JOBSEEKERS
Know your data protection rights
From 25 May 2018, new laws
will come into effect regarding
the storage of your personal
data.
Please read through the
information provided regarding
your rights under this new
legistation.
If you have any questions about
how we store your data, please
contact us at:
privacy@[Link]
What is personal data? General Data Protection Regulation
Personal data is data that can identify you as a The General Data Protection Regulation will
living individual. There is general personal data impose greater data protection obligations
such as name, address, bank details, National on organisations whilst giving more rights to
Insurance number and online identifiers/ individuals in relation to how their personal
location data. data is processed.
There is also sensitive personal data which
includes information on physical and mental
health, sexual orientation, race or ethnic origin,
religious beliefs, trade union membership and
criminal records. Sensitive personal data must
be protected to a higher level. Further information about data protection
can be found on the [Link]
YOUR RIGHTS UNDER GDPR
Right to informed consent - for your consent to be valid you Right of rectification of inaccurate or incomplete data -
must know what you are consenting to. To give valid consent you have the right to request that the agency corrects any
you must give a positive indication of your consent, such as by incomplete or inaccurate data they hold on you. The agency
ticking a box - an agency cannot accept your silence as consent should respond to your request within one month.
or use a pre-ticked box. However consent is not the only legal
basis that they can use to process your data. If the agency does Right to erasure - this is also known as the right to be
not need consent to process your data they should not ask for forgotten. You can request that the organisation remove all
it. your personal data. However, this is not an absolute right - the
organisation can keep your personal data if they have a legal
Right to withdraw consent - if you have given consent you will reason for doing so. If you ask for your data to be erased the
have the right to withdraw your consent. The agency will agency may ask whether you just do not want to hear from
have to stop processing the data that you gave them but they them for a period of time or whether you want your data to
can continue to process other data if they rely on another be permanently deleted? As organisations cannot keep lists
legal reason for doing so. of people whose data they have deleted, the agency may still
contact you if later on they find your details on a jobs board or
Right to object - you have the right to object to your data a social networking site. If you have requested for your data to
being processed. The organisation can then only process your be forgotten the agency should tell any third parties that they
data if it has a compelling legal ground to do so. have passed your data to that you have filed a request to erase.
They must also to the same.
Right to make a Subject Access Request (SAR) - if you make a Agencies are required to keep certain records such as ID or right
SAR then the agency should respond to you within 40 days, this to work checks and payroll records for certain periods of time.
can be extended to a further 2 months in certain circumstances. These obligations will override any request to erase data or any
The agency should not charge you to respond to your SAR objection to processing for so long as they must keep the data.
unless for example you have made repeated requests for the
same information. The agency could refuse to comply with Direct marketing - an organisation must have your express
your request for the same reasons. consent to send you direct marketing so if an agency wants
to tell you about services other than your work, they must have
Right to data portability - where technically possible, you your permission to send this to you.
have a right to have your personal data transferred directly
from one organisation to another. However, this does not Personal data breaches - if the agency suffers a data breach
include having your data passed to another organisation eg a loss of theft or personal data, they must inform the ICO.
without your knowledge. If there is a high risk to you, they must also tell you.