GDPR and employee files - What you need to know

The General Data Protection Regulation (GDPR) will come into force on 25th May 2018 changing the way we process data forever. The aim of the GDPR is to put greater protection on the way personal data is being processed for all EU citizens. Personal data can be anything from a name, an email address, PPS number, bank details etc so as you can imagine employers process a huge amount of personal data on a daily basis. So how will the GDPR affect employers in terms of processing employee data?

Consent

Data in the employment context, will include information obtained from an employee during the recruitment process (regardless of whether or not they eventually got the job), it will also include the information you hold on current employees and previous employees. All this information may be saved in hardcopy personnel files, held on HR systems or it could be information contained in emails or information obtained through employee monitoring.

Under GDPR your employee’s will have increased rights around their data.

These rights will include:

• The Right to Access. It’s not a new concept that employees will be able to request access to the data you hold on them. However, there is a new recommendation that where possible employers should provide their employees with access to a secure self-service login where they can view data stored on them. This backs-up the whole concept of transparency and ease of access to data, which underpins the new Regulations. 

• The Right to Rectification. Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. This is an existing right and the onus is on the employer to ensure that your employee records are kept up-to-date. To help ensure you maintain up-to-date records, employers should make it easier for employees to update their data.

• The Right to be informed. Employers must be very transparent with employees about what data you hold, why and how long it is held for. Up until now it has been the common practice for many employers to include a standard clause in the employment contract regarding the processing of HR Data, under GDPR that will no longer be sufficient. Employers need to be reviewing their Employee Data Protection Policies and possibly writing new Employee Privacy Policies that go into detail on the processing of employee data.

Employee self service

Under the GDPR legislation, where possible employers should be able to provide self-service remote access to a secure system which would allow employees view and manage their personal data online 24/7. Furthermore, the cloud functionality will improve your payroll processing with simple email distribution, safe document upload, easy leave management and improved communication with your employees. By introducing a self-service option, you will be taking steps to be GDPR ready.

For information on employee files and how long to keep them please see our support page: Record Keeping Requirements

To book a free online demo of Bright Contracts click here.
To download your free trial of Bright Contracts click here.

BrightPay - Payroll and Auto Enrolment Software
Bright Contracts - Employment Contracts and Handbooks

Posted in Employee Contracts, Employee Records, Employee Self Service, GDPR, General Data Protection Regulation, Online filing

GDPR FAQ's Answered!

The General Data Protection Regulation comes into force on 25 of May 2018. It is legislation with new rules and guidelines on how to protect and process personal data. It is replacing existing data protection regulations that dated back as far as 1988 – obviously pre-dating the era of internet and social media as we currently know it. We are all having to evolve; amending policies and changing how things are done to take into account the new GDPR rules, so here are some of the queries we are receiving into our Bright Contracts support lines on GDPR which you may find useful:

Does GDPR apply to me?

If you are a company in this country, if your company is a sole trader or a limited company, if you have employee’s working for you or customer’s paying you, then you will more than likely hold some form of personal data belonging to them (i.e. a name, an address, a PPS number, a VAT number) If you hold anything that could be classed as personal data then the new GDPR will apply to you.

What is Personal Data?

Personal Data is defined as, “any information related to a natural person or ‘Data Subject’ that can be used to directly or indirectly identify a person.”

It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address. (This is not an exhaustive list by any means) So, do you hold any of that type of information in your company? Of course you do; whether it is your clients, your customers or your employees. Somewhere along the line you will be dealing with personal data.

What rights do employees have under the GDPR?

As Data Subjects*, employees will have new and enhanced rights under the GDPR. The key rights in relation to employees include:

• The right to be informed: this emphasizes the need for transparency in how personal data is used. Employers should now be looking to revise their data protection policies and to implement new employee privacy policies outlining exactly what data is being held on employees.

• The right of access – there are amended rights surrounding an employee’s right to submit a data subject access request. A data subject access request involves an employee requesting to view all data retained on them, this will include data stored electronically and on paper files.

• Time-frame for response has been reduced from 40 days to one month. 
• It will no longer be permissible to charge a fee in order to respond to a subject access request.

• The right to rectification: individuals are entitled to have personal data rectified if it is inaccurate or incomplete. In fact it is recommended here that employers take steps to put the onus on employees to update their personal details should they change. For example, authorities will look unfavourably on employers who are communicating with employees through an old address having made no effort to ensure the address is correct. Employers are well advised to include a clause in employment contracts outlining the employee’s responsibility to notify the employer of a change in personal details.

• The right to erasure, also known as the right to be forgotten. The broad principle being that an individual has the right to request deletion or removal of personal data where there is no compelling reason to retain the data e.g. a legal requirement to retain employee data will always be a compelling reason to retain data.

* Data Subject: “an individual who is the subject of the personal data”.

