1. Introduction

The Northern Ireland Social Care Council (the Social Care Council) has been established by the Department of Health (DoH) to support high quality standards of social work and social care. Its purpose is to register, regulate and support the development of a strong and professional social work and social care workforce that meets the complex needs of our society.

More detailed information about different aspects of the Social Care Council’s work can be found on its website; www.niscc.info.

The Social Care Council recognises the importance of protecting personal and confidential information in all that it does directly, and working with others, and takes care to meet its legal duties.

The Social Care Council is a ‘Data Controller’ as defined in the UK General Data Protection Regulations (UK GDPR) and Data Protection Act 2018 (DPA). This means that if the Social Care Council collect and use personal and sensitive data about individuals it must comply with the requirements set out in the UK GDPR and DPA.

Key legislation includes:

UK General Data Protection Regulations (UK GDPR)
UK Data Protection Act (2018)
Access to Health Records (Northern Ireland) Order 1993 (AHR)
Freedom of Information Act (2000) (FOI)
Environmental Information Regulations (2004) (EIR)
the Human Rights Act 1998 (HRA),
relevant health service legislation, and the
common law duty of confidentiality.

The Social Care Council as a statutory regulator also has legislation, regulations and rules that govern its work. Our primary legislation is Health and Personal Social Services Act (Northern Ireland) 2001. The primary purposes for processing personal data supports these responsibilities. Further detail can be found on the Social Care Council website, see: niscc.info/legislation-regulations-and-rules/.

This Privacy Notice is for people whose persona data the Social Care Council hold and use, applies to all personal data held by third parties on the Social Care Council’s behalf and sets out the Social Care Council’s approach to the protection of personal information and data.

This policy also serves as a ‘Privacy notice’ under the UK GDPR.

2. Personal information

The Social Care Council holds and uses personal information for a number of purposes. This Privacy Notice provides a summary of how this information is used by the Social Care Council. To ensure that the Social Care Council process personal information fairly and lawfully it is required to advise:

What personal information it collects.
Why this it needs this information.
How it will be used.
With whom it will be shared.
How long it will be kept for.

2.1 What types of personal information do we handle?

The Social Care Council processes a range of personal information across its different business functions. The information it may hold includes:

contact information like names, addresses, telephone numbers, email addresses
for its staff, family details, for example next of kin details
employment details, for example, salary, HSC service information, and health and wellbeing data
sickness absence and other absence information
registrant and employer information like health records, and/or
details held in personnel files.

The Social Care Council also processes ’special categories’ of information to carry out its regulatory responsibilities. These can depend on an individual’s relationship with the Social Care Council, such as someone applying for registration, or who is a registrant, a social work student on the Degree in Social Work approved program in Northern Ireland, someone who is raising a concern about a registrant, witness information and/or if you are a current or former employee.

registration history
educational data, including qualifications and education provider details
professional development information
employment both current and historic, including disciplinary matters
criminal or legal information
bank or financial information
health and wellbeing information, including any ongoing medical issues, and/or
equality information, including racial or ethnic origin.

For further information on the personal information processed across the Social Care Council’s business functions, please refer to Appendix 1.

2.2 Why we need personal information

The Social Care Council processes information in order to provide a range of statutory and regulatory functions to protect the public, and functions that are within the public interest. To do this the Social Care Council maintain a Public Facing Register (the Register) of social care and social work professional who meet the Standards of Conduct and Practice. Registrant registration information is used to maintain the Register and ensure it is kept up to date.

The Social Care Council also processes personal information for legitimate private interests. It is also bound by statute to share information for law enforcement purposes.

For further information on the personal information processed across the Social Care Council’s business functions, please refer to Appendix 1.

2.3 Where we get this information from

The Social Care Council receives personal information from a range of sources, namely:

other HSC organisations, for example HSC Trusts
other professional registration bodies or regulators, such as RQIA
other statutory bodies
employers
individual social work and social care registrants
staff
health and social care professionals
law enforcement, including the police, or request by a court for legal proceedings.
service users, and
members of the public.

The above list is not exhaustive.

