Providing Key GDPR Information

A new Employment Agency Privacy Policy has been added to the Employment folder this month. For Business subscribers, this document is also available in the Business folder.

This document is for use by employment agencies and recruitment businesses that collect and process an individual’s personal data for work-finding purposes.

In the course of assisting an individual with work-finding activities, the employment agency will have access to an individual’s personal data. Under the General Data Protection Regulation (GDPR), personal data means “any information relating to an identified or identifiable natural person ('data subject').”

As with other businesses, the employment agency must use one of the six legal bases for data processing, allowable under GDPR:

• Compliance with a legal obligation
• Contractual performance
• Legitimate interest, and
• Consent

The remaining two bases for data processing are unlikely to apply in this context:

• Public interest
• Vital interests

The GDPR requires organisations to be transparent about the personal data that they hold and how it is used and to provide the following information to individuals at the point that data is collected from them:

• the identity and contact details of the organisation
• the purposes for which the personal data will be processed, as well as the legal basis for the processing
• if the organisation is relying on its legitimate interests as the lawful condition for processing, what those legitimate interests are
• the recipients or categories of recipients of the personal data
• any transfer of the data outside the European Economic Area and the basis for such transfer
• the period for which data will be stored, or the criteria used to determine how long data will be retained
• the individual's rights to subject access, rectification or erasure of personal data, and the right to restrict processing or object to processing
• the existence of any automated decision-making and meaningful information about the logic involved and the consequences of any such processing for the individual and
• where data is obtained from a third party, the source of the data, including if it came from publicly accessible sources.

This Privacy Notice/Policy is for use by employment agencies and recruitment businesses offering work-finding services. If a business is looking to provide job applicants with information about how their personal data will be used during their own recruitment process, the Job Applicant Privacy Notice should be used instead.