Privacy notices

Overview

As part of any recruitment process, the council collects and processes personal data relating to job applicants. The council is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations. You are being provided with a copy of this Job Applicant Privacy Notice because you are applying for work with the council (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purpose of the recruitment exercise and how long it will be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018.

Data protection principles

The council will comply with data protection law and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

Information the council collects

The council collects, stores and uses a range of information about you, in connection with your application for work with us. This includes:

• The information you have provided in any curriculum vitae and covering letter.
• The information you have provided on our application form, including your name, address and contact details, including email address and telephone number.
• Details of your qualifications, skills, experience and employment history.
• Information about your current level of remuneration.
• Information about your entitlement to work in the UK.
• Any information that you provide us during an interview, including interview notes and the records of any tests or assessments.
• Information providing you with the outcome of an interview selection process, including correspondence and any feedback given.

The council may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Equal opportunities monitoring information about your ethnic origin, sexual orientation, health, religion or belief, marital status, gender reassignment and age.
• Information about your health, including any medical condition, health and sickness records.
• Whether or not you have a disability for which the council needs to make reasonable adjustments during the recruitment process.
• Information about criminal convictions and offences.

The council collects this information in a variety of ways. For example, data might be contained in application forms or CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

The council will also collect personal data about you from third parties, such as recruitment agencies, references supplied by former employers, information from employment background check providers and information from criminal records checks. The council will seek information from third parties once a job offer to you has been made and will inform you that it is doing so.

Data will be stored in a range of different places, including on your application record in the recruitment management system (Taleo) and on other Council IT systems (including email).

Why the council processes personal data

The council needs to process data to decide whether you meet the minimum requirements to be shortlisted for a role and whether your application meets the requirements to invite you to an interview. If we decide to call you for an interview, we will use the information you provide us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and carry out appropriate checks.  The council needs to process your data to enter into a contract with you.

In some cases, the council needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.

The council has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process.

Processing data from job applicants allows the council to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The council may also need to process data from job applicants to respond to and defend against legal claims.

Where the council relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of applicants and has concluded that they are not.

How the council processes special categories of personal data

The council processes health information if it needs to make reasonable adjustments to the recruitment process for candidates who have a disability, for example whether adjustments need to be made during a test or interview. This is to carry out its obligations and exercise specific rights in relation to employment.

Where the council processes other special categories of data, such as information about ethnic origin, sexual orientation, religion or belief, marital status, gender re-assignment and age status this is for equal opportunities monitoring purposes.

Data that the council uses for equality purposes is anonymised for any publication purposes and is collected with the express consent of candidates, which can be withdrawn at any time. Applicants are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.  This data is kept in a secure online location with limited access only by specific HR individuals.  Equality data cannot be seen by line management or other employees.

Information about criminal convictions and professional registration

For some roles, the council will seek information about criminal convictions, offences, and professional registration. We will collect information about your criminal convictions history if we would like to offer you a role (conditional on other checks and references being satisfactory), where we are entitled or required to carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role, including where the role is one which is listed on the Rehabilitation of Offenders Act 1974 (Exceptions Order 1975 (SI 1975/1023) and/or is specified in the Police Act 1997 (Criminal Records) Regulations (SI 2002/233), so is eligible for a basic or enhanced check from the Disclosure and Barring Service (DBS). Where the council seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. These checks will only be carried out with the individual’s consent after a role is offered and accepted. The Council does not store DBS certificates of applicants. Rather an on-line check is carried out using the system Atlantic Data and a record kept of the disclosure reference, the date the check was completed and the decision as to whether to appoint the applicant, along with any additional information provided by the applicant.

Who has access to data

With the exception of equality information, your information will be shared internally for the purposes of the recruitment exercise on a ‘need to know’ basis, including with members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with the vacancy and IT staff, in the council’s legitimate interests of deciding whether to offer you employment and in order to comply with its legal obligations and enter into a contract with you.

The council will not share your data with third parties (except where recruitment consultancies have been used), unless your application for employment is successful and it makes you an offer of employment. The council will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records and professional registration checks. The Council will require those third parties to keep your personal data confidential and secure. Third parties are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions.

The council will not transfer your data outside the European Economic Area.

How the council protects data

The council takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

Where the council engages third parties to process personal data on its behalf, they do so on the basis of written instructions and for specified purposes, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long the council keeps data

If your application is unsuccessful your personal data will remain in the recruitment management system for 12 months after the end of the relevant recruitment process. At the end of that period or sooner if you withdraw your consent and we have relied on that consent for lawful processing of your data, your data will be deleted or destroyed.

Panel notes relating to the selection process that are held outside of the recruitment management system will be destroyed 12 months after completion of the end of the relevant recruitment process.

In exceptional cases your data may be kept for longer than the 12 months stated in this section if the Council decides that it is in its legitimate interests to retain your data for longer, in order to investigate or defend allegations relating to the fairness of the recruitment process and in the event of a legal claim, for example that we have discriminated against candidates on prohibited grounds.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a Workforce Privacy Notice and HR Records Retention Policy.

Your rights

As a data subject, you have a number of rights. You have the right to:

• information about what personal data we process, how and on what basis (as set out in this notice)
• access and obtain a copy of your data on request;
• require the council to change incorrect or incomplete data;
• require the council to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing for which it was collected;
• require the council to delete or stop processing your data if processing is unlawful;
• object to the processing of your data where the council is relying on its legitimate interests as the legal ground for processing; and
• ask the council to restrict the use of data for a period if data is inaccurate or there is a dispute about whether or not your interests override the council's legitimate grounds for processing data;
• object if the council processes your personal data for the purposes of direct marketing;
• transfer your personal data to another controller (excluding paper files)
• (with some exceptions) not be subjected to automatic profiling;
• be notified of a data security breach concerning your personal data where this is likely to result in high risk to your rights and freedoms;
• if we do request your consent as a lawful ground to process your personal data for a specific purpose, you have the right not to consent or to withdraw your consent later 

If you would like to exercise any of these rights, please email: humanresources@croydon.gov.uk.

If you would like to make a subject access request, please email: SAR@croydon.gov.uk

The council has appointed Sandra Herbert as its Data Protection Officer. Her role is to inform and advise the council on its data protection obligations. Further details are available in the Council’s Corporate Privacy Notice.

If you believe that the council has not complied with your data protection rights, you can complain to the Information Commissioner. You can do this by contacting the Information Commissioner’s Office directly. Full contact details including a helpline number can be found on the information Commissioner’s Office website www.ico.org.uk . This website has further information about your rights.

If you do not provide personal data

You are under no statutory or contractual obligation to provide data to the council during the recruitment process. However, if you do not provide the information, the council may not be able to process your application properly or at all, or provide any reasonable adjustments to the application process

When you applied for this role you provided your consent to us processing your personal information for the purposes of the recruitment exercise. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw you consent please contact email:careers@croydon.gov.uk

Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our HR Records Retention Policy, we will dispose of your personal data securely.

Automated decision-making

Recruitment processes will occasionally use automated decision-making for example to confirm that you meet the minimum statutory requirements for a job.  Where automated decision making prevents you continuing with your application you may request a review of the decision in accordance with your statutory rights under the relevant data protection legislation by contacting the Council at careers@croydon.gov.uk before the published closing date.

Data protection officer: Sandra Herbert

Updated 24 May 2018