We keep the Recruitment Privacy Notice under review. It was last reviewed and updated in June 2023.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
Read more about:
- personal data
- collecting personal data
- using personal data
- our legal basis for using personal data
- sharing personal data
- retaining personal data
- transferring personal data abroad
- further processing of personal data
- automated decision-making
- personal data in Emails
- unsolicited mail
- your rights relating to personal data
Personal data
As part of the recruitment process we collect and process personal data relating to job applicants.
We're committed to being transparent about how we collect and use that data to meet our data protection obligations.
You'll be asked to provide a range of information about yourself, including:
- your full name
- your address
- contact details, including email address and telephone number
- details of your qualifications, professional memberships, skills, experience and employment history
- information about your current level of remuneration, including allowances and benefit entitlements
- whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
- information about your entitlement to work in the UK
- criminal declaration of convictions (for specific roles)
- whether you're a member of the armed forces community
- whether you're a care leaver, or a carer of dependents
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief
If you're successful on being appointed our Employee Privacy Notice details what information is collected and how it's used during the course of your employment.
You are under no statutory or contractual obligation to provide personal data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for your application if you choose not to provide such information.
See further details about how we define personal data and non-personal data.
Collecting personal data
We collect personal data in a variety of ways, such as data:
- contained in application forms, CVs or resumes (if applicable)
- obtained from your passport or other identity documents such as driving licences
- collected through interviews or other forms of assessment, including online tests
We'll also collect personal data about you from third parties, such as:
- references supplied by former employers
- information from online criminal records checks providers
We'll seek information from third parties only once a conditional job offer to you has been made.
In certain circumstances we may approach referees prior to the assessment process, however this will be indicated to you within the application form you complete.
Collecting personal data on our website
We're the sole owner of the information collected on our recruitment website.
It doesn't store or capture personal data of users with general public access, but does log the IP address of a visitor. This enables us to determine which pages are being viewed and helps us to improve our services.
Our recruitment website doesn't use cookies. Some of the information or guidance documents that are linked to from the site, however, are on the council’s main website which is covered by the council’s cookies policy.
Where our website links to external resources or websites, these may add their own cookies. These are outside our control.
Cookies can be disabled by changing the settings on your computer browser, but you may need to re-enter information at times.
See further details about the steps we take when we collect your personal data.
Using personal data
We will use your personal data to:
- manage the recruitment and selection process
- progress your application
- assess your suitability for a role you have applied for
- decide to whom to offer a job
- help us to develop and improve our recruitment and selection process
- help us to fulfil legal or regulatory requirements if necessary
We may also need to use data from job applicants to respond to and defend against legal claims.
We may use information to create reports and statistics that are anonymous and cannot be linked back to you or individuals such as:
- statistical analysis
- statutory returns
- audit framework
Our legal basis for using personal data
Any personal data including special category data that we process is done so in accordance with Article 6, 9 and 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (DPA 2018).
The legal basis for processing your personal data is in accordance with the following:
- Article 6(1)(b) which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract of employment
- Article 6(1)(c) so we can comply with our legal and statutory duties including, but not limited to, those which apply under employment legislation
- Article 6(1)(e) for the performance of our public task
- Article 6(1)(f) for the purposes of our legitimate interest
Where the information we process is special category data, for example your health, religious or ethnicity data, the additional bases for processing that we rely on are:
- Article 9(2)(b) which relates to carrying out our legal obligations and the safeguarding of your fundamental rights including, but not limited to, those which apply under employment legislation
- Article 9(2)(g) – where processing is necessary for reasons of substantial public interest
If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.
For some roles, we need to process information about applicant criminal convictions and offences. The lawful basis we rely on is Article 6(1)(e) for the performance of our public task. In addition we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a).
Some of the Schedule 1 conditions for processing special category data and criminal offence data, require an Appropriate Policy Document (APD) to be in place, that sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice. You can find this in Our Appropriate Policy Document.
We will always ask for your consent to take part in surveys or to get your feedback, about our services.
Sharing personal data
Your personal data will be shared internally for the purposes of the recruitment and selection process. This includes:
- the recruitment and HR team
- shortlisting and interview panel members
- anyone else involved in the recruitment and selection or decision-making process
- Information Technology (IT) staff if access to the data is necessary for the performance of their roles
We will not share your data with third parties, unless your application for employment is successful and we make you an offer of employment.
We'll then share your data with former employers to obtain references for you, and with the Disclosure and Barring Service to obtain necessary criminal records checks.
The exception to this is in the case of applications where you will be undertaking some training a part of your employment - for instance, an apprenticeship, where, prior to an offer being made, we may share your name and details of your qualifications with the training provider to enable them to confirm your eligibility for the training.
This means that your data will be handled securely, strictly on a need to know basis only by those authorised specifically to do so.
We will not share any of the information you provide with any third parties for marketing, sales or any other commercial purposes.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- safeguarding
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
Retaining personal data
Data is stored in a range of different places, including:
- in your personnel file
- in our Human Resources (HR) management systems
- in other IT systems (including our email system)
We take the security of your data seriously.
We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties.
The personal data you provide in your application and as part of the recruitment process will only be held and used for the purpose of the recruitment and selection processes, and in connection with any subsequent employment or placement, unless otherwise indicated.
We'll only keep unsuccessful applicant’s personal data for a period of 6 months from the date the recruitment campaign closes, with anonymised equal opportunities information being held outside of the system for a maximum of 12 months and then deleted or destroyed securely.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment and for a period of time after your employment ceases in line with our retention schedule. When we no longer have a need to keep it, we'll delete or destroy it securely.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Transferring personal data abroad
We may process your personal data using services hosted outside the UK but only where there are safeguards in place such as a data processing agreement that complies with obligations equivalent to the principles of UK data protection legislation.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Automated decision-making
Recruitment processes are not based solely on automated decision-making.
Personal data in Emails
Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our record retention schedules.
If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.
Unsolicited mail
You will not receive unsolicited paper or electronic mail as a result of sending us any personal data while using our service, unless you've given us permission to do this.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.