What’s Changing?
To allow deletion/anonymisation of customers’ employee data to comply with the General Data Protection Regulation (GDPR), in force from 25th May 2018, customisable retention periods have been applied to three separate categories of data within the People System. To achieve this, three separate services have been developed that will run based on these customisable retention periods.
The services will result in the deletion/anonymisation of the relevant data. This will not be recoverable.
These release notes explain when these services run and the logic behind them.
Proposed Release Date: The first services are intended to run between 16th July 2018 and early August 2018, in phases.
Any changes to these timelines will be communicated to Fourth customers separately.
Reason for the Change
Personal data may only be processed in accordance with various principles under GDPR, but in particular must be:
Default retention periods will therefore be applied to specific categories of data in Fourth’s People System. Details of these, as well as a brief description of the categories of data to which they apply, are set out in our Data Retention Policy (which can be found on the Fourth Customer Community at on our website at www.fourth.com/agreements).
The default retention periods will only apply to customers’ employees who have already been terminated (except in the limited circumstances specifically set out in our Retention Policy, referred to above). The default Retention Periods will be customisable by customers according to each category.
At the end of the retention period, the services will result in the in the deletion/anonymisation of the relevant data. This will not be recoverable. In order for this deletion service to run, customers will have to enable a new HR Global Setting (functionality and release notes to follow shortly).
For more information about how to customise the default retention periods please see release note GDPR Screen Changes on the Customer Community.
Customers Affected
All People System customers.
Release Notes
Non-Financial Data
On the 1st of every month a service will run that looks back a set number of years from the date of termination (rounded up to the nearest calendar month). The default retention period has been set at 2 years for this category of data. If a customer does not change this, then the service will look back 2 years from the date of termination (rounded up to the nearest calendar month). If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the Customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the date of termination.
This retention period applies to non-financial data (see Appendix A for details of the fields included in this category). Once the service has run, the applicable data will be deleted or anonymised and will not be recoverable.
Financial Data
On the 6th of April of each year a service will run that looks back a set number of years from the end of the applicable tax year in which termination date occurs and the relevant data will be deleted or anonymised. The default retention period has been set at 7 years from the end of the applicable tax year in which the employee’s termination date occurs for this category of data. If a customer does not change this, then the service will look back 7 years from the end of the applicable tax year in which the termination date occurs. If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the end of the applicable tax year.
This retention period applies to Financial and HR Data. Once the service has run, all remaining data held against an employee will be deleted and will not be recoverable.
Documents
On the 6th of April of each year a service will run that looks back a set number of years from the end of the applicable tax year in which termination date occurs and documents will be deleted. The default retention period has been set at 7 years from the end of the applicable tax year for this category of data. If a customer does not change this, then the service will look back 7 years from the end of the applicable tax year in which the termination data occurs (except as specifically set out in the Data Retention Policy). If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the end of the applicable tax year.
This retention period applies to Documents (see Appendix B for details of what is included in this category). Once this service has run, the applicable data will be deleted and will not be recoverable.
Please note: For the FPS this will include the deletion of former and current employees as both types will be included in this file.
Please see Appendix C for areas of our Solution which will be impacted by the deletion of data.
Appendix A - Non-Financial Data
Appendix B – Documents
Appendix C – Other Areas Impacted
To allow deletion/anonymisation of customers’ employee data to comply with the General Data Protection Regulation (GDPR), in force from 25th May 2018, customisable retention periods have been applied to three separate categories of data within the People System. To achieve this, three separate services have been developed that will run based on these customisable retention periods.
The services will result in the deletion/anonymisation of the relevant data. This will not be recoverable.
These release notes explain when these services run and the logic behind them.
Proposed Release Date: The first services are intended to run between 16th July 2018 and early August 2018, in phases.
Any changes to these timelines will be communicated to Fourth customers separately.
Reason for the Change
Personal data may only be processed in accordance with various principles under GDPR, but in particular must be:
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed (‘storage limitation’)
Default retention periods will therefore be applied to specific categories of data in Fourth’s People System. Details of these, as well as a brief description of the categories of data to which they apply, are set out in our Data Retention Policy (which can be found on the Fourth Customer Community at on our website at www.fourth.com/agreements).
The default retention periods will only apply to customers’ employees who have already been terminated (except in the limited circumstances specifically set out in our Retention Policy, referred to above). The default Retention Periods will be customisable by customers according to each category.
