Privacy notice - Applying to work for us

The Nursing and Midwifery Council (NMC) collects and processes your personal information if you apply to work for us as a permanent or fixed term contract employee.

We also process your information if you’re an agency worker who is introduced to us by an employment agency.

This privacy notice describes how we’ll use your information if you apply to work for us or are an agency worker. This document forms part of a number of privacy notices.

Find out more about how we handle personal data 

If your application is successful, we’ll provide you with a further privacy notice when you start working with us, which will explain how we’ll use your information while you are working for us.

Data Controller

The NMC is the data controller in relation to your personal information.

What information do we collect?

If you apply to work for us as a permanent or fixed term contract employee we collect and process:

• your name, address, telephone number, mobile number, email address;

• information included in your CV and application including education history, employment history, and information about your skills, abilities and work experience;

• information about your current salary and notice period;

• information about your entitlement to work in the UK;

• references from previous employers;

• information about any reasonable adjustments you may require at the interview

• information for pre-employment checks...

For the purposes of Equality and Diversity monitoring we’ll also ask you about your ethnicity, religion, sexual orientation, gender and disability. You don’t have to provide this Equality and Diversity monitoring information to us and if you choose not to, this will not affect your application. Your Equality and Diversity monitoring information will be removed from your application when it is sent to the managers who’ll review your application.

How do we collect information about you?

If you apply to work for us as a permanent or fixed term contract employee we collect information about you in a variety of ways, including from:

• your application form and CV;

• any other information you provide to us during your application;

• interviews or other forms of assessment;

• your passport or other identity documents;

• former employers:

• pre-employment checks.

How and why we collect information about your previous roles

If you’re offered a permanent or fixed term contract with us we’ll ask your former employer for references. We’ll only seek references once a job offer has been made and we’ll tell you that we’re doing this.

The information we’ll collect will include your name, address and details of the role you have carried out.

We check references because we consider it a necessary step prior to entering into a contract with you.

Pre-employment checks

For some roles including directors, those with particular financial responsibilities or roles with access to people at risk we require additional pre-employment checks including basic, standard or enhanced Disclosure and Barring Service checks.

If you’re appointed into a role that requires additional pre-employment checks including a Disclosure and Barring Service (DBS) check, you will be informed of this at the time of appointment.

We may use a third party organisation to carry out pre-employment checks, including DBS checks, on our behalf.

In order to carry out pre-employment checks we and/or any third party carrying out the checks for us may process the following information about you:

Full name, former names, date of birth, NI number or country-specific similar ID, nationality, place of birth, address history, telephone number, email address, employment history, education history, education certificates, passport photo page or other relevant ID document/ visa, proof of current address, verification information from your former employers, recruitment agencies, named referees and places of education, other supporting documents as relevant to complete the process, information about criminal convictions and offences that are eligible based on the requirements and scope of the process, information about court judgments and insolvency notices that are required by the scope of the process.

During the checking process we or any third party carrying out the checks on our behalf may also collect, receive and process personal information from authorised and recognised criminal and credit reference agencies. These will include: the Disclosure and Barring Service (DBS), Call Credit, LexisNexis and Cifas.

The Disclosure and Barring Service (DBS) has access to the Police National Computer (PNC), and from this they will process identifying details such as your name and date of birth and they will obtain conviction information.

Where we use a third party to carry out pre-employment checks we will usually not have access to all the information which was processed for the checks but will be informed of the status of your application and the result.

If your appointment to the role is successful you will also be required to complete an annual declaration.

Having a criminal record will not necessarily bar you from working with us. This will depend on the offence and the relevance of the offence in relation to the position applied for. The factors taken into account will include the responsibilities of the position, the vulnerability of the customer group, the nature of the offence(s), the number and pattern of the offences (if there is more than one), how long ago the offence(s) occurred and the age of the offender when the offence(s) occurred.

Based on above we might still employ you or move you to another role if appropriate.

Agency workers

If you are an agency worker, your agency is your employer. When an agency introduces you to us, they’ll supply us with:

• your name:

• information included in your CV including education history, employment history, and information about your skills, abilities and work experience;

You may be asked to attend an interview where we’ll assess your suitability for the temporary role for which you have been introduced by your agency.

We may provide feedback to the agency about your interview with us and your work performance and attendance while you work for us.

We consider that both the NMC and the agency are joint controllers in respect of your personal data as we’re both processing your data so that you can work for us on a temporary basis. We have arrangements in place with our agencies which set out our respective roles and responsibilities.

If you have any questions about the way your data is being handled by your agency, the first point of contact is your agency. For more information see the section below on “Your rights”.

Why do we process your personal information?

We collect and process your information to assess your suitability for the role for which you have applied or for which you have been introduced by your agency.

If you apply to work for us as a permanent or fixed term contract employee and we offer you a role, we process your information to take steps to enter into an employment contract with you.

