The Data Protection Act 1998 places a duty on employers to protect the personal information of their employees
There are eight principles that data controllers are required to comply with. The most relevant in this case are that any data is processed fairly and lawfully, it is processed only for one or more specified and lawful purposes, it is adequate, relevant and not excessive for those purposes, is accurate and up to date, it is processed in accordance with the rights given to individuals, and is held securely.
The NMDS-SC seeks data on an individual employee’s national insurance number (NINO), post code, gender, ethnic group, date of birth and any disability they may have together with some specific questions on their job role, pay and training amongst other things.
Skills for Care has discussed the data set with the Information Commissioner’s Office (ICO) which has the responsibility for regulating and enforcing the Data Protection Act 1998 in the UK. The Commissioner’s advice was sought in order to ensure that the data collected through the NMDS-SC will be processed fairly and lawfully, is relevant and not excessive for the purpose intended and will be stored securely. Skills for Care has also agreed with the Department of Work and Pensions that the NINO can be used for this purpose.
For further information about fair processing of employees' and other workers' personal information in the NMDS-SC, and employers' obligations under the Data Protection Act 1998, please see the
NMDS-SC 3 layer Fair Processing Notices.