Health and Safety Privacy Notice

Service being provided

Administration of Worcester City Council’s health and safety functions, including accident, incident and near-miss reporting; risk management; occupational health referrals where required; Display Screen Equipment (DSE) assessments; occupational exposure management; compliance monitoring; insurance and legal claim handling; and statutory reporting to relevant regulators.

Categories of personal data we need to collect

•     Name

•     Address

•     Contact details

•     Financial (where relevant to claims)

•     Age / date of birth

•     Gender

•     Employment details (where applicable)

•     Incident and accident details

•     Witness statements

Special Category data we collect

Medical information (where required to meet legal obligations)

Source of data

We collect personal information directly from you where possible, and may also receive it from:

• from witnesses
• from managers or supervisors
• from incident or accident reports
• occupational health providers or partners.

In some cases, information may also be provided by emergency services, insurers, or other organisations involved in an incident.

Where we do not collect the information directly from you, we will provide this privacy information within a reasonable period, and no later than one month, unless an exemption applies.

Consequences of failing to provide personal data

Some personal data is needed so that we can meet statutory health and safety duties, including recording and reporting certain incidents under RIDDOR. If you do not provide required information, this may prevent or delay the Council from investigating incidents, managing health and safety risks, meeting legal reporting duties, responding to claims, or supporting employment-related health and safety obligations where applicable.

Data Controller and Processors

The Data Controller is Worcester City Council. 

The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.  

Purpose of Processing

• To record, assess and investigate accidents, incidents, near misses, work-related ill health and occupational exposures
• To comply with statutory health and safety obligations, including reporting relevant incidents under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)
• To manage health and safety risks and maintain safe premises, services and working environments
• To complete or review risk assessments, Display Screen Equipment (DSE) assessments, health surveillance or occupational health referrals where required
• To support employment-related health and safety obligations where the individual is an employee, worker, contractor or volunteer
• To manage insurance claims, legal claims, complaints, investigations and enforcement action arising from health and safety matters
• To monitor trends, identify recurring risks and improve health and safety controls, using anonymised or aggregated information where possible

Lawful basis for processing personal data

• Article 6(1)(c) – Legal obligation. Processing is necessary to comply with legal obligations under health and safety legislation, including the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999, RIDDOR 2013 and other applicable health and safety requirements.
• Article 6(1)(e) – Public task. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Council, including protecting public, employee and visitor safety and supporting regulatory compliance.

Lawful basis for processing special category data

• Article 9(2)(b) – Employment, social security and social protection law, where processing is necessary to meet employment-related health and safety obligations and is authorised by law.
• Article 9(2)(g) – Substantial public interest, supported by Schedule 1 of the Data Protection Act 2018 where applicable, including statutory and government purposes.
• Article 9(2)(f) – Establishment, exercise or defence of legal claims, where health information is needed for insurance claims, legal proceedings or regulatory action.

Where we rely on a condition requiring an appropriate policy document under the Data Protection Act 2018, processing will be carried out in line with the Council’s data protection policies and safeguards.

Who we share the information with

We may share your information where necessary with: 

• Health and Safety Executive (HSE)
• Insurance providers (e.g. Zurich)
• Legal representatives and courts where claims arise
• Emergency services
• Occupational health providers (where required)
• Other regulatory or enforcement bodies where required by law
• Service providers who support health and safety administration, case management, storage, legal services or occupational health services

We will only share personal data where it is necessary, proportionate and lawful.

Details of data transfers outside the UK and safeguards in place

Data is not normally transferred outside the UK. Where personal data is transferred outside the UK, appropriate safeguards are in place, such as adequacy regulations or approved contractual clauses.

Automated decision-making

We do not carry out automated decision-making or profiling in relation to this processing.

How long we hold your information

We will keep personal data only for as long as necessary for the purpose for which it was collected, and in line with the Council’s retention schedule. RIDDOR records must be kept for at least three years from the date the record was made. Other health and safety records may be kept for longer where necessary, for example to manage insurance or legal claims, meet employment or health surveillance requirements, or evidence compliance with health and safety law. Where legal claims are ongoing, records may be retained until the matter is concluded and any relevant limitation period has expired. All information will be held securely and destroyed under confidential conditions when no longer required.

Your rights

Your rights depend on the lawful basis and circumstances of the processing. Under UK GDPR, you may have the right to:

• access your personal information
• ask us to correct incorrect or incomplete information
• ask for your information to be deleted (in certain circumstances)
• restrict how your information is used
• object to certain uses of your information
• request your information in a commonly used format (data portability)
• understand and challenge automated decisions and profiling

We may not always be able to agree to a request if the law requires us to keep or use your information, or if an exemption applies. For example, the right to erasure and the right to data portability may not apply to processing carried out for legal obligation or public task purposes.

Complaints and further information

If you have any worries or questions about how your personal information is handled please contact our Data Protection Officer.

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Phone: 01905 722233

Postal Address:

Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).

Website: www.ico.org.uk

Phone: 0303 123 1113

Postal Address:

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.