Bright Contracts employee compliant GDPR policies are coming soon!

• If you would like to be notified when they are complete please click here
• For further information register now for our GDPR webinars click here
• Read our GDPR blogs  here

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in GDPR, General Data Protection Regulation

Bad Weather equals staffing headaches – what can be done?

With the recent bad weather, many businesses across the country have been forced to close or get by with skeleton staff. The question now on most employer’s minds is do they have to pay staff who are unable to come into work, whether because of workplace closure or inability to travel.

Answer

There is no legal obligation on employers to pay their employees if the business was forced to close due to extreme weather conditions or if employees were unable to travel to work due to bad weather. However, it is important to be aware of any custom and practice in the organisation or contractual clause, which may override this position.

The general advice to employers is to be as flexible as possible. The handling of bad weather and travel disruption can be a real opportunity for an employer to boost staff morale and show yourself as an all round fair employer. Possible considerations might include:

• Can you be flexible with regard to working hours or working patterns?
• Is it possible for employees to work from home or even at a different location?
• Would it be possible for the employee to work back the time missed at a later date?
• Rather than deducting pay for time missed you could offer that the employee take annual leave for the time. Whilst offering this as a solution is recommended, enforcing it without the agreement of the employee would not be best practice. 

A company policy on absence due to inclement weather should address the situation where employees are unable to attend work, due to weather-related circumstances. Having such a policy should also mean there is much less scope for confusion and disagreement.

An Inclement Weather policy is available within the Optional Sections of the Bright Contracts Handbook.

£250,000 holiday back-pay paid out to construction workers

Over 100 construction workers are to receive an estimated £250,000 worth of holiday pay following a Unite campaign which ruled that voluntary overtime should be included in holiday pay.

Background

Workers across three high profile projects in London were paid holiday pay based on 39 hours a week whereas in reality they often worked 55 hours a week working overtime on Saturdays. The workers have secured payment of between £400 and £1,000 each with further back payments to be received after joining forces to demand their full holiday entitlement.

The construction workers were initially ignored when they brought the issue to Byrnes Bros management, until construction workers at different sites, backed by Unite, joined forces and commenced a campaign which developed into a collective grievance. Management then tried to deal with the grievances individually but workers insisted on a collective remedy to the underpayments. Management accepted that overtime should have been included in holiday pay and Byrne Bros are now in the process of paying each worker what they are owed including back pay.

Learning Points

The decision to accept fault comes as no surprise after the landmark ruling by the employment appeal tribunal in the Dudley Metropolitan Borough Council v Willetts (and others) case in July 2017. The case was the first to confirm that employers must include normal voluntary overtime when calculating holiday pay and it set a legally binding precedent which employment tribunals across the UK are obliged to follow. The pressure is now on for employers who still do not include overtime in holiday pay to urgently reconsider; otherwise they are at risk of being brought in front of the Employment Tribunal.

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in Company Handbook, Contract of employment, Employee Contracts, Employee Handbook, Employment Tribunals

10 thing you NEED to know about GDPR

1) What is GDPR?

GDPR stands for General Data Protection Regulation and will come into force on the 25th of May 2018. GDPR is a European privacy regulation replacing all existing Data Protection legislation. The aim of the GDPR is to protect all EU citizens from privacy and data breaches in an increasingly data-driven world. The current data protection legislation dates back to 1998 – a time when internet usage and cloud technology was vastly different.

2) Who does GDPR apply to?

The GDPR applies to all businesses including sole traders, located in the EU that process personal data. It also applies to non EU organisations if they offer goods or services to, or monitor the behaviour of, EU citizens. It applies to all organisations processing and holding the personal data of EU citizens, irrespective of the organisations location.

3) What is personal data?

Personal data is defined as “any information related on a natural person or ‘Data Subject’ that can be used to directly or indirectly identify a person.” Personal data can be a:

• A name
• A photo
• An email address
• Bank details
• Posts on social networking websites
• Medical information
• CCTV images
• Records of websites visited
• A computer IP address

4) What are the 6 principles of GDPR?

Personal data should be:

• Processed lawfully, fairly and in a transparent manner
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
• Adequate, relevant and limited to what is necessary
• Accurate and kept up-to-date
• Kept for no longer than necessary
• Processed in a confidential and secure manner

5) Where is a good place to start preparing?

A good starting point for preparing for GDPR is to create an inventory of all personal data held and answer the following questions:

• Why are you holding the data?
• What is the legal basis for holding the data?
• How is the data obtained?
• Why the data was originally gathered?
• How long is the data held for?
• How is the data saved? Is it saved securely?
• Is the data shared with anyone else and with whom?

