Job applicant privacy notice

Introduction

This Privacy Notice provides guidance and information to job candidates/applicants
(collectively “Applicants”) who apply for positions of employment with the Competition and Consumer Protection Commission (“CCPC”) regarding the processing of Applicant personal data by the CCPC.

The CCPC (“us“, “we” or “our“) is committed to protecting and respecting your privacy. This Privacy Notice sets out the basis on which any personal data we collect from you or that you provide to us in connection with your job application will be processed by us. Please read this Privacy Notice carefully to understand our treatment and use of personal data.

In this Privacy Notice, references to “you” means the person whose personal information we collect, use and process.

We will use your personal data only for the purposes and in the manner outlined below, which describes the steps we take to ensure the processing of your personal data is in compliance with the Data Protection Acts 1988 to 2018 (as amended) and any subsequent data protection and privacy legislation, European Union law including Regulation (EU) 2016/679 (known as the General Data Protection Regulation or GDPR) and any subsequent amendments (collectively referred to as “Data Protection Legislation”).

Please note that by submitting a job application to the CCPC, you acknowledge that you have read, understood and agree to this Privacy Notice.

We seek to maintain the privacy, accuracy, and confidentiality of data (including your personal data) that we obtain during the job application process.

Identity of the controller of personal information

For the purposes of Data Protection Legislation, the data controller is the CCPC, an
independent statutory body with a mandate to enforce competition and consumer protection law in Ireland which has its address at Bloom House, Railway Street, Dublin 1, D01 C576.

Contact details of the the data protection officer

The contact details of the CCPC’s Data Protection Officer are as follows:
Email Address: dataprotection@ccpc.ie
Address: Bloom House, Railway Street, Dublin 1, D01 C576.

When does this privacy notice apply

This Privacy Notice applies to personal information that we collect, use and otherwise process about you in connection with the job application process.

Processing of your personal data

How and why do we process your personal data?

The CCPC will process your personal data for job recruiting and placement purposes, including notification of future job opportunities, human resources analysis and, for successful candidates, employment purposes. The personal data we process, the basis of processing and the purposes of processing are detailed below. Sometimes, these activities are carried out by third parties (see “Sharing of Personal Data” section below).

We encourage you to supply only the information you are comfortable with. In particular, special categories of personal data should only be provided when you have been specifically requested to do so. Special categories of data could include data revealing: racial or ethnic origin, political opinions, religious or philosophical beliefs, religious, party or trade-union membership, as well as data concerning health, genetic code, addictions or sex life and data relating to convictions, decisions on penalty, fines and other decisions issued in court or administrative proceedings.

Personal data Basis of processing Purpose of p0rocessing
• identification data, including
first name and surname, internal ID number;
• contact information,
including home address, phone/mobile/fax number, email address;
• gender, date of birth,
citizenship;
• data regarding responses to
screening questions;
• previous employment
information, including date of hire, job title, department and business unit, work
location, work status (full time, part time), data pertaining to work
preferences and abilities;
• resume/CV, including
education, past work
experience and references;
• information on certain health conditions only when relevant for the fulfilment of the job application to the
CCPC.
It is necessary to take
steps for entering into a
contract with you or for
the performance of our
contract with you.
This is required to enable the CCPC to administer the recruiting process, including the set-up of an electronic job applicant HR file,
managing your application, organizing interviews, including notification of  future job opportunities.
Consent Retention of your personal data so that we may contact you in case of future job vacancies.

Where does the CCPC obtain my data from?

Most of the personal data we process is obtained from you when you submit a job application to the CCPC but we also obtain personal data about you in the course of the application process (for example, during interviews or in general correspondence). Other types of personal data may be obtained from third parties, including, for example, recruitment agencies or referees.

In some circumstances, we may request your explicit consent to process (specific types of)
personal data. In these circumstances, you are able to withdraw your consent at any time by following the instructions provided when you gave consent or at the contact details below.

Sharing of personal data

Internally within the CCPC

Your personal data will be held by the CCPC’s Organisation Development Unit. Your personal data will only be shared with the Members of the CCPC and with persons in other Divisions of the CCPC in certain circumstances and where lawful to do so, i.e. it may be necessary to share your personal data with limited members of the CCPC’s Finance Unit or IT Unit, or with CCPC staff who are members of relevant interview boards. We may also share your personal data with external members of interview boards, as appropriate. Senior CCPC staff members may access and otherwise process your personal data in connection with their job responsibilities. The CCPC takes appropriate steps to ensure that such staff are bound to
duties of confidentiality with respect to your personal data.

Service Providers

We use third party service providers who provide technical and support services in connection with the application and recruitment process. In providing the services, your personal data will, where applicable, be processed by the service provider on our behalf. For example, the CCPC may use the Public Appointments Service or our own external recruitment services provider to assist in the recruitment process.

We will check any third party that we use to ensure that they provide sufficient guarantees
regarding the confidentiality and security of your personal data. We will have written
contracts with them which provide assurances regarding the protections that they will give to your personal data and their compliance with our data security standards and international transfer restrictions.

Transfers outside the European economic area

Your personal information may be transferred, stored and processed in one or more countries outside the European Economic Area (“EEA”), for example, when one of our service providers use employees or equipment based outside the EEA. For transfers of your personal data to third parties outside of the EEA, we take additional steps in line with Data Protection Legislation. We will put in place adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights, e.g. we will establish an adequate level of data protection through EU Standard Contractual Clauses based on the EU Commission’s model clauses.

