1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192 
Hot data
Page 40
Page 41
If you've noticed an error in this article please click here to report it so we can fix it.
Never write 'this man's an idiot' on interview
notes. Anna West explains how careless use
of data can come back to haunt you later.
In the day-to-day running of a transport business data is hound to be stored that is no longer needed, but operators who never clear out their files could he breaching the Data Protection Act (DPA).
The DPA governs how companies deal with personal information they hold about employees and job candidates. These records must be kept up to date and only information that is needed should be kept.
'Personal information' means any information relating to a living person. It includes expressions of opinion such as appraisal notes commenting on an employee's performance. Stricter rules apply to the handling of 'sensitive personal information' such as details of an individual's racial origin, religious beliefs, health or sex life.
Breaches of the DPA can lead to compensation claims from employees or former employees and possibly a fine.A code of practice,called the Employment Practices Data Protection Code, is designed to help organisations comply with the DPA in relation to their employees, ex-employees and job candidates.
The data protection code sets out best practice in four areas: recruitment: employment records: employee monitoring: and information about employees' health.
Recruitment
Job applications should: • Only request personal information that is relevant to the recruitment decision (for example, whether a candidate is single or married is irrelevant).
• Remove questions which are relevant to existing employees, but not to unsuccessful candidates, such as banking details. • Make it clear that any spent convictions do not have to be declared when requesting information about a prospective employee's criminal convict ions Firms which want to verify the information provided by candidates, such as their qualifications, should: • Explain what information will be verified and how ([or example, by contacting the candidate's course providers) • Obtain signed consent from the candidate, unless the person to be contacted is a referee the candidate has given.
Individuals are entitled to sec, on request, copies of personal information held about them, subject to certain exceptions. This includes notes taken by employers at interview — so he careful what you write. If the candidate is unsuccessful, the firm concerned should still keep the interview notes for about six months as they may he relevant if the candidate subsequently brings a compensation claim.
Employment records
Employers do not generally need an employee's consent to keep records, but employees should know what is kept and why. A policy or a statement in the employment contract can cover this.
The data protection code offers guidelines for record keeping,including: • Keep personal information secure. Ensure it can only be accessed by staff with a legitimate reason to see it • Information about an employee's ethnic origin,disability,religion or sexual orientation, while valid for equal opportunities monitoring, should only be obtained and kept with the employee's consent, and should be kept in a form that cannot identify individuals • Delete personal information which is no longer relevant.When an employee leaves appraisals could probably be deleted after a year, but tax records may need to be kept for longer.
If someone requests copies of their personal information, this must be provided within 40 days. Firms must check that their systems enable this to be done efficiently.
Employee monitoring
Examples of monitoring include installing a bidden camera to catch a thief. CCTV cameras to see if staff are meeting health and safety requirements, or checking the various websites visited by employees.
The code suggests: • Before introducing monitoring consider why it is needed, the impact on employees, and whether there is any less intrusive alternative • Only monitor employees as far as is necessary. For example. only install CCTV in the areas where you really need it *Tell employees what monitoring is being carried out and why, unless you can justify covert monitoring such as in the case of suspected theft • Avoid monitoring in areas where employees would expect privacy, such as toilets, unless serious crime is suspected Firms that monitor phones,e-mail or internet access should ensure they have a clear policy specifying permitted and prohibited use systems, such as requirements that 'personal use is to be kept to a minimum'.
Health information
Information about an employee's health is classed as 'sensitive personal information', so more stringent rules apply. The code recommends that only essential health information is collected. If using a pre-employment medical questionnaire. ensure the questions are clearly relevant to the employee's ability to do the job.
An employee may be required to undergo a medical examination in cases of long-term or frequent sickness absences. As well as obtaining the employee's consent,the data protection code recommends that employers consider whether the examination is genuinely necessat-y. It may be due to a need to assess when an employee is fit to return to work, or to find out what changes may be needed to make a job accommodate a disability.
Any health information held should he kept securely.The data protecth on code suggests that employers should: • Separate it from other personnel in tOrmation • Limit the people who have access to it • Ensure that anyone who does see it only sees the parts they need to— a manager looking at the results of an eye test will not need to see the pre-employment questionnaire response..
To see a full copy of the Employment Practices Data Protection Code go to the Information Commissioner's website at: www.informationconunissioner.gov.uk Anna West is an employment lawyer with City solicitors Travers