If you’re introduced to us by an agency we process your information so that you can work for us on a temporary basis.

In the event that you make a complaint or legal claim about our recruitment processes, we’ll process your information in order to investigate and respond to your complaint or legal claim.

How and why we collect health information

We don’t collect information about your health during the application process other than information you choose to give us about any reasonable adjustments you require at interview.

We are under a legal obligation to make reasonable adjustments to the way we offer our services to prevent people with disabilities from being placed at a substantial disadvantage and to ensure that people with disabilities have a fair and equal chance of accessing our services.

How and why we collect information about cautions and convictions

As part of the recruitment process we process personal data relating to previous criminal convictions or cautions you have received where this is required for preemployment checks for specific roles.

Who has access to your information?

Your information will be shared internally with members of the HR and recruitment team, and interviewers involved in the recruitment process. Because your data will be stored on our IT systems, our IT staff may have access to it in the course of their work.

We may share your information with external third parties in the following ways:

• to obtain pre-employment references from your former employers (If you apply to work for us as a permanent or fixed term contract employee);

• with suppliers (for example, those which provide recruitment services or IT systems);

• with your agency to provide feedback about your interview with us and your work performance and attendance while you work for us.

• with legal advisors in the event of a complaint or legal claim.

Our legal bases for processing your information

If you’re applying to work for us on a permanent or fixed term contract, we process your information in order to decide whether we can enter into an employment contract with you. In general, therefore our legal basis for processing your information is that it is necessary in order to take steps at your request prior to entering into a contract with you.

In some cases we’re also under a legal obligation to process your information before entering into an employment contract with you. For example we process information about your right to work in the UK in order to comply with our legal obligation to ensure all workers have the right to work in the UK before we employ them.

We also process any health information you provide us in order to comply with our legal obligation to make reasonable adjustments.

In order for us to fulfil our role as a public authority we need to recruit staff to work for us. In general therefore, the legal basis for processing your data is also because it is necessary for us to perform our tasks in the public interest.

We process equality and diversity information to promote and maintain equality of opportunity or treatment.

Where we process personal data relating to previous criminal convictions or cautions.

We do so in order to decide whether we can enter into an employment contract with you. In general, therefore our legal basis for processing your information is that it is necessary in order to take steps at your request prior to entering into a contract with you.

Where you make a complaint or bring a legal claim against us we consider that we both have a legitimate interest in processing your personal data so as to answer your complaint or claim. Our legal basis for processing is therefore that it’s necessary for the purposes of our legitimate interests.

If you’re an agency worker we consider that it is in both of our interests for us to process your data so that you can work for us on a temporary basis. Our legal basis for processing your personal data is therefore that it’s necessary for the purposes of both our legitimate interests.

How do we protect your information?

We take the security of your data seriously. We have internal policies and controls in place to keep your data secure.

View our information security policy and data protection policies 

How long does the NMC keep your information?

We only keep your data for as long as we need it for and this will depend on whether or not you are successful in your application to work for us.

If you apply to work for us as a permanent or fixed term contract employee, if your application is not successful we’ll keep your data for six months after the recruitment exercise ends. If you are introduced to us by an agency but you are not selected to work for us we’ll keep your information for six months. We keep you information for six months this in case you make a complaint or legal claim relating to the application process.

At the end of the six month period, we’ll delete or destroy your data. The exceptions to this are:

• We’ll keep any emails we hold about your application for longer than six months; the period of time for which we keep emails is set out in our corporate data retention schedule.

• In the event that you make a complaint or legal claim relating to the application process we’ll keep your information for as long as we need to in order to investigate and respond to your complaint or  claim; the period of time for which the data relating to complaints of legal claims is set out in our corporate data retention schedule.

View our corporate retention schedule 

We may ask your consent to keep your data on file for future job vacancies. If you consent to us keeping your information for this reason, we’ll keep your data for twelve months after the initial recruitment exercise ends. At the end of this period, we’ll delete or destroy your data. You can withdraw your consent before this period ends by contacting recruitment@nmc-uk.org. In this case, we’ll delete or destroy your data upon your withdrawal of consent.

If your application is successful, your information will be kept by us and we’ll provide you with a  further privacy notice explaining how we’ll use your information during the time you are working or us and after you finish working for us.

International transfers of data

We’ll only transfer your personal data outside the United Kingdom where we use a supplier to process personal data on our behalf and the supplier operates outside the UK.

We have policies and procedures in place to ensure that where your data is processed outside the UK it is adequately protected.

Use of Closed Circuit Television (CCTV) at our sites

CCTV is in operation at our sites at:

• 23 Portland Place, London

• 1 Westfield Avenue, London

• 2 Stratford Place, London

• 10 George Street Edinburgh.

