Personal Data Retention Policy

As controllers, we are required by data protection legislation to comply with the principles of data minimisation and storage limitation. Personal data we process:

• must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; and
• must not be kept in a form which permits identification of a data subject for longer than is necessary for the purposes for which the personal data is processed.

We are obliged to retain certain records (whether in hard copy or electronic form) for various periods because:

• we have a statutory obligation to do so; and/or
• the information contained in those records may be necessary for the future (for example, questions may arise about the calculation of benefits paid in the past, and data that may be relevant to a possible legal claim needs to be kept until the period within which that claim could be brought has expired).

This policy sets out the measures adopted by the Fund to comply with the principles of data minimisation and storage limitation in relation to personal data that it holds.

We hold and process the following types of personal data in relation to members and beneficiaries of the Fund:

• Contact details, including name, address, telephone numbers and email address.
• Identifying details, including date of birth, National Insurance number and employee and membership numbers.
• Information that is used to calculate and assess eligibility for benefits, including length of service or membership and salary.
• Financial information in relation to your membership of the Fund to enable the calculation or payment of benefits, for example bank account and tax details.
• Information about your family, dependents or personal circumstances, for example, marital status and information relevant to the distribution and allocation of benefits payable on death.
• Information about your health, for example, to assess eligibility for benefits payable on ill health, or where your health is relevant to a claim for benefits following the death of a member of the Fund.
• Information about a criminal conviction if this has resulted in you owing money to your employer or the Fund and the employer or Fund may be reimbursed from your benefits.

In compiling our policy on the retention of personal data, we have taken into account the guidelines on the retention of personal data as set out by / in:

• Information and Records Management Society;
• The National Archives;
• HMRC compliance handbook manual CH15400;
• Lord Chancellor’s Code of Practice on the Management of Records issued under Section 46 of the Freedom of Information Act 2000;
• Information Commissioner’s Office’s guidance;
• The Pension Regulator’s General Code of Practice for public service pension schemes

Data protection legislation requires that we retain personal data for no longer than is necessary in order to fulfil the purpose(s) for which it is processed. Given the long term nature of pensions, we need to ensure that personal data is retained to:

• comply with our legal and regulatory obligations regarding the payment of benefits from the Fund; and
• deal with any questions or complaints that we may receive about our administration of the Fund.

We will retain personal data for the greater of:

• such period as the member (or any beneficiary who receives benefits after the member’s death) are entitled to benefits from the Fund and for a period of 15 years after those benefits stop being paid;
• 100 years from the member’s date of birth;
• 100 years from the date of birth of any beneficiary who received benefits from the Fund after the member’s death.

During any period when we retain personal data, we will keep that personal data up to date and take all reasonable steps to ensure that inaccurate data is either erased or rectified without delay. We will periodically review the personal data that we retain and consider whether it is still required; any personal data that we no longer require will be destroyed. Paper records will be shredded using NYC’s corporate process, electronic records will be erased from the system that they are held on, either by one of the Fund’s management team or by the software provider. 

Beneficiaries form a wider category of people who receive benefits from the Fund, for example the member’s spouse, children or dependants who may receive benefits from the Fund following a member’s death. Members of the Fund and beneficiaries have a right to access and obtain a copy of the personal data that we hold about them and to ask us to correct personal data if there are any errors or it is out of date or incomplete.

In certain circumstances a member or beneficiary has the right to:

• object to the processing of their personal data
• restrict the processing of their personal data until any errors are corrected;
• transfer their personal data; or
• erase their personal data

If the exercise of the member’s or beneficiary’s rights would prevent us from paying or continuing to pay a pension from the Fund, we will consider retaining a minimised version of the personal data in order to fulfil our legal and regulatory obligations.

This policy applies to North Yorkshire Council in its capacity as the Administering Authority of the Fund. We have produced separate guidance for other participating employers in the Fund about our expectations for the retention by them of personal data we may require to administer the Fund. That guidance includes a suggested data retention policy that employers can each adopt in relation to their participation in the Fund.

This policy will be reviewed by the Fund at least annually.