Privacy notice for Recruitment 

What do we use the information for?

Recruitment services collects, processes and holds your personal information in order to provide our services effectively. 

We use this information as a result of your application for a vacancy to consider entering into a contract of employment or arrangement to undertake casual work with you.

We also use the data to produce reports to monitor recruitment volumes and workloads, but do not include personal data that would allow the identification of individual applicants in these reports. For example, how many applications were received for vacancies over a given period.

Information which has been collected to obtain your feedback and opinions may be used to influence changes to recruitment processes.

You are under no statutory or contractual obligation to provide data to the council during the recruitment process. However, if you do not provide the information, the council is unlikely to be able to consider your application.

What information do we hold and use?

We collect and process the following personal information relating to job applicants:

• Personal information (such as name, address and contact details including email address and telephone number)
  
• Details of your qualifications, skills, experience and employment history 
  
• Whether or not you have a disability or learning difference for which the council needs to make reasonable adjustments
  
• Information about your entitlement to work in the UK
  
• Equalities monitoring information, including information about your age, gender, marital status, ethnic origin and disability status.

On what grounds do we use the information?

We process personal data for the following reasons:

• GDPR Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes 
• GDPR Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(c) – processing is necessary for compliance with legal obligation to which the East Riding of Yorkshire Council is subject. 

We process special category data for the following reason:

• GDPR Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject. 

Within the recruitment process, the council needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.

The council has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the council to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The council may also need to process data from job applicants to respond to and defend against legal claims.

The council may process information supplied by applicants to determine the appropriateness of making any reasonable adjustments for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.

The council processes data including information about age, gender, marital status, ethnic origin and disability status, for statutory equalities monitoring purposes.

For specified job roles, the council is required to seek information about criminal convictions and offences. Where the council seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

For job roles involving frontline Health and Social Care or undertaking any form of work in Care Quality Commission (CQC) registered care homes, the council will seek information about COVID-19 Vaccination or exemption status.  This is necessary to ensure the council is complying with health or social care and public health interests, or the Health and Social Care Act 2008 relating to particular posts or service provision.

The council does not use automated decision-making in the recruitment process.

How do we collect this information?

We may collect the information in the following ways:

• Paper, electronic or online application forms
• Right to Work documents
• Criminal record checks
• Face to face, during the interview process
• Third parties (such as referees, the Disclosure and Barring Service (DBS) or providers who can verify identities).

For example, data may be contained within application forms, obtained from your passport or driving licence or other identity documents produced for the purpose of carrying out an identity, right to work in the UK or criminal record check, or documents confirming qualifications or professional registration or COVID-19 vaccination or exemption status or information collected through interviews or other forms of assessment.   

If you are selected for the interview or preferred candidate stage of the recruitment process, the council may also collect personal data about you from third parties such as referees, providers of services to verify documents, right to work in the UK, qualifications, professional registration or restrictions/sanctions on work and the disclosure and barring service.

Who do we share your information with?

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation. 

Your information may be shared internally for the purposes of the recruitment exercise. This includes people services staff, the recruiting manager or school, interviewers involved in the recruitment process, IT staff working with PS systems and support services staff carrying out tasks for people services or supporting recruiting managers, if access to the data is necessary for the performance of their roles.

To enable the service to carry out their functions, we use a system called iTrent which is supplied by MHR International (UK) Limited and they are classed as a Data Processor.

MHR International (UK) Limited (external website)

We will not share your data with third parties, unless your application is selected for interview or preferred candidate stage. The council will then share your data with former employers/those able to comment on your character to obtain references for you, providers of services to confirm the validity of identity documents, right to work in the UK, driving licence validity, qualifications, professional registration and restrictions/sanctions on certain professions and, where required for specified job roles, the disclosure and barring service to obtain necessary criminal records checks.  

We may transfer your data outside the European Economic Area, for example when making reference requests to former employers who are based outside the EEA.

The reasons why we may share your data with other public bodies are as follows:

• To protect vulnerable adults who may be at risk of harm or abuse
• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• Where necessary to protect individuals from the risk of harm or injury
• Where otherwise permitted under the General Data Protection legislation. 

How long do we store it and is it secure?

Data will be stored in various systems including the council’s recruitment IT system and on other IT systems used by HR such as databases, shared drives on secure servers and email.

Your personal data will remain in the recruitment IT system to assist you in future applications for as long as you retain your personal account to access the online system. Individual application forms will be automatically deleted from the recruitment IT system after 2 years. You may request your account and all information in that account to be deleted at any time.

If your application is unsuccessful, any application information in vacancy job files or HR systems will be retained for 2 years to allow operation of council policy to revisit recruitment exercises completed within the last 6 months and reconsider applicants and to allow monitoring reports on the recruitment process to be run for the 2 previous years. Details will then be deleted to be consistent with the 2 year retention period for application forms within the recruitment IT system.

The recruitment IT system will retain anonymous data to allow monitoring of the recruitment process in terms of volumes of applications etc.

If your application for employment is successful, personal data gathered during the recruitment process including your application form, references, copies of documents confirming right to work in the UK and confirmation of the completion of other statutory checks will be transferred to your personnel file which is stored electronically in the council’s document management system.  

The personal data of successful applicants will also be transferred into the council’s HR/Payroll IT system to allow correct payment to be made for work undertaken during employment and for the council’s statutory obligations with regard to employment to be met for example correctly deducting income tax, national insurance and pension contributions and making statutory payments such as for sickness and maternity/paternity. 

Personal data in your personnel file and the council’s HR/Payroll IT system will be retained during your employment and for a set period after employment ceases. The periods for which your data will be held are available to you in the privacy notice relating to employment information.

The council has retention schedules in place to ensure that information is only held for as long as it is needed. For information on how long your information will be held visit the retention explained page. 

Details of how we keep your information secure are available on the general privacy information page.

What rights do you have?

The rights that you have depend upon the grounds upon which your information is collected. All of the rights you could have are outlined on the data protection rights page. 

In most cases, people who have been involved in a recruitment process will have the following rights: 

• The right of access - you are entitled to see the information that we hold about you.
• The right to rectification - we will amend information accordingly, if any information the service holds about you is incorrect.
• The right to restrict processing - you may wish to limit how we use your data.
• The right to object - in addition to the right to limit the use of your data, you also have a right to object to the use of you data for certain actions.
• The right to erasure/ right to be forgotten - in certain circumstances, you may be able to ask for some of the information we hold to be deleted. The service has determined that all requests to permanently delete a service user record will be dealt with on an individual basis.

To exercise any of your above rights, please visit the  data protection rights page for more information.

Where can I find out more?

If you would like to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concerns with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external website)

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect any changes in our services, feedback from customers, and to comply with any changes in the law. This privacy notice was last updated on 19 January 2023.