Employee Records

Introduction/Legislative Background

Data Protection Act 1998

Under the Data Protection Act 1998 Data Controllers must follow certain principles in relation to the data that they hold. Individuals have rights of access to data which is held on them and rights to sue for damages if various offences occur. In relation to employee records, the 1998 Act:

covers manual as well as computerised records
introduces a broader definition of ‘sensitive personal data’ and restrictions on its processing

The University adopts the principles of openness which will, in turn, contribute to the fostering of open and honest management. The University should not keep in record form any information, opinion or judgement that it would not be comfortable showing to the data subject and explaining and justifying if called upon to do so.

Police Act 1997 (Part V) - Disclosure Scotland

Part V of the Police Act 1997 is aimed at helping employers and other organisations assess the suitability of applicants for particular posts and to make safer recruitment decisions in relation to positions of trust by widening access to criminal record information. To this end, the Act provides for the issue of criminal conviction certificates, criminal record certificates, and enhanced criminal record certificates. In Scotland these certificates are issued by Disclosure Scotland. In practice, the certificates are known as Basic, Standard and Enhanced Disclosures. The University is registered as a corporate body with Disclosure Scotland which means that it can access these certificates.

The Act also provides for a Code of Practice governing the use of all information issued in respect of Standard and Enhanced Disclosures. The Code requires all recipients of such Disclosure information to comply with the Code and to handle, store and dispose of that information appropriately.

Registered Bodies are therefore required to have a written policy on the handling, holding and destroying of Disclosure information, and to ensure that any body or individual, at whose request applications for Standard and Enhanced Disclosures are countersigned has such a written policy. The University’s policy in this regard is contained in 'Disclosure Information' below.

Policy

Subject to the following provisions employees will have the right of open access to their personal employment records.

1. Scope

A personal employment record is a manual and/or electronic record, and their contents, which is capable of enabling the identification of the particular employee by way of an index and/or a personal identifier e.g. name, any form of reference number etc. including:

any record the contents of which relate exclusively to a named employee and which is held in the Human Resources Department, and which would be regarded, in whole or in part, as being the ‘personnel record’.
any record the contents of which relate exclusively to a named employee and which is held in the Payroll Section, and which would be regarded, in whole or in part, as being the ‘payroll record’.
any record the contents of which relate exclusively to a named employee and which is held in the Faculty, School or Department and which would be regarded, in whole or in part, as being the Faculty, School or Departmental record.
any similar or equivalent record.

The above does not imply any requirement to create such a record where no such record exists at present. However, any records that exist or are created must comply with this policy.

2. Who May Keep Such Records

2.1 The ownership of a personal employment record rests with the University. In order to ensure clear accountability for the proper conduct of such records it is important to identify who may establish and maintain them. This can only properly be based on the principles of ‘need’ and then ‘access’.

Personal employment records may only be established and maintained by:

the Head of HR under the direction of the Executive Director of Human Resources.
the Assistant Finance Officer (Payroll) under the direction of the Director of Finance.
the Head of School or Department - or their equivalents where no such post exists - under the direction of the relevant Strategic Manager.
the Dean of Faculty or relevant SPARG member - in respect of Faculty staff.

2.2 Low level data (e.g. job descriptions) may be kept at a lower level and would not fall within the scope of these provisions except where it is traceable by a personal identifier.

2.3 Responsibility for maintenance shall be delegated to the relevant staff within the HR Department and to the relevant Personal Secretary/Assistant/Officer/Administrative Assistant at Faculty/School/Departmental level. Such delegation shall be in writing using the standard form DP1 shown in Appendix 1. This form will be issued on an annual basis by the Records Manager and must be completed and returned, with a copy being retained by the School/Department.

2.4 It follows that, operationally, the Head of HR, the Assistant Payroll Officer and the Deans of Faculty, Heads of School/Department, as appropriate, are responsible for the proper application of this policy.

2.5 No other personal employment records may be established or maintained. In due course electronic records will lead to the position whereby it will be inappropriate for reason of economy and efficiency for more than one record to be established and maintained.

3. Other Employment Records

There are, from time to time, requirements to establish and maintain ‘one off‘ records for particular purposes e.g. complex disciplinary cases, grievances etc. where it is not reasonably practicable to keep the whole record in a single file. Secondary records may be established for these purposes however they must be referenced in the main record and the same rights of access apply.

4. What May A Personal Employment Record Contain?

4.1 It may contain any information legitimately required for the purposes of:

statutory employment records, and/or
operational management and administration

These may include, inter alia:

applications for vacancies and CV’s
interview records
references
medical reports
offers of employment
statutory statements of terms and conditions
disciplinary and grievance records
performance appraisals and similar reviews
notes of informal meetings and interviews
relocation details
allowances and expenses
training details
salary, additional payments and bonuses etc
certificate of sponsorship information
related correspondence
attendance records

These are examples only and there will be other legitimate entries that may be included.

