Work experience privacy notice

Why are we collecting your information?

This Privacy Notice has been written to inform you that York and Scarborough Teaching Hospital NHS Foundation Trust (the Trust) processes information about you in order to facilitate and support your work experience placement.  We will use the personal information we have collected about you to:

• Assess your eligibility and suitability for the placement
• Communicate with you about the work experience process
• Evaluate our work experience programmes
• Comply with legal and/or regulatory requirements.
• The personal information we collect about you may also be used to:
  • remind you about your placement if it changes and send you relevant correspondence
  • review your placement

We will use the information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process or the placement. 

We will use the information about your ethnicity and gender to ensure meaningful equal opportunity monitoring and reporting. 

Who do we collect your information from?

We collect personal information about applicants from the following sources:

• You
• Your school/place of education, if appropriate

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures.

The DPO contact details are:

York and Scarborough Teaching Hospitals NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE

yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

In connection with your application for work experience we will collect, store and use the following categories of personal information about you:

• The information you have provided on our application form, including name, address, contact details, date of birth, emergency contact details, eligibility criteria and education details
• Health information

We will also collect, store and use the following special categories:

• Gender
• Ethnicity
• Disability

What is our lawful basis for processing your information?

Any personal data we process is done so in accordance the UK General Data Protection Regulation (UK GDPR).

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR.

The processing is necessary to perform a contract or to take the steps, at your request, before you enter into your agreement with the Trust.

If you provide us with any information about reasonable adjustments you require under the Equality Act 2010 the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.

The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the UK GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights. And Schedule 1 part 1(1) of the DPA2018 which again relates to processing for employment purposes.

How long do we keep your information for?

The Trust follows NHS Digitals recommended retention schedule which can be found in the Records Management Code of Practice for Health and Social Care 2016.

The Trust will only retain your personal information for as long as is necessary to fulfil the purposes for which it was collected and processed.

Who do we share your information with?

We will not share your personal information with a third party.

Do we transfer your information outside the UK?

We will not transfer your personal information outside of the UK.

Data security

We have in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an authorised way, altered or disclosed. 

We limit access to your information to those employees who have a business need to know.  They will only process your information on our instructions and they are subject to a duty of confidentiality. 

We have in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

• to be informed about how we process your personal data. This notice fulfils this obligation
• to request access to your personal data that we hold, and be provided with a copy of it (commonly known as a ‘data subject access request’)
• to request that your personal data is corrected if inaccurate or incomplete
• to request that your personal data is erased (deleted) where there is no good reason for its continued processing
• to request that the processing of your personal data is restricted
• to object to your personal data being processed
• request the transfer of your personal information to another party
• right to withdraw consent: When you applied for the placement you provided consent to us processing your personal information for the purposes of recruitment and undertaking the placement. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent contact Ellie Dove (ellie.dove@nhs.net). Once we have received notification that you have withdrawn your consent, we will not long process your application or placement, and subject to our retention policy we will dispose of your personal data securely.

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above. To put in a Subject Access Request please contact:

ellie.dove@nhs.net

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

casework@ico.org.uk  // 0303 123 1113

Version 10
08/04/2021