Candidate Privacy Notice
Social Security Scotland
December 2021
As part of any recruitment process, Scottish Government and associated public bodies collects and processes personal data relating to job applicants and applicants for public appointments.
This privacy notice explains how we collect, use and store your personal information in the context of applying for employment or a public appointment and for use in our recruitment processes. It also sets out the situations where we may share your personal data. The privacy notice also explains your rights and how to contact us.
We may collect, process and store different personal data from you depending on what stage you are at in the recruitment process and whether you are applying for employment or you are applying for a public appointment.
The personal data we may collect from you includes:
- contact details such as name, title, addresses, telephone numbers, and personal email addresses
- copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills
- evidence of how you meet the requirements of the role, including CVs and references
- evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks
- evidence of your right to work in the UK and immigration status
- diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’
- information about your health, including any medical needs or conditions
- other information required for some applications, for example verification of qualifications
- if you contact us regarding your application, a record of that correspondence
- details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies
- the status of your application and updates on how it moves forward
- Our lawful basis for using your data
We process personal data throughout the application on different lawful bases.
For Employment and Public Appointments:
Contract Processing your data is necessary to move your application forward before signing a contract of work. This concerns employment or pre-employment checks.
Legal obligation The law requires Scottish Government to check that candidates are entitled to work in the UK.
Public task When we carry out National Security vetting for some roles, we have to process personal data to perform a task that’s in the public interest or in the exercise of our official authority.
Processing criminal convictions and sensitive information We collect, use and hold sensitive information such as criminal convictions on the lawful bases of contract, legal obligation and public task.
Public Task When the selection panel requires to discuss with you any issues raised concerning conflicts of interest and time commitment. Processing your data is necessary to check your identity and credentials prior to taking up a public appointment
Legal obligation For anonymised reporting in line with the Equality Act 2010 and reporting to the Ethical Standards Commissioner
For the appointment letter Processing your data will be necessary to provide you with the terms of appointment.
- Processing special category data
Personal data is defined as ‘special category’ when it reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It includes:
- data concerning health
- data concerning someone’s sex life or sexual orientation
We process this data when it’s necessary for reasons of substantial public interest for the exercise of our functions. This applies to information about criminal convictions, allegations and offences during baseline security clearance checks.
- Why we need your data
We need your data in order to:
- move your application forward
- check that you’re the right candidate for the role
- get in contact with you
- send you notifications for vacancy roles or job or public appointment alerts
- How your personal information is collected
We usually collect your personal information when you enter it in iCIMS. We might also collect information from third parties.
These include:
- former employers and people named by candidates as references
- Disclosure Scotland
- Employment Reserve lists
We maintain a reserve list of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your consent to be added to this list. We will refer to the list when other roles are advertised and will contact you if you match the role. We will ask for your consent before putting you forward for the role.
- Data sharing
Personal information you provide in the recruitment process will be made available to Scottish Government and our additional data processors, Capita and Amiqus. The following information will be shared with our additional data processors depending on their role:
- contact details such as name, title, addresses, telephone numbers, and personal email addresses
- copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills
- evidence of how you meet the requirements of the role, including CVs and references
- evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks
- evidence of your right to work in the UK and immigration status
- other information required for some applications, for example verification of qualifications
- if you contact us regarding your application, a record of that correspondence
- details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies
- the status of your application and updates on how it moves forward
If you are successfully recruited for employment or a public appointment, we will upload your details to our HR system.
Employees will sign a contract of employment and agree to additional terms on how your data is handled and stored.
We will also share your data for statistical analysis (it will be anonymised first) if we are required to do so by law – for example, for public interest, by court order, or to prevent fraud or other crime.
Where Scottish Government is managing the recruitment of employees or of public appointees on behalf of a public body or, we will share your information with that public body, who will be the data controller.
- Transferring information to iCIMS outside the UK
Our data processor, iCIMS, is based outside the UK, so your data might be transferred and stored securely outside the UK however will remain within the EU. Where that is the case it will be protected through the use of Model Contract Clauses. The following information will be shared with iCIMS:
- contact details such as name, title, addresses, telephone numbers, and personal email addresses
- evidence of how you meet the requirements of the role, including CVs and references
- evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks
- other information required for some applications, for example verification of qualifications
- if you contact us regarding your application, a record of that correspondence
- details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies
- the status of your application and updates on how it moves forward
- Data security
We have put in place measures to protect the security of your information.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we only give access to your personal information to those employees, agents, contractors and other third parties are involved in the recruitment process.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
- Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for - including legal, accounting, or reporting requirements.
This will depend on:
- the amount, nature, and sensitivity of the personal data
- the potential risk of harm from unauthorised use or disclosure of your personal data
- the purposes for which we process it
- whether we can achieve those purposes in other ways
For recruitment to employment the retention period for documents supporting recruitment, application and sifting the retention period is 2 years.
For recruitment to public appointments the retention period for documents supporting the public appointments process is 5 years.
If you are unsuccessful, personally identifiable data is removed 2 years after your most recent application. You can request the deletion of your personal information by contacting us at recruitment@socialsecurity.gov.scot.
- Your rights
You have the right to:
- request access to your personal information (known as a ‘data subject access request’) - you’ll receive a copy of the personal information we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format
- request that we correct incomplete or inaccurate personal information that we hold about you
- request we delete or remove your personal information - you can do this when there is no good reason for us to keep it - you can ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
- withdraw your consent for any data processed under the lawful basis of consent (see below)
- object to the processing of your personal information where we are relying on the legal basis that we are carrying out our public task (see legal bases above)
- request we restrict the processing of your personal information - you can ask us to stop processing your personal information, for example if you want us to establish its accuracy or the reason for processing it
To make any of these requests or to ask us to transfer a copy of your personal information to another party, contact the Social Security Resourcing team at recruitment@socialsecurity.gov.scot. Please note that these rights are not absolute and will be processed on a case by case basis.
- Accessing your data
You will not have to pay a fee to access your personal information or to exercise any of the other rights. However, if your request for access is clearly unfounded or excessive we may refuse the request.
In some cases we will need some information to confirm your identity. This is to ensure that your personal information is not disclosed to someone who has no right to access it.
- Questions and complaints
If you have concerns about the way we process and handle your personal information, in the first instance you should raise your concerns to the People Directorate:
Resourcing Team
People Directorate
Scottish Government
Saughton House
Broomhouse Drive
Edinburgh
EH11 3XD
If you are not satisfied with the response, you can escalate to Scottish Government Data Protection Officer by email to DataProtectionOfficer@gov.scot
If you are not satisfied with the response or believe we are not processing your personal data in accordance with the law you may make a complaint to the Information Commissioner’s Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
- Changes to this privacy notice
We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to let you know.
14. National Fraud Initiative in Scotland
National Fraud Initiative in Scotland: Privacy notice (audit-scotland.gov.uk)