Agent Privacy Policies & My CV

[man]

Hi all,

I'm finding a few agents doing a 2-stage process on Jobserve now (i.e. after you've submitted your CV you get an email from Jobserve telling you to go to a link and agree to the agent's T&Cs for the application to be completed) and/or sending me emails advising me of their privacy policy and asking for consent for my CV to be kept.

By my (layman's) reading, a couple of these policies are vaguely worded enough that they appear to give the agent permission to send my CV to clients (Not just specifically the client role I applied to) - and there's no clear way to opt out. Knowing the industry reputation for spamming contractor CVs all over the place (and the potential consequences of that), I'm reluctant to blindly agree.

What's the crack with this in this post-GDPR world? I'd hope that explicit consent is required...

[northernladuk]

I'd say the devil is in the details and first step would be to fully understand the privacy policy rather than make up non issues that are actually well covered.

We'd have to see the exact wording to be able to give you any meaningful answer I think.

[Old Greg]

Hi all,

I'm finding a few agents doing a 2-stage process on Jobserve now (i.e. after you've submitted your CV you get an email from Jobserve telling you to go to a link and agree to the agent's T&Cs for the application to be completed) and/or sending me emails advising me of their privacy policy and asking for consent for my CV to be kept.

By my (layman's) reading, a couple of these policies are vaguely worded enough that they appear to give the agent permission to send my CV to clients (Not just specifically the client role I applied to) - and there's no clear way to opt out. Knowing the industry reputation for spamming contractor CVs all over the place (and the potential consequences of that), I'm reluctant to blindly agree.

What's the crack with this in this post-GDPR world? I'd hope that explicit consent is required...

Agree to the terms. Check they have sent it out to the agent from the ad. Then at the appropriate time, put is an SAR and request them to delete your records.

[man]

@Old Greg:
Thanks for the suggestion - that's a great workaround to reduce the risk where there is lingering doubt.

@northernladuk:
That's my point exactly, I've read it, found it unclear and it's not the first (and won't be the last) time I've seen this issue with an agent's privacy policy. I was hoping I wouldn't need to seek advice every time I want to apply to a contract and the agent hasn't provided a well worded privacy policy. I think my caution is warranted because my knowledge of legal matters is that those with the most money to spend on lawyers win most of the time, particularly where there is any lack of clarity involved. And my cynical side always leads me to question whether it's worded badly with the intention of allowing misuse.

Thanks for the offer to review it - I was actually just hoping that in this post-GDPR world you can't sign away your ability to retain which end clients see your CV. I'll paste the full terms below - grab a cuppa:

How we use your information

This statement outlines how REDACTED (REDACTED) processes your personal data.

How will REDACTED use the information that you provide?

Personal data that you supply to us will be used for the following, collectively the 'Purposes':

(i) the purpose of processing your application for a role with REDACTED or one of our clients;
(ii) if successful, managing your contract;
(iii) matching your details to any future suitable assignments;
(iv) contacting you about the services we offer or specific assignments;
(v) assisting you with the decision as to best engagement model; and
(vi) undertaking surveys

REDACTED are processing your personal data on the basis of REDACTED's legitimate interest, that it is necessary for progressing the Purposes and the performance of any resulting contract, and also due to REDACTED legal obligations. Some processing may include profiling and automated decision making.

The legitimate interests pursued by REDACTED are as follows:-

a) Collecting your personal data either directly from you, or from a publicly available source for the
purposes of matching your profile against suitable assignments
b) Managing the application, screening, and selection process for suitable assignments
c) Providing your details to nominated third party suppliers for the purposes of pre-assignment
screening, and also for the nominated suppliers to offer appropriate services that may benefit you
d) Managing any resulting contract of employment or engagement where relevant
e) Storing your personal data for the purpose of matching your details with potential future
assignments
f) Contacting you by phone, or email about potential future assignments

In the course of processing your application, REDACTED may collect personal data about you which is more sensitive than other data such as details about your health. Where this is done it will be for the purpose of making reasonable adjustments during the application, sourcing and selection process. In some circumstances this data may be shared with our clients for the same purpose, or for them to ensure that the assignment being performed would not be detrimental to your health, or the health of others.

