relates to the processing of special category data for employment purposes.