4.2 What may not be included is information, data or other material that cannot legitimately be shown to be related directly or indirectly to the employment of the employee concerned.

4.3 Within the individual personal employment record, all records must be kept in a form that is, by and large, chronological, easily readable and auditable. They should be kept in a secure location with controlled access for those that are authorised to have access.

5. Sensitive Personal Data

5.1 The 1998 Data Protection Act defines ‘sensitive personal data’ as personal data which relates to:

racial or ethnic origin
political opinions
religious beliefs or other beliefs of a similar nature
trade union membership
physical or mental health or condition
sexual life
the commission or alleged commission by the individual of any offence, or
any proceedings for any offence committed or alleged to have been committed by the individual, the disposal of such proceedings or the sentence of any court in such proceedings.

5.2 The Act prohibits the processing of sensitive data except in specified circumstances, for example, ethnic monitoring. It is the University’s policy that the explicit and informed consent of employees will be obtained for the processing of information which may include sensitive personal data.

5.3 For prospective and new employees this is obtained by a specific signed declaration in the employment Application Form, separate Recruitment Monitoring Form and the Statement of Particulars of Terms of Employment issued on appointment.

6. Disclosure Information

6.1 General Principles

The University complies fully with the Code of Practice, issued by Scottish Ministers, regarding the correct handling, holding and destroying of Disclosure Information provided by Disclosure Scotland under Part V of the Policy Act 1997, for the purposes of assessing applicants’ suitability for positions of trust.

6.2 Usage

The University uses Disclosure information only for the purpose for which it has been provided. The information provided by an individual for a position within the University is not used or disclosed in a manner incompatible with the purpose. The University processes data only with the express consent of the individual. Individuals are notified of any non-obvious use of the data, including further disclosure to a third party.

6.3 Handling

The University recognises that, under section 124 of the Police Act 1997, it is a criminal offence to disclose Disclosure information to any unauthorised person. Disclosure information is only passed to those who are authorised to see it in the course of their duties. The University will not disclose information provided under section 115(8) of the Act, namely information which is not included in the Disclosure, to the applicant.

6.4 Access and Storage

The HR Department does not keep Disclosure information in an individual’s personal employment record. It is kept separately and securely, in lockable, non-portable storage containers. Access to storage units is strictly controlled to authorised and named individuals, who are entitled to see such information in the course of their duties. These individuals are named using the standard form DP1.

6.5 Retention

The University does not keep Disclosures or Disclosure information for any longer than is required after a recruitment (or any other relevant) decision has been taken. In general, this is no longer than 90 days. This is to allow for the resolution of any disputes or complaints.

6.6 Disposal

As soon as a recruitment decision has been taken, the University will ensure that Disclosure information is immediately destroyed in a secure manner i.e. by shredding, pulping or burning. The University will not keep Disclosure information which is awaiting destruction in any insecure receptacle (e.g. a waste bin or confidential waste sack). The University will not retain any image or photocopy or any other form of the Disclosure information. The HR Department will, however, keep a record of the date of issue of the Disclosure, the name of the subject, the Disclosure type, the position for which the Disclosure was requested, the unique reference number of the Disclosure and details of the recruitment decision taken.

7. 'Secret' or 'Alternative' Records

Secret or alternative records may not be established for the purposes of by-passing the spirit or intention of this policy.

8. Employee Rights

8.1 Employees will have right of access to their personal employment record normally within 5 working days of written notice being received by the SPARG member, Head of School/Department or the Head of HR. The request should be put in writing using the University’s request for access form DP3 (appendix 3). In response to a request, the appropriate official receiving the access request will confirm, in writing, the date, time and place at which access will be provided and will confirm the access fee that will be charged (see model letter at appendix 4).

8.2 Access will be by arrangement and viewing of the contents of the record will be at its kept location in the presence of a person nominated by the Dean, Head of School/Department or the Head of HR. (The sole purpose of this provision is to ensure that no material is inappropriately removed or destroyed).

8.3 The access charge for subject access will be the maximum permitted by the Regulations.

8.4 Employees may, within reason, request one copy of any or all of the contents of a record if they wish. A record will be made of any copies requested and where possible, provided, including date and place together with the name of the person providing them. Information can be provided in other formats if required.

8.5 An employee may challenge the accuracy of an entry in the record and where, on investigation, it is found to be inaccurate shall be entitled to have the entry corrected or removed, whichever is the most appropriate and to have this action confirmed in writing as having been done. See Section 10 for further information.

8.6 An employee may challenge the legitimacy of making or keeping particular data or other information in the record. See Section 10 for further information.

9. Access By Other Employees

9.1 Normally complete rights of access will be held by:

the relevant SPARG member
the relevant Head of School/Department
the employee in respect of his/her record
the Executive Director of Human Resources and authorised HR staff

9.2 Other employees who have line management responsibility may be authorised e.g. Section Heads. Such authorisation shall be in writing using the Authorisation for Access form DP2 at appendix 2. It may be for complete access or for defined limited purposes.

