HSE Privacy Notice Candidates in recruitment process with National Recruitment Services (NRS)

Purpose

The Health Service Executive (HSE) and the HSE National Recruitment Service (NRS) as the data controller must comply with all applicable data protection, privacy and security laws and regulations in the locations in which we operate. We respect your rights to privacy and to the protection of your personal information. The purpose of this privacy notice is to explain how we collect and use personal information pursuant to your candidate application in the recruitment process within the HSE NRS.

The information we process

In order for us to fulfil our obligations as a recruiter it is necessary for the HSE to collect and process various categories of personal information about you.

Only relevant data is recorded.

Data that is necessary to:

• identify you
• verify your education
• verify your employment history
• contact you

Types of information we collect

Personal data means any information relating to you which allows the HSE to identify you. Data such as, your name, address, contact phone numbers and e-mail address.

The HSE will collect the following personal information about you:

• personal details about you, such as name, date of birth, address and PPSN number
• contact details for you - address, phone number and email address
• relevant information pursuant to your application - education and employer history and verification document pursuant to same
• documentation to support your application - passport, birth cert , proof of address as a way to confirm identity
• nationality to establish your right to work in Ireland (The Employment Permits Acts 2003 to 2014)

We may also process certain special categories of information, which may include racial or ethnic origin. If this is collected, it will be used for statistical purposes and will in no way be used in the recruitment activity itself.

How we obtain your information

We may obtain your information from a variety of sources, including:

• information you provide to us through applying for a campaign
• information you provide to us by registering your interest in working for the HSE
• information from third parties, for example your former employers via a reference for which we obtain your consent (where your former employer is the HSE we reserve the right to obtain a reference without consent)
• recruitment agencies with whom the HSE engage to carry out recruitment services on behalf of the HSE

Why we process your information

Your information may be used to perform a range of activities associated with the recruitment process in the HSE, such as:

• communication with you throughout the various stages of the recruitment process via email, SMS messages, phone or post mail
• sharing relevant information with essential parties in the recruitment process such as interview boards

Should you be successful in your application your information will be used to prepare your contract of employment

The HSE provides statistical information to other organisations such as the Department of Health, Universities and other research institutions. The HSE will make sure that you cannot be identified by anonymising the information. If it is not possible to anonymise the information, you will be contacted for your consent.

Who can access your data

Data will only be shared on a strict need-to-know basis for specified purposes relating to recruitment and appointment to positions within the HSE.

It may only be accessed by:

• HSE NRS staff involved in NRS recruitment
• Independent Chairpersons who are involved in the recruitment process
• HSR HR staff for successful candidates who progress to employees
• HSE HR staff in the event of panels passed to local HR teams for management

How your information will be kept secure

We are committed to ensuring that your information is secure with us and with the third parties who act on our behalf. We have a number of security precautions in place to prevent the loss, misuse or alteration of your information. All staff working for the HSE have a legal duty to keep information about you confidential. All staff are trained in information security and confidentiality.

The HSE has strict information security policies and procedures in place to ensure that information about you is safe, whether it is held in paper or electronic format.

Legal basis for processing

The HSE’s lawful basis under the General Data Protection Regulation (GDPR) for processing personal data in relation to NRS recruitment is as follows:

• the processing of personal data is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6.1(e) GDPR)
• where an applicant is successful and becomes an employee, the lawful basis relied on for processing would be processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6.1(b) GDPR)

The processing of special category data is necessary:

• For the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems on the basis of Union or Member State Law or pursuant to contract with a health professional and subject to conditions and safeguards (Article 9.2(h) GDPR)

Retention period

We will only retain information for as long as necessary. Recruitment records are maintained in line with the recommendations of the HSE retention policy.

Your rights

You have certain legal rights concerning your information and the manner in which we process it.

This includes, a right to:

• get access to your personal information
• request us to correct inaccurate information, or update incomplete information
• request that we restrict the processing of your information in certain circumstances
• request the deletion of personal information
• receive the personal information you provided to us in portable format
• object to us processing your personal information in certain circumstances
• lodge a complaint with the data protection commission

Get access to your personal information

You can access your personal records by making a subject access request (SAR). It is also sufficient to write to the HSE National Data Protection Office. It is important that you provide satisfactory evidence of identification and a sufficient description of the data that you are looking for.

Forms are available for this purpose at General Data Protection Regulation (GDPR).

Request us to correct inaccurate information or update incomplete information

Refer to campaign documentation (ACI) supplied at advertising.

Please note that the right to correct inaccurate information or update incomplete information does not apply to campaign application information (Employment / Education History and competencies). This is due to the nature of the applicants having a defined timeframe to provide information for assessment.

To request rectification of personal information that HSE NRS hold on you for all or specific applications made, please contact NRS.

Email asknrs@hse.ie and request a Right to rectification/erasure form.

Request that we restrict the processing of your information in certain circumstances

Refer to campaign documentation (ACI) supplied at advertising.

Request the deletion of personal information

Refer to campaign documentation (ACI) supplied at advertising to delete personal information in relation to a specific recruitment campaign.

To request deletion of all personal information that HSE NRS hold on you for all or specific applications made please contact NRS by email on asknrs@hse.ie and request a right to rectification/erasure form.

Receive the personal information you provided to us in portable format

Refer to campaign documentation (ACI) supplied at advertising.

Object to us processing your personal information in certain circumstances

Refer to campaign documentation (ACI) supplied at advertising.

Lodge a complaint with the data protection commission

Lodge a complaint through the Data Protection Commision.

Sharing with third parties

We may also be receiving services from, or providing information to:

• recruitment service providers outside of the HSE
• recruitment support partners external to HSE
• independent interview chairpersons working on behalf of HSE NRS
• statutory bodies, for example CPSA ( Commission for Public Service Appointments), WRC ( Workplace Relations Commission)
• professional bodies

In order to assist in this process, we may:

• need to share your personal information with those providers
• receive your personal information from those providers

We are careful only to share the information that is necessary for this purpose.

Examples of when we share information with statutory bodies:

• CPSA /WRC in the event of an appeal by a candidate in the recruitment process. This information would be required to enable such bodies to make a decision on such an appeal
• CORU on foot of a summons invoking powers under the Health and Social Care Act 2005 in relation to professional conduct

Anyone who receives this information is also bound by confidentiality and the data protection laws.

Contact

You can contact us:

• if you have any queries in relation to data protection or other issues around the security of your personal information
• for more information about the steps we are taking to protect your information
• for more information about your rights, including the circumstances in which you can exercise them and how to exercise them
• if you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. We hope that we can address any concerns you may have.

Contact details

Phone: 01-6352478
Email: dpo@hse.ie

Dr Steevens Hospital
Steevens Lane
Dublin 8
D08 E2CV