As the GDPR requires organisations to be in a position to demonstrate compliance with its requirements, documenting the above will enable employers to:

• Identify and gaps in compliance
• Put in place processes to rectify gaps
• Produce evidence of its compliance on the new GDPR

In preparation for GDPR you must be aware of your data protection responsibilities and ensure that all employees are aware of their responsibilities when processing data. Ensure that you have an up to date data protection/privacy policies addressing the six principles of GDPR and apply it to your organisation.

For more information see: “12 steps to take for GDPR”

6) How do I report a breach?

A breach is defined as a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of or access to personal data. Breaches must be reported to the ICO within 72 hours, but only if the breach is likely to result in a high risk to the rights and freedoms of individuals for e.g. result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage. Breaches likely to result in a high risk to the rights and freedoms of individuals must also be reported to the individuals concerned.

7) What are the consequences of a GDPR breach?

Organisations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements. There is a tiered approach to fines e.g. a company can be fined 2% of annual global turnover or €10 Million (whichever is greater) in some situations for lesser breaches.

8) Do I need a Data Protection Officer (DPO)?

The main role of the DPO will be to monitor internal compliance and it is mandatory to appoint a DPO for:

• Public Bodies
• Organisations engaged in large scale regular/systematic monitoring
• Organisations whose core activities consist of processing “special categories” of data or data relating to criminal convictions
• May be mandatory in other contexts as defined by Member State Law

9) What is Bright Contracts doing to ensure compliance with GDPR?

Data Protection has always been a priority for Bright Contracts and we’ve always aimed to act with complete integrity in this regard. We are committed to being GDPR compliant and are putting a number of security measures in place including:

• We are reviewing our privacy policy and making necessary changes where needed to ensure we are communicating accurately with our customers.
• In terms of the Bright Contracts content, we will be amending the appropriate data protection clauses in the contract and handbook. These will be completed well in advance of 25th May 2018.

10) How secure is my data in Bright Contracts?

Your Bright Contracts data files are encrypted so if someone gets a copy of your data they cannot read it. Whilst we have security measures in place to protect your data, it remains your responsibility to keep your sign in details secret and to sign out of Bright Contracts when you are not using it and to ensure there is no unauthorised access to your computer.

For further information register now for our GDPR webinars  here
And read our GDPR blogs  here

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in GDPR, General Data Protection Regulation

The countdown to the GDPR is on!

With less than 5 month to go before the new General Data Protection Regulation (GDPR) comes into force employers are urged to start preparing immediately if they haven’t already done so.

What is it?

The GDPR is a European privacy regulation replacing all existing data protection regulations and will come into play on 25 May 2018. The aim of the GDPR is to protect all EU citizens from privacy and data breaches in an increasingly data-driven world.

The GDPR applies to all businesses including sole traders that process personal data (a name, photo, email address, bank details etc.) so it is safe to say that it will affect all businesses in some way. Employers are advised to be prepared otherwise they will face fines of up to €20M or 4% of annual global revenue, whichever is greater, for non-compliance. So how can you start preparing to ensure your business is fully compliant?

Preparation

A good starting point for preparing for GDPR is to create an inventory of all personal data held and answer the following questions:

• Why are you holding the data?
• What is the legal basis for holding the data?
• How is the data obtained?
• Why the data was originally gathered?
• How long is the data held for?
• How is the data saved? Is it saved securely?
• Is the data shared with anyone else and with whom?

As the GDPR requires organisations to be in a position to demonstrate compliance with its requirements, documenting the above will enable employers to:

• Identify and gaps in compliance
• Put in place processes to rectify gaps
• Produce evidence of its compliance on the new GDPR

In preparation for GDPR you must be aware of your data protection responsibilities and ensure that all employees are aware of their responsibilities when processing data. Ensure that you have an up to date data protection/privacy policies addressing the six principles of GDPR and apply it to your organisation.

For further information register now for our GDPR webinars here
And read our GDPR blog here

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in GDPR, General Data Protection Regulation

What lies ahead for employers in 2018?

2018 looks set to be another busy year. We take a look at some of what’s coming down the pipeline.

April 2018 - Gender Pay Reporting

Private and voluntary sector employers in England, Wales and Scotland with at least 250 employees will be required to publish information about the differences in pay between men and women in their workforce, based on a pay bill ‘snapshot’ date of 5 April 2017, under the Equality Act 2010 (Gender Pay Gap Information) Regulations 2017. The first reports must be published by 4 April 2018.

Legislation in Northern Ireland mirror the above, except they also include fines of up to £5,000 for non-compliance, and a requirement to report on ethnicity and disability pay gaps, as well as gender.

