Candidate Privacy Statement

Data Controller - Public Appointments Service (PAS), Chapter House, 26-30 Abbey Street Upper, Dublin 2

Data Protection Officer - Contact at DPO@publicjobs.ie

Legal Basis for Processing Data

The Data Protection Act 2018 provides that the processing of personal data shall be lawful where such processing is necessary for the performance of a statutory function of a controller. PAS is mandated by statuteⁱ to act as the centralised assessment and selection body for the civil service and to carry out all the procedures necessary to undertake the recruitment, assessment and selection of suitable candidates for appointment, therefore, the processing of personal data necessary for this purpose is lawful as Article 6(1) (e) of the General Data Protection Regulation (GDPR) and Section 71 (2) (a) of the Data Protection Act 2018 apply.

The Data Protection Act 2018 also provides a legal basis for the processing of "special categories" of personal data for the performance of a function conferred by or under an enactment. The information collected from applicants that falls within the "special categories" of personal data set out in Article 9 of the GDPR will be subject to a range of more stringent measures designed to safeguard the fundamental rights and freedoms of data subjects. This range of measures includes: obtaining the explicit consent of the data subject, pseudonymisation of data where possible, and includes strict time limits for the erasure of relevant personal data once the legal basis for processing that data has expired. The processing of any such data will be necessary, proportionate and undertaken in accordance with the principles of data protection with a particular focus on data minimisation. The specifics of the data collected by PAS which are included in the "special categories" of personal data and the processing thereof are explained further in the Code of Practice for the Protection of Personal Data, available at https://www.publicjobs.ie/documents/data-protection/Code-of-Practice-for-the-Protection-of-Personal-Data-in-the-Public-Appointments-Service.pdf.

Categories of Personal Data Concerned

Personal data is collected on all candidates for competitions run by PAS in order to process their applications. This information is used by the relevant recruitment unit to run a recruitment and selection competition from application up to appointment in the case of a successful candidate. The data is collected primarily by means of an application form. This application is used to assess eligibility for a particular competition; determine preferences in relation to the location (if applicable); determine whether the candidate meets the shortlisting criteria (if applicable); and to aid the selection board in the interview/assessment situation (should the candidate be called to this stage). Information which is required to be provided by candidates as part of the application process includes their relevant qualifications and experience, and examples of the competencies required for the particular post; it also includes their name, address, contact details, and date of birth; (the date of birth is not shared with selection board members).

Other data collected is required to confirm that the candidate meets the essential requirements for the competition and for background checks conducted at clearance and assignments stage to ensure the person is suitable for appointment in respect of character and that he or she is fully competent to undertake, and fully capable of undertaking, the duties attached to the position. Data collected at clearance and assignment stage from those candidates under consideration for a position includes security checks and/or Garda vetting; employment or other references; health and medical information; health and character declaration; copies of relevant qualifications; proof of identification; workplace accommodation form (if such accommodations are required); drivers licence (if essential); and reports from the Chief Medical Officer (CMO) (if required).

Candidates may also be asked to provide equality monitoring information on a voluntary basis; this is used to ensure that our assessment processes are fair to all groups covered by the Equality legislation and processed only in line with our obligations for processing "special categories" of data.

PAS only keeps data for purposes which are specific, lawful and clearly stated. Personal data will only be processed in a manner compatible with the stated purpose and information collected from candidates will only be used in order to process their application for a specified competition.

Regular audits are conducted on all personal information collected from all sources. This establishes that there continues to be sound, clear and legitimate purposes for collecting all of the information currently collected. These audits are conducted on an ongoing basis by a nominated staff member for the Data Protection Officer. The findings are reviewed by the Risk Management Group, who report to the Management Board.

All data is obtained and processed in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018; PPSN are only requested where required in order to support the provision of a public service to a customer (i.e. for recruitment and selection purposes).

Information on Cookies is provided in a separate statement on the Data Protection page of publicjobs.ie, available at https://www.publicjobs.ie/documents/data-protection/Code-of-Practice-for-the-Protection-of-Personal-Data-in-the-Public-Appointments-Service.pdf.

