We keep the Workforce Development Unit (WDU) Privacy Notice under review. It was last reviewed and updated in June 2020.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
Personal data
We collect and use the following personal data:
- your personal data including name, telephone number and email address
- booking information for and participation in courses including e-learning (your learning history)
- your workplace and type of work
- your manager and their contact details if applicable
- any additional information that's necessary for us to assess and provide you with the service you require (including disability requirements)
See further details about how we define personal data and non-personal data.
Collecting personal data
Your personal data is collected via:
- information you provide via your on-line account in My Learning Online (MyLO)
- the Human Resources system iTrent (for council employees only)
- your workplace manager
- post, email and telephone conversations made as appropriate
When we ask you for personal data, we will:
- ensure you know why we need it
- only ask for what is necessary for the work we're undertaking
- store it securely
- ensure your data is only shared with authorised individuals
We ask that you:
- give us accurate information
- inform us of any changes
- tell us as soon as possible if you notice mistakes in the information we hold about you
Using personal data
We'll use your personal data to:
- administer your training records and provide your training history
- offer advice and guidance on appropriate training for your role or area of interest
- contact you about your bookings and any changes to arrangements
- invoice you (or your employer, if applicable) for training fees including non-attendance or late cancellation (see MyLO Terms and Conditions)
- provide your employer/manager with your training information including bookings, cancellations, test results and attendance information
- create anonymous statistical reports to help us plan future training
- send information about training that may be of interest if you have chosen to receive this information (if you have opted-in to our mailing list)
We use the data to create statistics that are anonymous and cannot be linked back to you. We could use these statistics to see how the WDU, the wider council and its partners are supporting workforce development across sectors, to help design better services and to contribute to national surveys and government returns, for example, to the central government workforce data returns (Adults and Children’s Social Care) or to Care Quality Commission or Ofsted.
Our legal basis for using personal data
The data you provide to the WDU enables us to provide learning and development opportunities to you, to support workers to be appropriately qualified in key areas (such as safeguarding or health and safety) as required for their role, and to support workforce development across a range of sectors in the council’s remit.
The data you give us ensures that we can provide recommendations regarding learning and development opportunities to meet your needs at work.
For external customers (not employed by the council), we'll use your personal data because you are asking us to do something on your behalf. We may not be able to do what you have asked us to do if you don't provide us with your personal data to use as described in this privacy notice.
In some cases we may need to use your personal data to ensure that we're complying with our legal obligations, or where we are entering into a contract with you for a service.
Sharing personal data
Where necessary, we will share data about your training activity with your:
- employer
- manager
- training provider
Trainers (either City of York Council staff, or staff in partner agencies employed to deliver training or people contracted via a commercial training organisation) will have access to:
- the names of delegates who have booked, cancelled or are waiting for places on the courses they deliver
- the name of their workplace
- their contact email addresses
We will not share your personal data with another organisation or third party other than those set out in this privacy notice without your consent.
As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA). However, for as long as the provisions of the Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020/392 remain in effect we will be hosting training sessions and we are currently using Zoom Pro or Business version of Zoom to host meetings (version 5) for that purpose.
Where meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom. Some personal data, such as user’s names, email addresses; telephone numbers where applicable, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. will be stored securely on Zoom’s system in the US (that is, outside the EEA) in compliance with the EU – US Privacy Shield Framework. Zoom’s certification may be viewed online.
Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services. Zoom’s privacy policy can be viewed online.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We're committed to ensuring that your personal data is secure. In order to prevent unauthorized access to files, electronic restrictions are in place to ensure that only employees who need the information to perform a specific task are given access to your personal details.
General training records, including your profile information, assessments, certificates and course bookings are kept on the system for 3 years after your record is closed. If training is about working with children we keep those records for 25 years, and if training is related to hazardous substances or environmental training, then we keep those records for 85 years.
We close your record when the last time you log in or the last time you attended a course is more than the length of time stated above, whichever date is most recent.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.