April 2018: Termination Payments

The government plans to make changes to the taxation of termination payments from April 2018. The proposals include:

• removing the distinction between contractual and non-contractual PILONs (payments in lieu of notice) so that all PILONs are taxable and subject to Class 1 NICs]
• ensuring that the first £30,000 of a termination payment remains exempt from income tax and that any payment paid to any employee that relates solely to the termination of the employment continues to have an unlimited employee NICs exemption
• aligning the rules for income tax and employer NICs so that employer NICs will be payable on payments above £30,000 (which are currently only subject to income tax)

A government consultation on the issue closed in October 2016.

April 2018 – Restricting Employment Allowance for Illegal Workers

The government plans to introduce a further deterrent to the employment of illegal workers. From April 2018, employers will not be able to claim the Employment Allowance for one year if they have:

• hired an illegal worker
• been penalised by the Home Office
• exhausted all appeal rights against that penalty.

A consultation containing draft regulations closed in January 2017.

25 May 2018 – General Data Protection Regulations

The much anticipated General Data Protection Regulation will come into force from 25th May 2018. For those who haven’t already started preparing, now is the time. The GDPR will apply to ALL companies and sole traders that process personal data, the definition of personal data is broad and can include anything from a name, an email address or an IP address.

With possible fines of €20 million or 4% of annual turnover – which ever is higher, businesses need to sit up and take heed.

For further information of GDPR sign up to our employers webinar here or read our blog here.

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here
To subscribe to our newsletter click here

Posted in Customer Update, Dismissals, Employment Update, GDPR, General Data Protection Regulation

National minimum wage to increase on 1st April 2018

The Low Pay Commission’s Autumn 2017 report has been published and on the 1st April 2018, the minimum wage will increase again.

The National Minimum Wage (NMW) is the minimum pay per hour most employees are entitled to by law. An employee's age and if they are an apprentice will determine the rate they will receive.

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in Pay/Wage

Christmas Bank Holiday Entitlements

There are three public holidays coming over the festive season – Christmas Day, Boxing Day and New Year’s Day. Although many offices across the country will close during this period it can be one of the busiest times of the year for industries including retail, hospitality, and hair and beauty. So what public holiday entitlement are employees entitled to over this time?

Bank holiday entitlement

Employers do not have to give employees paid leave on bank holidays. Any right to time off, payment for time off or extra pay for bank holidays worked depends on the terms of the employee's contract of employment. Therefore employees may be required to work on bank holidays. Employers may choose to include bank holidays as part of a worker’s statutory annual leave.

Holiday leave entitlement

Employees’ holiday rights start on the first day of their employment.

Under the Working Time Regulations 1998, workers (including most agency and freelance workers) have the right to:

• 5.6 Weeks’ paid leave each year, this equates to 28 days for full-time employees

Part-time employees

Part-time employees are entitled to the same holidays as full-time workers, calculated on a pro-rata basis. For example:

• 5.6 x 5 working days = 28 days
• 5.6 x 4 working days = 22.4 days
• 5.6 x 3 working days = 16.8 days

Irregular hours

Annual leave for irregular workers is best calculated as a percentage using 12.07% of days worked.

Limits on statutory leave

Statutory leave is capped at 28 days per year. If an employee works 6 days per week their statutory entitlement is 28 days, not 33.6 (6 multiply by 5.6)

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

Posted in Contract of employment, Pay/Wage, Wages

Does my employee need a written statement of employment?

The main purpose of the written statement of employment, often referred to as the contract of employment, is to clarify the terms of a person’s employment and avoid uncertainty or misunderstandings, where employee expectations might not be the same as employer intentions.

All employers must provide an employee with a written statement of their terms of employment within 2 months of commencement of employment, including full-time staff, part-time staff, fixed-term and casual workers.

The written statement must include the following information:

• The full name of employer and employee
• The address of the employer
• Place of work
• Job title or nature of work
• The date the employment started
• Type of contract
• Rate of pay
• Pay intervals
• Hours of work
• Paid leave
• Incapacity for work, sick pay 
• Any terms relating to a pension scheme
• Period of notice to be given by employer or employee
• Details of any collective agreements
• Pay reference period

Additional clauses can be recommended to further clarify the relationship. These might include:

• Probation clause
• Pay in lieu of notice clause
• Confidentiality clause
• Right to search 
• The calculation of holiday pay

Failure to to provide contracts of employment could leave you wide open to a claim from their employees. Employers found not to have written terms of employment in place will be fined a maximum of 4 weeks’ remuneration per employee. Clearly worded contracts of employment are key to the success of any business. They will ensure your business is on the right side of employment law as well as help prevent disputes with employees.

To book a free online demo of Bright Contracts click here
To download your free trial of Bright Contracts click here

BrightPay - Payroll and Auto Enrolment Software
Bright Contracts - Employment Contracts and Handbooks

Posted in Company Handbook, Contract of employment, Employee Contracts, Employee Handbook, Employee Records, Employment Contract, Employment Tribunals, Staff Handbook, Workplace Relations Commission, WRC