We keep the Recruitment Privacy Notice under review. It was last reviewed and updated in April 2022.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
As part of the recruitment process we collect and process personal data relating to job applicants.
We're committed to being transparent about how we collect and use that data to meet our data protection obligations.
You'll be asked to provide a range of information about yourself, including:
- your full name
- your address
- contact details, including email address and telephone number
- details of your qualifications, professional memberships, skills, experience and employment history
- information about your current level of remuneration, including allowances and benefit entitlements
- whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
- information about your entitlement to work in the UK
- criminal declaration of convictions (for specific roles)
- whether you're a member of the armed forces community
- whether you're a care leaver, or a carer of dependents
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief
If you're successful on being appointed our Employee Privacy Notice details what information is collected and how it's used during the course of your employment.
You are under no statutory or contractual obligation to provide personal data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for your application if you choose not to provide such information.
See further details about how we define personal data and non-personal data.
Collecting personal data
We collect personal data in a variety of ways, such as data:
- contained in application forms, CVs or resumes (if applicable)
- obtained from your passport or other identity documents such as driving licences
- collected through interviews or other forms of assessment, including online tests
We'll also collect personal data about you from third parties, such as:
- references supplied by former employers
- information from online criminal records checks providers
We'll seek information from third parties only once a conditional job offer to you has been made and when you've agreed for these checks to be undertaken.
In certain circumstances we may approach referees prior to the assessment process, however this will be indicated to you within the application form you complete.
Collecting personal data on our website
We're the sole owner of the information collected on our recruitment website.
It doesn't store or capture personal data of users with general public access, but does log the IP address of a visitor. This enables us to determine which pages are being viewed and helps us to improve our services.
Where our website links to external resources or websites, these may add their own cookies. These are outside our control.
Cookies can be disabled by changing the settings on your computer browser, but you may need to re-enter information at times.
See further details about the steps we take when we collect your personal data.
You have the right to withdraw your consent for us to process your data at any time, including consent to contact you to gain feedback on the recruitment process, however doing so may affect our ability to manage the recruitment and selection process, assess and confirm your suitability for employment and decide if we can offer you a job.
The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Where you do not give your consent or withdraw it later, we do have a process/way to ensure that we don’t send you anything or contact you further.
Our legal basis for using personal data
We need to process data to take steps at your request prior to entering into a contract with you. We also need to process you data to enter into a contract with you.
In some cases, we need to process data to ensure that we're complying with our legal obligations. For example, we're required to check a successful applicant's eligibility to work in the UK before employment starts.
We have a legitimate interest in processing personal data during the recruitment and selection process and for keeping records of this process.
Processing data from job applicants allows us to:
- manage the recruitment and selection process
- assess and confirm a candidate's suitability for employment
- decide to whom to offer a job
We may also need to process data from job applicants to respond to and defend against legal claims.
For some roles, we're obliged to seek personal data about criminal convictions and offences. Where we seek this information, we do so because it's necessary for us to carry out our obligations and exercise specific rights in relation to employment.
Where we process other special categories of data, such as personal data about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes.
We process personal data about health and disability if we need to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.
Sharing personal data
Your personal data will be shared internally for the purposes of the recruitment and selection process. This includes:
- the recruitment and HR team
- shortlisting and interview panel members
- anyone else involved in the recruitment and selection or decision-making process
- Information Technology (IT) staff if access to the data is necessary for the performance of their roles
We will not share your data with third parties, unless your application for employment is successful and we make you an offer of employment.
We'll then share your data with former employers to obtain references for you, and with the Disclosure and Barring Service to obtain necessary criminal records checks.
The exception to this is in the case of applications where you will be undertaking some training a part of your employment - for instance, an apprenticeship, where, prior to an offer being made, we may share your name and details of your qualifications with the training provider to enable them to confirm your eligibility for the training.
This means that your data will be handled securely, strictly on a need to know basis only by those authorised specifically to do so.
We do not pass personal data to third parties for marketing, sales or any other commercial purposes.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, such as the UK GDPR Data Protection Act 2018, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
Data is stored in a range of different places, including:
- in your personnel file
- in our Human Resources (HR) management systems
- in other IT systems (including our email system)
We take the security of your data seriously.
We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties.
The personal data you provide in your application and as part of the recruitment process will only be held and used for the purpose of the recruitment and selection processes, and in connection with any subsequent employment or placement, unless otherwise indicated.
We'll only keep unsuccessful applicant’s personal data for a period of 6 months from the date the recruitment campaign closes, with anonymised equal opportunities information being held outside of the system for a maximum of 12 months and then deleted or destroyed securely.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment and for a period of time after your employment ceases in line with our retention schedule. When we no longer have a need to keep it, we'll delete or destroy it securely.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Transferring personal data abroad
We may process your personal data using services hosted outside the UK or European Economic Area, but only where there are safeguards in place such as a data processing agreement that complies with obligations equivalent to the principles of UK data protection legislation.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Recruitment processes are not based solely on automated decision-making.
Personal data in Emails
Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our record retention schedules.
If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.
You will not receive unsolicited paper or electronic mail as a result of sending us any personal data while using our service, unless you've given us permission to do this.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.