Student Matching System Privacy Notice

Introduction

The NHS Wales Student Matching System was developed as part of the Student Streamlining Project (SSP); delivering a single application and recruitment pathway for student nurses and NHS organisations in Wales.

The Student Streamlining Project (SSP) is being delivered by NHS Wales Shared Services Partnership (NWSSP), working in partnership with NHS Wales Health Boards, Welsh Universities and NHS Wale Health Education and Improvement Wales (HEIW).

NHS Wales Shared Services Partnership (NWSSP) supports NHS Wales through the provision of a comprehensive range of high quality, customer focused support functions and services. Included in this is Employment Services, which is responsible for delivering the following services: Student Awards, Recruitment, Payroll, Pensions, Expenses and Lease Car Administration.

The Student Matching System has been developed in partnership with HEIW, with the system being hosted by HEIW who have their systems currently hosted by Cardiff University.

Please read the following Privacy Notice to understand how we collect, process, store, protect and share the information you provide to us, through your journey (see figure 1) from application to employment.

Figure 1: Your data journey from application to employment through our systems

Stage 1	Student Matching System	Registration and application data Selection and appointment data
Stage 2	Trac Recruitment System	Registration and appointment data Pre-employment checks data Contract and recruitment file data
Stage 3	NHS Electronic Staff Record (ESR) System	Trac recruitment data download to ESR via Trac-ESR interface Occupational Health data interfaced between ESR and Cohort(Occupational Health System) Payroll/Employee commencement data

 

By using, registering or submitting any information on the Student Matching System you consent to the collection, use, storage and transfer of your information under the terms of this Privacy Notice and Privacy Notices/Policies of the relevant systems through whole process.

For further information regarding the Privacy Notices/Policies relating to your data journey (collection, use and transfer) through the systems and processes we use, please following below links:

NWSSP Recruitment Services Privacy Notice: Add link

Trac Systems Ltd Privacy Policy: https://apps.trac.jobs/about/privacy

NHS Electronic Staff Record (ESR) system Privacy Policy: http://www.esrsupport.co.uk/privacy-2018-05014-v1.php

Applicants should be aware that this privacy notice applies to all the processing of your personal data by NWSSP in relation to or arising from your role. NWSSP is a data controller in respect of the personal data it holds concerning the Student Matching Scheme.

 

Why your personal data is collected

Personal data is information from which an individual can be identified either directly or indirectly when the information is read in conjunction with other data that a data controller holds.

Your personal data is collected and held as part of the NHS Wales Student Streamlining Matching Scheme. The purposes include:

1. Collection and monitoring of equal opportunities data
   • Personal information that includes gender, race, ethnicity, sexual orientation, religious beliefs (where you have provided this information)
2. Personal data for identification and communication
   • Telephone numbers
   • Email address
3. Personal data for your application and recruitment process
   • Contact names, addresses, telephone numbers, date of birth
   • Medical information including physical health or condition (if provided)
   • Right to work information
   • Work permits (where applicable)
   • Criminal record history (where applicable).
   • Supporting information/values based questions information

The function of NWSSP is to deliver a recruitment service and process from student nurses from application to employment. The processing of personal data is necessary for the purposes of those functions.

 

How your personal data is collected

We collect information, including personal data, from your use of the student matching scheme when you register and submit your application.

 

How your personal data is kept secure

Access to your personal data is restricted to the authorised team within NWSSP that manages the Student Matching Scheme. This information will be anonymised (where applicable) and aggregated before distributing to Recruiting Managers in the relevant Health Boards via secure restricted system access.

The data is collected, processed and stored securely from unauthorised access, alteration or disclosure. The following security measures are taken:

• The system implements encrypted communication via SSL certificates
• The data is accessed by authorised users through secure authentication and authorisation protocol
• We review our data management strategy to evaluate information collection, storage and processing practices, to guard against unauthorized access to systems
• With defined access control policies in place, only restricted access is provided to authorised members of staff at HEIW

We will only store information for as long as necessary. Records are stored in line with Records Management Code of Practice for Health & Social Care’s retention and disposal schedule. This determines the minimum length of time records should be kept. When required, we will destroy your personal data confidentially and securely.

 

How and why your personal data may be shared

We share your personal data for the purpose of completing the recruitment process. Under the law, your information is shared only with those recruiting managers that are responsible for the recruitment process to a vacant post within their department. This is so that only the appropriate people work together to recruit staff for the benefit of you and the NHS. It is important to note that anyone receiving information about you is under a legal duty to keep it confidential.

In the context of the Student Matching Scheme, your personal data is processed and shared with the following in order to manage the application and selection process:

• Nominated Recruiting Managers
• Nominated Health Boards leads (Escalation leads, SSP Communication & System Admin leads)
• NWSSP Employment Services (Service Improvement Team & Recruitment Service)

In the context of the whole recruitment process, your personal data is processed and shared using the stages and systems outlined in figure one. Please view the above links to all the relating Privacy Notices covering your from application to employment.

The NWSSP will only transfer your personal data to third parties using secure channels and when it is needed to manage your recruitment. NWSSP will not sell your information and will not transfer your data unless it is satisfied of the following matters:

• That there is a fair and lawful basis to share your personal data with the third party.
• The data will be handled by the third party in accordance with the law on data protection.
• It is only the minimum information necessary.