2.4 How will we use personal information?

The Social Care Council processes information in order to fulfil its regulatory, statutory, contractual and legal obligations, as well as obligations in the public interest.

For further information on how the Social Care Council processes personal information, please refer to Appendix 1.

2.5 Sharing personal information

The Social Care Council may also be obliged to provide personal information to another statutory organisation (such as a Police, other regulator or investigatory body), or via a Court Order. The Social Care Council may also share personal information obtained from registrants with counsel, third-party solicitors, courts and experts in the course of managing legal issues, as part of legal processes.

For further information on the sharing of personal information across the Social Care Council’s business units, please refer to Appendix 1.

2.6 Retaining information

The Social Care Council will only retain information for as long as necessary, in line with the Department of Health (DoH) Good Management, Good Records (GMGR).

For further information, please refer to the following DoH link: www.health-ni.gov.uk/topics/good-management-good-records.

3. Individual rights

Individuals have certain rights under UK GDPR, namely:

The right to obtain confirmation that their personal data is being processed, and access to personal data.
The right to have personal data rectified if it is inaccurate or incomplete.
The right to have personal data erased and to prevent processing, in specific circumstances.
The right to ‘block’ or suppress processing of personal data, in specific circumstances.
The right to portability, in specific circumstances.
The right to object to the processing, in specific circumstances.
Rights in relation to automated decision-making and profiling.

Detailed guidance on individual rights is available from the Information Commissioner’s Office, see: ico.org.uk/for-the-public.

4. Security of personal information

The Social Care Council is committed to taking all reasonable measures to ensure the security of all personal information it holds. As part of this the Social Care council accesses support from the Business Service Organisation (BSO), including corporate services such as data protection and information governance.

The following arrangements are in place:

All Social Care Council staff have contractual obligations of confidentiality, enforceable through disciplinary procedures.
Everyone working for the HSC is subject to the common law duty of confidentiality.
Staff are granted access to personal information on a need-to-know basis only.
The Social Care Council has appointed a Senior Information Risk Owner (SIRO) who is accountable for the management of all information assets and any associated risks and incidents.
The Social Care Council has appointed a Personal Data Guardian (PDG) who is responsible for ensuring confidentiality and security of information within the organisation.
The BSO has also appointed a designated Data Protection Officer (DPO) to support the Social Care Council, who provides full authoritative advice and recommendations in the field of data protection and facilitates compliance with the accountability requirement of GDPR.
All staff are required to complete information governance training every two years. The training provided ensures that staff are aware of their information governance responsibilities and follow best practice guidelines to ensure the necessary safeguards and appropriate use of personal information.
A range of policies and procedures are in place, including Social Care Council’s Data Protection and Confidentiality policy.

5. Access to information

5.1 Subject Access Requests (SARs)

GDPR gives individuals the right to access information that the Social Care Council holds about them by submitting a Subject Access Request (SAR). To make a request, individuals will need to provide:

adequate information (for example full name, address, date of birth) so that identity can be verified and information located, and/or
an indication of what information is being requested, to enable the Social Care Council to locate this in an efficient manner.

The Social Care Council aims to comply with requests for access to personal information as quickly as possible, and normally within a calendar month of receipt unless there is a reason for delay that is justifiable under GDPR.

The Social Care Council want to make sure that personal information is accurate and up to date. If someone thinks any information is inaccurate and/or incorrect then please let the Social Care Council know.

5.2 Freedom of Information

The Freedom of Information Act 2000 provides any person with the right to obtain information held by the Social Care Council, subject to a number of exemptions.

5.3 Complaints about how we process personal information

If an individual is dissatisfied with how the Social Care Council is, or has been, processing their personal information, they have the right to advise Social Care Council of this in writing.

6. Contact details

SARs and complaints may be made in writing or verbally. Freedom of information requests must be made in writing. Contact details are as follows:

Subject Access Requests: dpa.bso@hscni.net. However, individuals may also wish to submit a SAR using telephone (call 028 9636 3525) or BSO social media channels.
Freedom of Information requests: foi.bso@hscni.net.
Complaints: info@niscc.hscni.net.

