GDPR is about managing data responsibly. So, before we look at key areas such as CV databases and the application process, it’s important to understand some of the key definitions in GDPR and then examine the obligations of Jobs.ie and the Recruiter under the new legislation.
Key Definitions in GDPR
Joint Data Controllers
Under GDPR legislation Jobs.ie and the Recruiter are Joint Data Controllers. A data controller controls and is responsible for the keeping and use of personal information on a computer or in structured manual files. As we are Joint Data Controllers the need to have a Data Processing Agreement is removed.
The Recruiter becomes a Data Controller when you receive an application from a jobseeker through Jobs.ie or when you download a CV from our CV Database
Retention
It means how long is it reasonable for you to hold onto a CV from a jobseeker either from an application for a specific job or downloading a CV from our database.
Consent
Consent must be freely given, specific, informed and unambiguous. When you receive an application from Jobs.ie or download a CV from our database then you can be sure we have permission from the candidate to do so. However, if you then decide to keep that data for an extended period then you must seek the candidate’s consent to do that. Once you download a person’s CV you are starting your own data relationship with them.
Deletion, Right to be forgotten & Portability
The new legislation gives jobseekers a right to delete their information and history and to see the information we hold about them and to take that information with them.
When a jobseeker registers on Jobs.ie we are the Data Controller. We will remain the Data Controller for their profile and account information so long as they are a registered jobseeker on the site. We have all the necessary consent and security protocols in place to keep this data safe.
Jobseekers have a right to ask for all the information we hold about them, for it to be deleted, and to be able to take the data away with them.
When the jobseeker applies for a job they give consent when they hit the apply button. They are giving consent to pass their application to the recruiter for a specific role only. We store a copy of the application in our back office which makes us joint Data Controllers with you.
You can only use the application for the job it relates to and you can only hold on to the applications if it’s reasonable for the lifetime of the particular job you are hiring for.
We have taken a viewpoint that 18 months is a reasonable period of time to retain an application. 18 months after the job posting has expired we will automatically delete the applications associated with that job from our back office.
CV Database
A jobseeker who registers with Jobs.ie can upload their CV to our CV database and make their CV searchable to the recruiters who advertise on Jobs.ie. We control that database therefore, we are the Data Controller.
However, as soon as the Recruiter uses their account to view or download a CV, and access the jobseeker’s personal details, then the Recruiter become a Data Controller too.
As with job applications, a CV can only be used in relation to a specific job. Therefore, CVs cannot be downloaded to simply be added to a talent pool. If you want to do that then you must get the consent of the jobseeker.
We are the Data Controller of the CV database. If a jobseeker asks us to erase their data, we will do that. If you have downloaded or viewed their CV in the previous 18 months, then we will endeavour to inform you of their request to be deleted. It is then your responsibility to ensure that you erase their data too.
If you would like to learn more then please read our updated Privacy Policy.
Please be aware, while Jobs.ie is doing everything we can to assist our customers, we are not a law firm and highly recommend you seek legal advice to ensure your business is compliant with GDPR. You can find out more about GDPR legislation from the Office of the Data Protection Commission here.