Where the data is used for analysis and publication by a recipient or third party, any publication will be on an anonymous and aggregated basis, and will not make it possible to identify any individual. This will mean that the data ceases to become personal data.

Third parties may include the following non-exhaustive list: NHS Health Boards/Trusts/Organisations in Wales, the Welsh Government, the HEIW, UK health departments, Colleges/Faculties, the NMC and any approved researchers.

For information regarding the collection, use and sharing of cookies, please access the Student Matching Scheme Cookies Policy.

 

Your rights and responsibilities

From 25th May 2018, the General Data Protection Regulation replaced the Data Protection Act 1998 and this will be the principal piece of UK legislation concerning personal data. NWSSP will be subject to the General Data Protection Regulation. It emphasises the need for NWSSP to ensure that we explain how we use your information during the recruitment process.

The information we give you about our use of your information will be:

• Brief, easy to read and easily accessible
• Written in clear, plain language and
• Free of charge.

Informing you and obtaining your permission (consent)

For the use of your personal information to be lawful, NWSSP may ask for permission from you. This is not necessary if the use is for a lawful basis under current regulation such as for Recruitment purposes. Any permission (consent) that is collected from you should have been given freely and you have not been pressured to do so. This should have been done clearly and you are aware of what the use of your information means.

If your permission is asked for, you will be provided with information regarding this by use of this Privacy Notice. This will explain what you are being asked to give permission for. NWSSP will have to prove that it gave you information and that you were fully aware of what you were giving permission for.

If permission is requested, you could provide this in several ways that include by writing, ticking a box on a web page, by choosing options in a mobile phone app, or by any other action that shows your acceptance of the use of your information.

Your rights to correct or delete inaccurate information

It is important that you work with us to ensure that the information we hold about you is accurate and up to date, so please inform the NWSSP immediately if any of your personal data needs to be updated or corrected. You also have a right to have inaccurate personal data rectified, blocked, erased or destroyed. NWSSP must ensure that proven inaccurate or incomplete information is either erased or corrected.

All communications from NWSSP/Student Matching Scheme will normally be by email. It is therefore essential for you to maintain an effective and secure email address or you may not receive news and information about your matching process.   

In certain limited circumstances, you have a right to object to processing that is likely to cause you damage or distress, or to any decisions made by automated means that significantly affect you. If you wish to exercise any of these rights or have any concerns in relation to how your personal data is processed, please contact NWSSP.

Automated decision taking

NWSSP also provides safeguards against risks that involve processes that include automated decision-making. This applies to you when:

• It is an automatic process; and
• There is a legal effect on decision made with your information.

NWSSP may take a small number of automated decisions with your information but there is mostly some human involvement in this. However, NWSSP will take steps to identify how many automated decisions it makes and whether these are acceptable. NWSSP will ensure that any automated profiling is fair and lawful. NWSSP will use correct procedures to reduce errors and inaccurate data.

Access to your information

The NWSSP will make sure that you are able to have access to your information, so that you know what we hold.

You have the right:

• To know about details of how your information is used; and
• Have copies of your information.

NWSSP will look at your request to make sure that the information requested is personal information. Most of the time, it will be clear that the information is personal but the NWSSP will contact you if it is not clear.

These rights relate only to your own information. You can request to see another person’s information, if one of the following applies:

• Parent/legal guardian of a child too young to exercise own legal rights
• Where someone (with mental capacity) has authorised the individual to operate on their behalf
• Under the terms of the Mental Capacity Act

If at any point, you wish to gain a copy of your personal data that is held by NWSSP you may submit a subject access request in writing. If you want to know more information about your rights of access, please contact the NWSSP Information Governance Manager. The NWSSP tries to answer all requests for access to information as quickly as possible. The organisation is obliged to provide a response to your request within a month of receiving it, but this can be extended if the request is complex and extensive.

Stopping use

When a request for stopping use is received, NWSSP will still store information but will not use it anymore. Any changes that include the stopping of the use of your information will be told to you at the time. However, any withdrawn or unsuccessful appointment that did not complete pre-employment checks will be retained for 13 months and destroyed after this time.

Keeping your information

We will only store information for as long as necessary. Records are stored in line with Records Management Code of Practice for Health & Social Care’s retention and disposal schedule. This determines the minimum length of time records should be kept.

Further information/Making a complaint

Should you wish to learn further information about data protection, please visit the Information Commissioner's Office (ICO) website. The ICO deals with complaints about how data controllers have dealt with information matters and provides useful guidance.

 

If you wish to make a complaint about any issues, you have experienced regarding your information, then please contact:

Tim Knifton

NWSSP Information Governance Manager

Tel: 01443 848585

Email: tim.knifton@wales.nhs.uk

 

If you are still unsatisfied following your complaint and this remains unresolved, you have the right to make a complaint to the:

Information Commissioner’s Office,

2nd Floor, Churchill House, 17 Churchill Way, Cardiff, CF10 2HH

Email: wales@ico.gsi.gov.uk

Website: www.ico.org.uk

 

Disclaimer

This privacy statement applies to the NHS Wales Student Matching Scheme.