You may also submit requests and/or complaints to:

Corporate Services Department

Business Services Organisation

2 Franklin Street

Belfast

BT2 8DQ

7. Changes to our Privacy Notice

The Social Care Council will keep this Privacy Notice under regular review and will place any updates on this document. As a minimum this Privacy Notice will be reviewed every 3 years.

[Last updated – 6 October 2024]

Appendix 1

Business function	Personal information processed	Reason(s) this information is required	Who this information may be shared with	Legal basis under GDPR
Workforce Development: General	– Name and job title – Email address-work and personal if provided Telephone/mobile number – Demographic information-home/work address – Employer information-name and email address of employer, name of line manager – Attendance information at events – Disability, health and dietary requirements at events – Funded opportunities including qualifications applied for/ progress towards/completion data.	To maintain contact with registrants about learning and development opportunities. To inform employers about funded opportunities and events. To enable contact with finance departments re invoicing, payments and spends. To ascertain employer representation at events and levels of staff and ensuring equality of opportunity across employers. To maintain health & safety and ensure personal choices and independence are honoured	Information can be shared with employers for reasons of regulation and governance	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing
Workforce Development: Learning Zone (LZ)	– Username, Personal/Work Email, Work role, work setting – Name and job title – Email address-work and personal if provided – Telephone/mobile number – Work address – Employer Name – Employer email – Supplier Name and main contacts names (Account manager, – Support team details Supplier contact email – Attendance information at content reference meetings/testing focus groups/pilots/digital engagement event – Disability, health and dietary requirements at events	To develop digital resources, the Social Care Council invites employers and registrants, subject matter experts to participate in content reference groups and pilot groups to support development of the content, build, review and testing/piloting of the resources. To develop supporting multimedia for inclusion in resources – registrants and managers are invited to participate in filming or be photographed. To support development and maintenance of the LZ website and supporting platforms the Council works with suppliers via their account managers, technical and finance teams. To access certificates for completion of childcare resources – childcare professionals must register with the LZ and set up an LZ account. Registrants/other professionals provide feedback including pilot feedback via online Citizen Space surveys where there is an option to include their contact email, service/setting and their role. Registrants and other professional using the LZ – can email the dedicated LZ email to raise a query or report an issue with a resource or the platform where they provide an email address to respond to.	Contact information mainly work emails is shared with other reference group members but only when consent has been agreed. Identifying details provided by Citizen Space returns are anonymised in reporting process and only used to seek additional information or follow up on a query raised. Where the Social Care Council takes photographs or develops films to be used within resources, individuals will always be asked for the appropriate level of consent to do so, and apart from a third-party provider, contact information will not be passed on to any third parties and will only be used by the Workforce Development and Communications Team. In order to provide individuals attending meeting or digital events with a good service we may pass on some basic information (e.g. if you have special requirements) to a venue, event facilitator or other organisation, as part of its face-to-face and virtual event offerings. Emails from registrants and employers received to the LZ email box maybe shared with other internal teams where these are relevant.	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing
Workforce Development: Degree in Social Work	– Name of registered social work student – Year/Level of study – Name of student attending – Name of employer organisation providing Practice Learning Opportunities (PLOs)	The Social Care Council requires information about students availing of practice learning in the Community and Voluntary sector in order to disburse funding for Practice Learning opportunities on behalf of the Department of Health (DoH).	Information may be shared with the Northern Ireland Degree Partnership, the relevant Higher Education Institute or the organisation providing a PLO to ensure accuracy of information. Practice Learning Centres, and the Voluntary Organisations Communication and Learning Services contract holder allocate PLO’s within the sector and therefore information may be shared with them on a reciprocal basis. Information may also be shared with the Department of Health if required to provide quality assurance in relation to disbursement of funding	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing”
