Under the UK GDPR, it is essential to have a lawful basis when processing personal information. For workforce data processing, we normally rely on the following lawful bases:
- Article 6(1)(b) – contractual obligation
- Article 6(1)(c) – legal obligation
- Article 6(1)(e) – public task
There may be occasions where our processing is not covered by one of the legal bases above. In that case, we may rely on Article 6(1)(f) – legitimate interests. We only rely on legitimate interests when we are using your data in ways you would reasonably expect.
For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (10) Preventing or detecting unlawful acts
Some of the information we collect about you is classed as special category data under the UK GDPR. The additional conditions that allow for processing this data are:
- Article 9(2)(b) – employment and social security and social protection law
- Article 9(2)(g) – reasons of substantial public interest
The applicable substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 are:
- Condition 6 – statutory and government purposes
- Condition 8 – equality of opportunity or treatment
- Condition 10 – preventing or detecting unlawful acts
- Condition 18 – safeguarding of children and vulnerable people