• Temple Court, Cardiff

Where we are not the sole occupier of the building (all offices other than 23 Portland Place) there’s additional CCTV which is controlled by the building owners or management company.

We record CCTV images of people when entering and leaving our premises as well as at strategic locations throughout the buildings. This information is recorded for the purposes of security and safety monitoring and the investigation of alleged criminal offences. The images may be shared with law enforcement and courts if this is needed.

Our legal basis for recording CCTV is that we use our premises to perform our regulatory functions. We consider that ensuring the security and safety of our premises is necessary for to perform a task carried out in the public interest and/or in our official authority as a regulator.

We also have a legitimate interest in maintaining the security and safety of our organisational buildings.

For more information about how we use CCTV, you can ask to see the CCTV policy.

What if you don’t provide personal data?

Most of the information we ask for, such as contact details, and information about your right to work in the UK have to be provided to enable the NMC to enter a contract of employment with you. If you don’t provide this information we won’t be able to enter into an employment contract with you.

For the purposes of Equality and Diversity monitoring we’ll ask you about your ethnicity, religion, sexual orientation, gender and disability. You don’t have to provide this Equality and Diversity monitoring information to us and if you choose not to, this will not affect your application.

Your rights

Right to be informed

You have the right to be informed about how and why we collect and use your information. This privacy notice forms part of our work to inform you about the information we hold about you and how we use it.

You can request further information or clarification on our use of your information at any time by emailing us at foi&dparequest@nmc-uk.org.

Right of access

You have the right to request a copy of the information we hold about you.

In most cases the information will be provided to you free of charge. Only if the request is manifestly unreasonable or excessive or is a repeated request for the same information can we apply a charge. Any charge would be based on the costs of providing the information.

There are circumstances where we’ll hold information but will not be able to provide it in response to a request. An example of this would be where doing so would interfere with the rights of another person (if your data includes information about another individual). In such circumstances we would tell you that this is the case (unless compelled by law not to do so). We would also not supply information about a person if we haven’t been given enough details to identify them from that information You can request a copy of the information we hold about you by emailing
foi&dparequest@nmc-uk.org.

Right to rectification

You have the right to ask us to correct any information we hold if it’s incorrect.

Where proportionate and practical we’ll ensure that any organisation we have shared the information with also corrects it.

You can make your request by emailing foi&dparequest@nmc-uk.org.

Right to erasure

In some circumstances you may have the right to ask us to remove information we hold
about you.

There are limitations to this right. For example, if we are compelled by law to keep information about you or it is integral to our activities as a regulator.

To make your request email us at foi&dparequest@nmc-uk.org.

Right to restrict processing

You have the right to ask us to restrict the processing of your information for specific purposes for specific periods of time. In many instances the right to restrict the processing of your information does not arise, for example, where we process your information because of a legal obligation.

To make a request to restrict processing contact foi&dparequest@nmc-uk.org.

Right to data portability

You have the right to request your information in a machine readable format, using common standards or file types. This right only applies where you have provided the information to us yourself and we are processing the information based on your consent or to fulfil a contract and when the processing is carried out by automated means.

To make a request email foi&dparequest@nmc-uk.org.

Right to object

You have the right to object to us processing your information. This includes the right to object to direct marketing and the right to object to your information being used for research.

There are a number of exemptions to this right. If we’re not able to comply with your request we’ll advise you of our decision within one month of your request setting out the reasons.

You can tell us of your objection by contacting foi&dparequest@nmc-uk.org.

Rights related to automated decision making including profiling

You have the right to request human intervention in any automated decision making processes where this process is not based on your consent, authorised by law or necessary for the performance of a contract.

Automated decision making is where a decision is taken about you using an electronic system without human involvement. No decision will be made about you based on automated decision making which has a significant impact on you.

If you have an enquiry about our use of automated decision making, contact foi&dparequest@nmc-uk.org.

Consent

If you have consented to the processing of your data you have the right to withdraw that consent at any time. To withdraw your consent, contact foi&dparequest@nmc-uk.org.

As outlined in this privacy notice, in most instances we process your data for employment purposes on a legal basis other than consent.

Data Protection Officer

Our Data Protection Officer can be contacted by emailing DPO@nmc-uk.org

Your right to complain to the Information Commissioner’s Office (ICO)

You have a right to complain to the Information Commissioner’s Office (ICO). The contact details for the ICO can be found at https://ico.org.uk/

If more than one data controller processes your data

The NMC is the data controller in relation to your personal information. If you were introduced to the NMC by a recruitment agency or online recruitment site before you made your application to us, that agency or recruitment site will also be a data controller in relation to your data. If you wish to make a request about the way in which the agency or recruitment site processes your data you should contact the agency or recruitment site in the first instance. If you wish to make a request about the way we process your data or wish to obtain a copy of information which is held about you, you
should make a request to us at foi&dparequest@nmc-uk.org.