Workforce Development: Internationally Qualified Social Workers (IQSW)	– Name – Email/postal address, – Telephone – Qualifications achieved including awarding body – Employment history	In order to assess if qualification they hold meets Social Care Council standards for registration as a social worker as set out in; Health and Personal Social Services Act (Northern Ireland) 2001, Part 1, Section 11	Employers providing compensation measures.	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing”
Professional in Practice (PiP) and Assessed Year in Employment	– Name. – Email/postal address. – Telephone number. – Employer information. – Attendance information (e.g. events). – Disability/ health and personal circumstances. – Dietary details (if applicable). – Demographic information (e.g. location, age, gender). – Profession (if a registrant) and job title. – Professional in Practice – post-graduate and Continuous Professional Development activity. Post-graduate academic record where applicable. – Compliance / non-compliance with Registration requirements. – Guests e.g. family members. – Personal email addresses where provided. – Stakeholder relevant information when non-registrants. – Non-domiciliary registrants where relevant to PiP. – Payment information for external providers. – Practice evidence required for auditing and governance purposes	To carry out all of the roles and functions associated with the Northern Ireland Social Care Council’s Awarding Body status. The delivery of the Professional in Practice Framework is a Statutory Function of the Social Care Council as set out in Health and Personal Social Services Act (Northern Ireland) 2001. We require information to carry out all the of the activities associated with that function including: – Maintaining a record of Professional in Practice activities for all registered social workers. – Managing the delivery of all meetings, forums and panels associated with the delivery of the PiP Framework. – To deliver the Quality Assurances processes associated with Awarding Body Status. – To confer professional Requirements and Awards on social workers who have achieved them. – Facilitation of assessment processes.	Information can be shared with the employer recorded by the registrant on their portal account for the purposes of: – Regulation and Governance – Performing our statutory functions – Performing our Award Body functions. Information can be shared internally with the Registration and / or Fitness to Practise Team where there is a justifiable reason to do so, including for the purposes of exercising our statutory duties or where there are regulation or public protection concerns.	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing”
Communications	– Name – Email/postal address – Telephone number – Attendance information (e.g. events) – Disability/dietary details (if applicable) – Demographic information (e.g. location, age, gender) – Profession (if a registrant) and job title – Social media profile information (if required)	The Social Care Council are required to engage with the people affected by its work. This is the basis for contacting individuals about any of our events and/or other activities, as this is necessary to perform tasks carried out in the public interest and/or in exercising our official authority as a regulator. Reasons include to: – maintaining contact with individuals, and to manage and develop relationships with them – responding to public enquiries and providing individuals with relevant information and/or services – where individuals have opted-in to future communications, on each subsequent communication, will offer an easily executable ‘opt-out’ or ‘unsubscribe’ option from any future mailings – sending essential information to registrants, employers, students and endorsers about registration-related and workforce education and training-related matters e.g. registration renewal reminders and communications for any other reason related to your registration – taking and organising photographs to document an event or as part of campaign /promotional activity – promote research and evaluation opportunities to improve our engagement and communications activities – communicate about any relevant developments, and – ask if individuals would like to participate in research or engagement events.	On the whole contact will not be made with an individual unless they agree to be contacted, and/or it is to support a regulatory or statutory function e.g. registration-related matters. In order to provide individuals with a good service and to make communications and engagement with the Social Care Council as comfortable as possible the communications function may pass on some basic information (e.g. if you have special requirements) to a venue, learning providers or other organisation, as part of its face-to-face and virtual event offerings. The Social Care Council will also share reports about our engagement and learning events with third-party organisations within the HSC and/or that support is work, as part of reporting and evaluation. For some engagement activities, the Social Care Council may need to use personal details itself and/or pass personal details to third-party provider to promote an event, confirm attendances, provide updates and information about an event an individual is attending or have attended. Where the Social Care Council takes photographs at an event or as part of a promotional activity, individuals will always be asked for the appropriate level of consent to do so, and apart from a third-party provider, contact information will not be passed on to any third parties and will only be used by the Communications Team. Individuals can withdraw consent at any time by emailing: comms@niscc.hscni.net, and all photos will be deleted that include the individual and if published this will be done where possible, as not all copies may be on Social Care Council publications and/or websites.	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing
Business Support	– Email/postal address for registrants, employers, stakeholders. – Personal telephone numbers for sessional workers, students. – Attendance information (e.g. events, conferences) for stakeholders. -Disability details (if applicable) for stakeholders. – Identity photographs.	– Attendance at events and conferences. – Travel bookings. – Board and committee information. – Payment processing for sessional staff. – Sessional workers. – Student placements. – Complaints. – Trade Union correspondence. – Training. – Email management for Senior Leadership Team (SLT) Chair and Heads of Function. – Mail management. – Staff passes, health and wellbeing events. – Bereavements. – Procurement. – Registrants – management of emails for registration team. – Research. – Lunchtime seminars. – FoIs and SARs. – Publication of Board and partnership minutes and papers. – Declarations of Interest.	Primarily for internal use to support management of corporate functions around HR, procurement, estates and mail management – may be additionally shared with BSO and Pals for finance or HR processing purposes. Line manager. Head of Business Services. Head of Business Services. PA Chair and SLT. Business Support. Director of Registration and Corporate Services. Professional adviser lead. Business Support. Business Support and/or direct line manager – may also include BSO. Business Support.	UK General Data Protection Regulation (UK GDPR)
	Staff personal, home and contact details. Board members and SLT – personal contact details (phone, email, address). Participation Partnership and service users and carers – personal contact details (phone, email, address). Public and others email and contact details (name, address, email and phone number). Personal and health data for staff. Payroll number for sessional staff.	Emergency/business continuity contact purposes. Travel claims processing and flight bookings. Emergency/business continuity contact purposes. Travel claims processing and flight bookings. Meeting contact arrangements. Complaints receipt and management. Also, ad-hoc general correspondence. Official correspondence received by the Social Care Council for onward processing or internal storage. To approve payments.
Registration	– Full name and previous name(s) if any. – National Insurance Number – Copies of identity documents. – Work email address (and personal email address where provided). – Postal address. – Telephone number. – Demographic information (e.g. location, age, gender). – Payment information (provided by phone or online to pay fees). – Employment information including organisation details, job title and work address. – Disability/ health declaration information. – Disciplinary and criminal offence declaration. information including Data Barring Service data – Details of endorser from employing organisation – Equal Opportunities information, if provided. – Student enrolment details at universities providing the Degree in Social Work. – Social Work qualification details. – Compliance / non-compliance with Registration requirements i.e. Assessed Year in Employment/PiP or Fitness to Practise/Committee decisions – Practice evidence for audit purposes. – Registration or application history (i.e. dates of all periods registered/previous removals or incomplete applications). – Copies of communications exchanged with applicant/registrant. – Notes of pertinent information obtained during application/maintenance of registration points of contact.	To complete the registration application process in line with the requirements of the Northern Ireland Social Care Council Registration Rules to assure good character, conduct, competence and physical and mental fitness to practise. We require this range of information in order to complete the registration function and maintain registrants’ registration cycle. Related activities include: – Sending requests for information/fee or renewal reminders/confirmation of registration details to the applicant/registrant. – Sending reminders to endorse or requests for information to endorsers. – Where necessary referring information related to character, competence or health matters to our Fitness to Practice Team. – Sending notification of removal to registrants. – Answering queries regarding application or registration status from registrants or their employers. – Selecting registrants and communicating with them for audit purposes. – Communicating and verifying social work degree course participation or graduation with universities and Department of Health. – Sending communications to registrants and employers to inform or remind them of highlights in the registration calendar or of new developments in process and digital tools. – Providing statistical information where required to employers, universities or to Department of Health.	Information can be shared with the employer recorded by the registrant on their portal account for the purposes of: Regulation and Governance. Performing our statutory functions. Information can similarly be shared with universities providing the Degree in Social Work in Northern Ireland and with other regulatory bodies. Information can be shared internally with the Workforce Development Team, Communications Team and / or Fitness to Practise/Committee Teams where there is a justifiable reason to do so, including for the purposes of exercising our statutory duties or where there are regulation or public protection concerns.	General Data Processing Regulation (2016): Article 6: Lawfulness of Processing