Recipients or Categories of Recipients

Examples of legitimate disclosures specific to PAS are listed below:

Information on candidates who are being offered appointment is provided to the client organisation (this includes contact details and information in relation to the candidate's qualifications/experience for the post);
Material is provided to the Chief State Solicitor and any of their legal advisers, and to the Workplace Relations Commission (or other appropriate body) as required in the event of a case being taken against PAS;
National Archives disclosures are set out in the Code of Practice for the Protection of Personal Data;
Certain data is disclosed to assessment providers who carry out some of the assessments run by PAS; only the minimum amount of personal data is disclosed to allow them to fulfil their functions as data processors (name, email address and PAS candidate identification number);
Where a candidate requests a review by the Commission for Public Service Appointments in relation to an alleged breach of the Code, or appeals a decision under the Freedom of Information Act to the Information Commissioner, the information requested by these bodies is provided to them in order for them to respond to the candidate's request for a review;
PAS use external selection board members/assessors/invigilators and these board members/assessors/invigilators may receive, or have access to, candidate application data in order to assist in the determination of suitability for a specific role; selection board members/assessors/invigilators have a duty to keep such information confidential and secure;
Information is provided to the CMO where PAS has concerns in relation to a candidate's suitability for appointment on health related grounds (as the CMO provides the occupational health service for PAS);
Some organisations (which are involved with the security of the state) may require that candidates assigned to them have additional security clearance conducted; the names and addresses of those candidates are sent to the relevant client organisation for processing.
Non Consultant Hospital Doctors' applications are collected for the HSE through our recruitment application;
The results of State Board's assessment processes are sent to the appropriate Department in order for the Minister to make a decision.

Period for which personal data will be retained

The Record Retention Schedule (available at https://www.publicjobs.ie/documents/data-protection/Records-Retention-Schedule.pdf ) sets out the retention period for all items of personal data kept. Necessary approval has been sought from the Director of the National Archives to destroy electronic and physical records.

Some data in relation to testing (test scores) are anonymised and retained for research, validation and statistical purposes. The minimum amount of data is retained for the shortest period possible, as set out in the Records Retention Schedule.

A record of candidate participation in a competition may be retained for archiving purposes.

Your responsibility

You can update your own profile at any stage and should do so as your circumstances change.

Subject Access Requests

PAS is aware of its obligations as a data controller with primary responsibility for, and a duty of care towards, the personal data within its control. Our obligations are set out in the GDPR and associated implementing and supplementary legislation in Ireland (Data Protection Act 2018).

Data subjects whose personal data is held by PAS are entitled to ask PAS and receive confirmation as to whether or not personal data concerning them is being processed. Where that is the case, data subjects are entitled to access the personal data as well as certain information in relation the processing of that data.

The subject access request should be made in writing, and should include sufficient information to identify the data subject to our reasonable satisfaction so we can verify that we are not releasing your data to someone who is impersonating you. When the criteria are satisfied, we will be in a position to commence the work involved in responding to your request. PAS will strive to respond as quickly as possible and in any event without undue delay, but if we have not been able to complete our work in that regard within one calendar month we will update you as to the progress of our response to your request. The Subject Access Request Form is available on the Data Protection page of publicjobs.ie at https://www.publicjobs.ie/en/data-protection.

PAS will provide the data subject with any relevant data in response to a subject access request in electronic format. If you do not wish to receive our response to your request by email, please let us know in advance. Once our response to your subject access request has been finalised, we will make a full copy of the material to be retained for our own reference. These records will be used as a reference should there be any dispute as to the content or timeliness of our response provided to you. It will be retained for seven years.

Any individual may apply at any stage (to the Data Protection Officer) to have any personal information held by PAS updated or corrected (if the individual believes that any information held is incorrect/incomplete).

ⁱ Public Service Management (Recruitment and Appointments) Act 2004 (2004 Act), Section 34