At the end of the retention period, the services will result in the in the deletion/anonymisation of the relevant data. This will not be recoverable. In order for this deletion service to run, customers will have to enable a new HR Global Setting (functionality and release notes to follow shortly).
For more information about how to customise the default retention periods please see release note GDPR Screen Changes on the Customer Community.
Customers Affected
All People System customers.
Release Notes
Non-Financial Data
On the 1st of every month a service will run that looks back a set number of years from the date of termination (rounded up to the nearest calendar month). The default retention period has been set at 2 years for this category of data. If a customer does not change this, then the service will look back 2 years from the date of termination (rounded up to the nearest calendar month). If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the Customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the date of termination.
This retention period applies to non-financial data (see Appendix A for details of the fields included in this category). Once the service has run, the applicable data will be deleted or anonymised and will not be recoverable.
Financial Data
On the 6th of April of each year a service will run that looks back a set number of years from the end of the applicable tax year in which termination date occurs and the relevant data will be deleted or anonymised. The default retention period has been set at 7 years from the end of the applicable tax year in which the employee’s termination date occurs for this category of data. If a customer does not change this, then the service will look back 7 years from the end of the applicable tax year in which the termination date occurs. If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the end of the applicable tax year.
This retention period applies to Financial and HR Data. Once the service has run, all remaining data held against an employee will be deleted and will not be recoverable.
Documents
On the 6th of April of each year a service will run that looks back a set number of years from the end of the applicable tax year in which termination date occurs and documents will be deleted. The default retention period has been set at 7 years from the end of the applicable tax year for this category of data. If a customer does not change this, then the service will look back 7 years from the end of the applicable tax year in which the termination data occurs (except as specifically set out in the Data Retention Policy). If a customer changes this retention period, then the look-back period will be determined by the retention period chosen by the customer e.g. if the customer has selected 5 years as the chosen retention period for this category of data, the look-back period will be 5 years from the end of the applicable tax year.
This retention period applies to Documents (see Appendix B for details of what is included in this category). Once this service has run, the applicable data will be deleted and will not be recoverable.
Please note: For the FPS this will include the deletion of former and current employees as both types will be included in this file.
Please see Appendix C for areas of our Solution which will be impacted by the deletion of data.
Appendix A - Non-Financial Data
- Address1
- Address2
- Address3
- Address4
- Postcode
- PartnerAddress1
- PartnerAddress2
- PartnerAddress3
- PartnerAddressCounty
- PartnerAddressPostcode
- PartnerAddressTown
- PartnerEmployerAddress1
- PartnerEmployerAddress2
- PartnerEmployerAddress3
- PartnerEmployerAddressCounty
- PartnerEmployerAddressPostcode
- PartnerEmployerAddressTown
- PartnerEmployerName
- AccountNumber
- BankName
- SortCode
- MotherDateOfDeath
- MothersAddress1
- MothersAddress2
- MothersAddress3
- MothersCounty
- MothersFirstName
- MothersPostcode
- MothersSurname
- MothersTown
- HomePhone
- FaxNo
- MiddleNames
- AccountNo
- MobileNo
- DateOfEntryToUK
- DatePermitAppliedFor
- DrivingLicence
- EligibilityProofComments
- EmployeeNationalityID
- EthnicOriginID
- EthnicOther
- FaxTel
- Gender
- HomeEmail
- HomeTel
- MobileTel
- PassportEndDate
- PassportNo
- PermitExpiryDate
- PermitNumber
- PermitType
- StudentVisaEndDate
- StudentVisaHolidayEnd
- StudentVisaHolidayStart
- StudentVisaNumber
- StudentVisaStartDate
- StudentVisaTypeID
- WorkPermitNumber
- WorkTel
- WRSPermitExpiryDate
- DependentChildren
- DependentDisabled
- DependentElderly
- DisabledNotes
- ReligionOther
- SexualOrientation
- HasDependants
- Address
- NoticeName
- WebAddress
- LicenceName
- LicenceNumber
Appendix B – Documents
- P6/P9/SL/NI notifications
- Pension Contribution files
- Personal documents
- Employee Pension Documents
- RTI submissions – FPS/EPS/EYU/NVR
Appendix C – Other Areas Impacted
- FPS Documents will be deleted, which will include current employees as well as past employees
- Rotas which include terminated employees will become inaccurate from a costs perspective after the expiry of the selected retention period
- Tronc funds which include terminated employees will become inaccurate from a paid out perspective after the expiry of the selected retention period
- Historic HR statistic reports in Fourth Analytics
Comments
Please sign in to leave a comment.