9.3 Personal pay information will be available only to the above persons on a “need to know basis”.

10. How May An Employee Exercise The Right To Challenge The Accuracy Or Legitimacy Of An Entry?

10.1 In the case of Faculty staff, initially in writing, to the relevant Dean of Faculty and thereafter, if not satisfied, to the Executive Director of Human Resources. In the case of the School/Department record, in writing to the relevant Head of School/Department and thereafter, if not satisfied, to the relevant SPARG member. In the case of the records held by HR and Payroll to the Head of HR or Assistant Finance Officer (Payroll) respectively. In all other cases in writing to the relevant SPARG member.

10.2 At all stages, any decision shall be taken in consultation with the appropriate HR Client Partner and reasons shall be given to the employee explaining the decision. Under the Data Protection Act 1998 the employee should receive a written response within 21 days stating what action has or will be taken or stating the reasons for regarding the concerns as unjustified.

10.3 If still not satisfied the employee may refer the matter to the Executive Director of Human Resources, (or his nominee) for adjudication.

11. References - Employees And Prospective Employees

11.1 These require particular care. There are legal as well as personal and professional obligations.

11.2 In general the obligation is to ensure that all references, oral or in writing, given in respect of an employee of the University should contain only information that is factual or is honest opinion or judgement that is capable of being demonstrated as being reasonable by reference to actions, events or circumstances. An individual may sue for damages if they suffer loss or detriment as a consequence of information given in error or with malicious intent.

11.3 References given formally on behalf of the University shall be given on headed letter paper and signed by the author. Where a proforma is completed, this must be authenticated by an official University stamp and/or the signature of the author.   All references should contain the statement:

“This is a reference given in strictest confidence and without legal responsibility. We do not expect you to release this to any third parties without first obtaining our explicit and written consent.”

This makes it clear that the recipients rely on the reference at their own risk. However, this will provide no defence against an action for libel and no certain defence against an action for negligence.

The writer of the reference is responsible for meeting the requirement of reasonableness and defensibility. Where necessary, further guidance should be sought from the relevant HR Client Partner.

11.4 A copy of each reference given should be retained in the individual's personal data subject’s personal employment record.

11.5 Confidential references given by the University are exempt from subject access under the Data Protection Act. Nevertheless they should be written in the knowledge that the receiver may seek consent to disclose the reference to the prospective employee before or after they have been engaged. The University may, or may not, agree to such disclosure. In addition, there are certain legal procedures under which disclosure may be ordered.

11.6 References requested and received by the University from other employers are usually provided in confidence. The following clause should be used in all reference requests:

“Your reference will be treated as confidential unless you indicate that you wish it to be otherwise or we obtain your explicit and written consent to disclose the reference or we are obliged to disclose it by virtue of a statutory order.”

11.7 Employees will be entitled to have access to references received should they so request if the provider of the reference has consented and there is no other substantial reason for the University to do otherwise.

11.8 References already received at the implementation date and understood at the time of writing to be “confidential” shall remain so.

12. References - For Current Or Previous Students Seeking Employment

12.1 The same guidance, responsibilities and obligations described above generally apply.

12.2 The assumption must be that, if any employee is asked to give a reference in whatever capacity (e.g. Course Leader, Tutor etc.) then the reference must be considered to be in an official capacity and must be prepared accordingly.

12.3 Heads of School must ensure that relevant staff are briefed appropriately and that a proper record is kept.

13. Personal References - Given In An Entirely Personal Capacity

These may not be issued on University headed paper, must not in any way suggest that comments are other than personal, and do not form part of the employment record.

14. Audit

An audit protocol shall be established and included in the programme of internal and external audits.

15. Retention

15.1 Employee records covered by this policy shall be retained, after the actual date of the employee leaving, for the following period.

Faculty/School/Department records	current year + 6 years
HR Records	current year + 6 years
Payroll Records	In accordance with tax requirements
Superannuation records	In accordance with pension scheme requirements

After that period, records shall be destroyed.

See clause 6.5 above in relation to the retention of Disclosure information.

15.2 In the event that an employee transfers from one Faculty/School/Department to another within the University, the employee record held in the Faculty/School/Department shall transfer with him/her.

16. Compliance

The aim is to achieve a continuous progression towards the standards of best practice that this policy prescribes. However, provision has to be made for repeated non-compliance by a person responsible for the proper establishment and maintenance of a record. Serious and/or repeated non-compliance will be regarded as misconduct and will render the person liable to disciplinary action.

Printable Versions of Documents

Appendix 1: Form DP1

Appendix 2: Form DP2

Appendix 3: Form DP3

Appendix 4: Model Letter

Employee Records Policy