Policy
Data protection
Why this policy exists
Hunter and Young provides HR services to employers. Almost everything we are asked to do involves personal data about somebody, and a good deal of it is the most sensitive data an employer holds: sickness absence, disability, grievances, allegations of misconduct, disciplinary outcomes, pay. Handling it carelessly would cause real harm to real people and would expose our clients to exactly the risk they engage us to reduce.
This policy applies to everyone working for or on behalf of Hunter and Young Limited, including the directors, employees, associates and contractors. It sits alongside our Privacy & AI notice, which tells individuals what we do with their data.
The law we work to
The UK General Data Protection Regulation and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003 for electronic marketing. We follow guidance issued by the Information Commissioner's Office.
Controller or processor
We are a controller for our own business data: enquirers, client contacts, suppliers, our own staff and applicants.
We are normally a processor for the personal data of our clients' employees. The client decides the purpose; we act on their documented instructions. That has practical consequences we hold ourselves to:
- We act only on instructions from the client, and we say so if an instruction appears to us to breach data protection law.
- We do not engage a sub-processor without the client's authorisation.
- We assist the client with subject access requests, with security, with breach notification, and with data protection impact assessments.
- At the end of an engagement we return or delete the personal data at the client's choice, except where we must keep it by law.
The principles we apply
Every use of personal data must satisfy all seven.
- Lawfulness, fairness and transparency
- There is a lawful basis, the use is fair, and people are told.
- Purpose limitation
- Collected for a specified purpose and not reused for an incompatible one.
- Data minimisation
- Adequate, relevant, and no more than we need. In practice this is the principle most often broken in HR work: whole personnel files get sent when three documents were needed. We ask for what the matter requires.
- Accuracy
- Kept accurate and corrected without delay when it is not.
- Storage limitation
- Kept no longer than necessary, then deleted.
- Integrity and confidentiality
- Protected by appropriate security.
- Accountability
- We can demonstrate all of the above, which means writing things down.
Lawful bases
Where we are the controller we rely on performance of a contract, our legitimate interests, or compliance with a legal obligation. We do not rely on consent for our core work, because consent that cannot freely be refused is not consent.
Special category data, which in our work usually means health information and sometimes trade union membership, needs a condition under Article 9 as well as a lawful basis. In employee relations casework the relevant condition is normally employment, social security and social protection law, with a supporting condition in Schedule 1 of the Data Protection Act 2018. Data about criminal allegations and proceedings needs a Schedule 1 condition of its own. Where we are the processor, it is the client who must identify these, and we will ask them to confirm it.
Security
We take appropriate technical and organisational measures, which as a minimum means:
- Multi-factor authentication on email and file storage.
- Case files shared through a secure channel rather than as open email attachments, and never to a personal email address.
- Access limited to the consultant working on the matter.
Individual rights
People have the right to be informed, to get a copy of their data, to have it corrected, to have it erased, to restrict processing, to data portability, to object, and not to be subject to solely automated decisions with significant effects. We respond within one month, which may be extended by two further months for complex requests if we tell the person within the first month.
Requests reach us in unexpected ways. A subject access request does not have to use those words, does not have to be in writing, and does not have to go to any particular person. Anyone here who receives something that might be a request passes it on the same day.
Where the request concerns data we hold as a processor for a client, we tell the client without undue delay and help them respond. We do not answer on their behalf unless they instruct us to.
Personal data breaches
A breach is any accident or attack that results in personal data being lost, destroyed, altered, disclosed or accessed without authorisation. An email to the wrong recipient is a breach. A lost laptop is a breach.
- Contain it, and recover what can be recovered.
- Report it internally the same day, to satpal@hunterandyoung.co.uk. Nobody is disciplined for reporting a breach promptly and honestly.
- Assess the risk to the people affected.
- Where we are the controller and the breach is likely to result in a risk to people's rights and freedoms, notify the ICO within 72 hours of becoming aware. If it is likely to result in a high risk, tell the affected individuals without undue delay.
- Where we are the processor, notify the client without undue delay. The 72-hour clock is theirs, and it starts when we tell them, so we tell them quickly.
- Record it in the breach log, whether or not it was reportable, with what happened and what we changed.
Records and accountability
We keep a record of processing activities, a breach log, and a register of the processors we use. We carry out a data protection impact assessment before any processing likely to result in a high risk, which includes large-scale processing of special category data and any new monitoring technology.
Responsibility
A statutory Data Protection Officer must be appointed in three circumstances, and none of them applies to us. We are not a public authority or body. Our core activities do not consist of regular and systematic monitoring of individuals on a large scale. And while our work does involve special category data and information about alleged misconduct, it is not processed on a large scale: it arrives case by case, for one employer at a time.
Responsibility for data protection therefore rests with Satpal Sokhi, who can be reached at satpal@hunterandyoung.co.uk or at Carleton House, 266–268 Stratford Road, Shirley, B90 3AD.