We will treat all personal data (whether sensitive or not) as private and confidential except where we are permitted or required by law to make a disclosure or where the disclosure is necessary for the Purposes.

Unless REDACTED are required by law, you are under no obligation to provide your personal data to REDACTED for the purposes. Should you choose not to provide your personal data, or you request that REDACTED delete your personal data, REDACTED or our client will be unable to engage or employ you.

How long will REDACTED keep your data for?

We will keep your personal data for the purposes of matching your details to a potential future assignment for as long as is necessary to achieve the Purposes, which may be for the duration of your career, or until such point that either you ask us to delete the personal data or we believe that there is no realistic prospect of REDACTED identifying a potential future assignment.

Where you are presented to a client and additional data is collected or created during the application, sourcing and selection, or screening process REDACTED will retain that data for 12 months after the application process has completed. After 12 months the personal data relating to the application will be deleted from our systems however some of your personal details may still be retained in order for us to achieve the purpose as described above.

If you are engaged to provide services to REDACTED or to an REDACTED client, REDACTED will need to hold your personal data for the length of any assignment and for as long thereafter as may be required to ensure compliance with statutory and other obligations. Typically this is 7 years after the point that your last assignment ends, however in some limited circumstances this may be longer.

A description of your rights

You have a right to request a copy of the information that we hold about you. If you would like a copy of some or all of the personal data we hold about you, please email or write to us at the addresses set out below.

We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove data that you think is inaccurate.

You have a right to request that we restrict processing, to object to decisions made by automated means, and also to ask us to provide the personal data that we hold in a machine readable format for the purposes of transferring it to another organisation at your request.

You may request the removal of your personal data from REDACTED' systems at any time by emailing REDACTED with "Remove my Details" in the subject title. We may not always be able to comply with your request immediately - for example, if we need to retain your personal data for a certain period of time for legal reasons, or for the purposes of defending a legal claim.

You also have a right to make a data protection complaint to the Information Commissioner in the UK if you think we are mishandling your personal data.

Who does REDACTED share your personal data with?

In order to process your application (and, if successful, manage your assignment), we may need to pass your information to other REDACTED companies, to REDACTED clients and REDACTED' nominated suppliers for progressing the Purposes described above. These could include REDACTED technology providers, insurance companies, credit checking agencies, third party screening providers, payroll providers, and government bodies, as well as third parties that you provide us, such as your referees.

Your personal data will be mainly processed by REDACTED within the European Union but may also be transferred to and processed in countries outside of the European Union. In addition, any personal data provided by you may be stored on servers outside the European Union. Some overseas countries do not have data protection legislation equivalent to that in force in the European Union however in all circumstances where your personal data is transferred, it will be done so lawfully (for example on the basis of an organisation being signed up to the US Privacy Shield or having signed a EU approved model clause agreement). In all circumstances, wherever your personal data is stored and processed, it will be processed in accordance with all applicable laws including the General Data Protection Regulations.

Should you wish to get further information about the safeguards applied to the transfer of your personal data, please contact the REDACTED Privacy Office for more information at REDACTED.

How will REDACTED protect your personal data?

REDACTED operates an information security management system certified to the ISO 27001 standard. In some circumstances you may be issued logins or given access to systems in order to provide information securely, or to perform certain actions such as time recording.

You agree to immediately notify REDACTED of any unauthorised use of your user id and/or password. Any breach of the above which results in losses to either REDACTED or our Clients may result in legal action being taken against the individual concerned.

Changes to REDACTED' privacy policy

We keep our privacy policy under regular review. Any substantial changes to the way in which we process personal data will be notified by posting an announcement on our website.

How to contact REDACTED

Please contact us if you have any queries about our privacy policy or the information we hold about you.
You can reach us:

by sending an email to REDACTED; or
by writing to our Data Protection Officer at REDACTED

Declaration

You agree that the personal data which you provide to REDACTED is in all respects true and accurate and is not misleading or deceptive. You agree to inform REDACTED in writing if any of the data you have provided is no longer accurate during the period in which REDACTED retains your personal data.

[northernladuk]

Looks fair enough to me.

[man]

Thanks. I've realised that what I interpreted as vague wording was actually my own misreading of clause c) as I missed the word 'supplier' when I read it originally. Good job I'm not a lawyer!