Database	– Name – Email/postal address – Telephone number – Employment information – Disability/ health and personal circumstances – Demographic information (e.g. location, age, gender) – Profession (if a registrant) and job title – Professional in Practice – post-graduate and CPD activity – Fitness to Practise information (Data Barring Service/Criminal Convictions) – Health Information – Identity Documents	To carry out all of the roles and functions associated with the Northern Ireland Social Cares Registration process To assist in maintaining a record of Professional in Practice activities for all registered social workers	Information can be shared with the employer recorded by the registrant on their portal account for the purposes of: – Registration – Regulation and Governance – Performing our statutory functions – Performing our Award Body functions. Information can be shared internally with the Registration and / or Fitness to Practise Team where there is a justifiable reason to do so, including for the purposes of exercising our statutory duties or where there are regulation or public protection concerns.
Fitness to Practise	– Name – Registration (SCR) Number – DOB – Email/Postal address – Employment details – Health declarations – Criminal offence details – Disciplinary declarations – DBS Barring status – Third party regulator decisions – PSNI/Safeguarding investigation details – Details of the concern raised – Correspondence with third parties about the concern raised – Employer disciplinary documentation – Supporting evidence including video and photo evidence – Health related documentation – Information from the Police or relevant authority – Certificates of conviction – Witness statements	To meet our statutory functions as laid out in the Health and Personal Social Services Act (Northern Ireland) 2001 for the purpose of regulating social care workers, ensuring character and conduct meet agreed standards and the public is protected against dishonesty, malpractice and other seriously improper conduct or unfitness.	Internally, information is shared with Registration, Committee and Workforce Development teams as required to enable them to discharge their respective statutory functions. At certain points in our proceedings, in accordance with the NISCC Fitness to Practise (Amendment) Rules 2019, it may become necessary to share information held with the following parties: – the registrant who is the subject of the concerns raised and any identified representative; – the person who has raised the concern; – the registrant’s current employer or educational institution where they are participating on a social work course; – the registrant’s previous employers; – the Police; – the NI Courts and Tribunals Service; – ACRO Criminal Records Service; – the Disclosure and Barring Service; – the Regulation Quality Improvement Agency; – Adult or Child Safeguarding Teams; – potential witnesses and experts, including health professionals; – people affected by the incident; – other regulators; – Council solicitors. All Consensual Disposal sanctions are published on the Social Care Council’s Public Facing Register in accordance with our Disclosure and Publication Policy.	Internally, information is shared with Registration, Committee and Workforce Development teams as required to enable them to discharge their respective statutory functions. At certain points in our proceedings, in accordance with the NISCC Fitness to Practise (Amendment) Rules 2019, it may become necessary to share information held with the following parties: the registrant who is the subject of the concerns raised and any identified representative; the person who has raised the concern; the registrant’s current employer or educational institution where they are participating on a social work course; the registrant’s previous employers; the Police; the NI Courts and Tribunals Service; ACRO Criminal Records Service; the Disclosure and Barring Service; the Regulation Quality Improvement Agency; Adult or Child Safeguarding Teams; potential witnesses and experts, including health professionals; people affected by the incident; other regulators; Council solicitors. All Consensual Disposal sanctions are published on the Social Care Council’s Public Facing Register in accordance with our Disclosure and Publication Policy.
Committee	– Name – Contact Information – Employer information – Representative Details – Profession – Health information – Conviction information – DBS listing – Disciplinary information – Medical Reports – References – Video/audio Recordings – Family member details – University information – Bank Details – Dietary requirements – Criminal information – Personal and commercial interests – Hearings statistics – Appraisal and Personal Development information – Decisions taken by Committees	To manage the delivery of all hearings. To enable evidenced based decisions to be made for applications to the Register and regarding a registrant’s fitness to practise to remain on the Register. To recruit and appoint Committee Members and Legal Advisers and to manage administration and governance procedures.	(Amendment) Rules 2019 and the Northern Ireland Social Care Council (Registration) Rules 2022. Information can be shared for payroll purposes and to third parties who provide our information systems.	UK Data Protection Act 2018

Privacy Notice