Privacy Notice

This notice describes how the City of London Corporation (“the City Corporation”) as a data controller collects and uses the personal information about you that you provide when applying for employment in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018). The Notice will be reviewed periodically and may be updated at any time.

The City Corporation’s Data Protection Officer is the Comptroller and City Solicitor and can be contacted at information.officer@cityoflondon.gov.uk.

The categories of data for job applicants that we collect, process, hold and share

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed i.e. anonymised data.

Examples of the categories of personal information we will collect, process, hold and share about you include:

• Personal and contact details such as name, address, National Insurance number
• Nationality / right to work information
• Qualifications, previous experience, referees and answers to questions relevant to the role you have applied for
• Results of pre-employment screening checks such as, criminal record checks
• Age and gender
• Special categories of data including characteristics information such as race or ethnicity, religious/philosophical beliefs, sexual orientation; and information about your health, medical information and disability (for access requirements)

Why we collect and use this information

• To assess suitability for appointment to a particular post
• For administration and management purposes, to satisfy any regulatory requirements and carrying out appropriate security checks
• Where the post is offered and accepted, to enter into the employment contract
• For employment checks after an offer has been made including those required to confirm identity, establish trustworthiness, integrity and reliability, check an employee’s entitlement to work in the UK and, where necessary, to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question

Special categories of data will be processed only in the following circumstances:

1. In limited circumstances, with your explicit written consent.
2. Where we need to carry out our legal obligations and in line with our data protection policy.
3. Where it is needed in the public interest (or otherwise for our legitimate interests), such as for equal opportunities monitoring.
4. Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Collecting this information

The majority of information that we collect will have been supplied by you in the course of the application process e.g. from your application form and interview. Examples of other types of information collected include references and health data.

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. Where we are required to monitor and report on equalities data in accordance with the Public Sector Equality Duty (PSED), reporting will be of anonymised data only.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

Sharing this information

Storing this information

We hold applicant data for a reasonable period in accordance with legal requirements and this will generally be destroyed after 12 months; unless you are appointed when the recruitment paperwork will form part of your employee personnel file.  An Employee Privacy Notice is provided to all employees on starting.

We will not share your data with any third parties for marketing purposes. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

Consent

If we have consent to use your personal information for any particular reason, you have the right to remove your consent at any time by contacting the Information Compliance Team.

Employee related personal data held directly by the City Corporation is not routinely transferred to countries outside the EEA. However, certain data processed by third parties on behalf of the City Corporation may be transferred, for instance organisations based outside the EEA or operating on a global basis may need to transfer or store your data outside the EEA. We will put in place additional protections on your personal information if it leaves the UK ranging from secure way of transferring data to ensuring we have a robust contract in place with that third party. Links to each organisation’s privacy notice will also be supplied where this occurs.

Your rights regarding your personal information

Under data protection legislation, you have the right to request access to information about you that we hold, also known as a Subject Access Request. You will not have to pay a fee to access your personal information (or exercise any of the other rights listed below). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive or we may refuse to comply with the request in such circumstances.

You also have the right to:

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

To make a Subject Access Request or to verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we
transfer a copy of your personal information to another party; please contact the Information Compliance Team at information.officer@cityoflondon.gov.uk.

If you would like to discuss anything in this privacy notice, please contact the City Corporation’s Data Protection Officer at information.officer@cityoflondon.gov.uk.

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit ico.org.uk or email casework@ico.org.uk.