If you would like to see a copy of any relevant provisions, please contact the CCPC’s Data
Protection Officer (see “Contact Us” section below).

How is my personal data secured

The CCPC operates and uses appropriate technical and physical security measures to protect your personal data.

We have in particular taken appropriate security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in connection with your job application.

Access is only granted on a need-to-know basis to those people whose roles require them to process your personal data. In addition, our service providers are selected carefully to ensure they have an appropriate level of technical, organisational and security measures.

Storage of my personal data

If your application for employment is successful and you commence employment with the
CCPC, your personal data will be transferred to an individual personnel file held by the CCPC’s Organisation Development Unit and will be processed for employment purposes in accordance with our internal rules for processing employee personal data. In such cases, your job application data (i.e. relating to the period up to the point of recruitment) will be kept on your recruitment file and will not be transferred to your individual personnel file.

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. If you would like further information about our data retention practices you can ask for this at any time (see “Contact Us” section below).

Your rights

Your rights under Data Protection Legislation may include the following (where applicable):

Your right What  does it mean? How do I execute this right? Conditions          to exercise?
Right of access Subject to certain conditions, you are entitled to have access to your personal data which we hold(this is more commonly known as submitting a “data subject access request”). Request for such information should be made in writing to  dataprotection@ccpc.ie. If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations. We must be able to verify your identity. Your request may not affect the rights and freedoms of others, e.g. privacy and confidentiality rights of other individuals and/or businesses.
Right of data portability Subject to certain
conditions, you are
entitled to receive
the data which you
have provided to us and which is
processed by us by
automated means, in a commonly-used
machine readable
format.
Requests should be
made in writing to
dataprotection@ccpc.ie.
If possible, you should
specify the type of
information you would
like to receive to
ensure that our
disclosure is meeting
your expectations.
The GDPR does not establish a general right to data portability. This right only applies if the processing is based on your
consent or on our
contract with you
and when the
processing is carried out by automated means (e.g. not for paper records). It affects only personal data that was “provided” by you. Therefore, it does not, as a rule, apply to personal data
that was created by the CCPC or
supplied to the
CCPC by any other individual and/or business.
Rights in relation to
inaccurate personal
or incomplete data
You may challenge
the accuracy or completeness of personal data which
we process about
you. If it is found that personal data is inaccurate, you are entitled to have the
inaccurate data removed, corrected
or completed, as appropriate.
We encourage you to
notify us of any
changes regarding your
personal data as soon
as they occur, including
changes to your
contact details.
Requests should be
made in writing to
dataprotection@ccpc.ie.
This right only
applies to your own personal data. When
exercising this right, please be as specific as possible.
Right to object to or restrict our data
processing
Subject to certain
conditions, you have
the right to object to
or ask us to restrict
the processing of
your personal data.
Requests should be
made in writing to
dataprotection@ccpc.ie.
This right applies
only if the
processing of your
personal data is
necessary for the
performance of a
task carried out in the public interest (see “basis of
processing” above). Objections must be based on grounds
relating to your
particular situation.
They must not be generic so that we
can demonstrate
that there are still
lawful grounds for us to process your personal data.
Right to have
personal data
erased
Subject to certain
conditions, you are
entitled, on certain
grounds, to have your personal data
erased (also known
as the “right to be
forgotten”) e.g. where you think
that the information
we are processing is
inaccurate, or the
processing is
unlawful.
Requests should be
made in writing to
dataprotection@ccpc.ie.
There are various
lawful reasons why we may not be in a position to erase your personal data.
This may apply (i) where we have to comply with a legal obligation, (ii) in
case of bringing
legal proceedings
(including any legal proceedings relating to an investigation
conducted by the
CCPC which are not brought directly by the CCPC) or
defending legal
proceedings, or (iii) where retention
periods apply by law or under the CCPC’s internal data retention policies.
Right to withdrawal You have the right
to withdraw your
consent to any
processing for which
you have previously
given that consent.
Requests should be
made in writing to
dataprotection@ccpc.ie.
If you withdraw
your consent, this
will only take effect
for the future.

Your right to lodge a complaint with a supervisory authority

If you are unhappy about any aspect of the way we collect, share or use your personal data,
please let us know using the contact details below.

You also have a right to complain to the Data Protection Commission by post to 21 Fitzwilliam Square South, Dublin 2, D02 RD28; and/or by telephone at 1800 437 737/01 765 0100; and/or by using the webform available on the website www.dataprotection.ie.

Changes to this information

We may decide to make changes to this Privacy Notice. If the change is indicative of a
fundamental change to the nature of the processing (e.g. enlargement of the categories of
recipients or introduction of transfers to a third country) or a change which may not be
fundamental in terms of the processing operation but which may be relevant to and impact
upon you, then the updated Privacy Notice will be provided to you well in advance of the
change actually taking effect.

We will post the changes on our website or send them to you via e-mail so that you will be
aware of the changes. When notifying you of such changes, we will also explain what the
likely impact of those changes will be to you, if any. In order to ensure fairness of the
processing, we encourage you to review the content of this Privacy Notice regularly.

Contact us

For further information or if you have any questions or queries about this Privacy Notice,
please contact the CCPC’s Data Protection Officer, at dataprotection@ccpc.ie or alternatively you can write to us at Data Protection Officer, Competition and Consumer Protection Commission, Bloom House, Railway Street, Dublin 1, D01 C576.