DWP Recruitment Privacy Notice

1. Data Controller

The Department for Work and Pensions (DWP) is the controller for any personal data processed by Shared Services Connected Ltd (SSCL).

Name: Department for Work and Pensions

Address: Caxton House | 6-12 Tothill Street | London | SW1H 9NA

Email: data.protection@dwp.gov.uk

1.b) Data Processor

Name: Shared Services Connected Ltd (SSCL)

Email: dataprotection@sscl.com

1.c) Sub Processor

Name: Tazio

Email: privacy@tazio.co.uk

Oleeo – for processing recruitment applications.

Trust ID – for digital ID and Right to Work Checks (where the candidate has the relevant documents and is eligible to use the service) if not a face-to-face check is carried out.

Ucheck – for DBS checks

Meet and Engage – chat bot/ live chat available for candidates.

2. Data Protection Officer

DWP’s Data Protection Officer is Dominic Hartley. You can contact him at: Data.ProtectionOfficer@DWP.GOV.UK

Address:
Caxton House
6-12 Tothill Street,
Westminster
London
SW1H 9NA

The DWP Data Protection Officer’s team manages the data protection compliance and can be contacted at the above address.

3. Why do we use personal data?

Data is gathered to enable DWP to progress successful applications for vacancies and is essential to ensure that the applicants are who they say they are and that they can work in the UK and in the UK Civil Service. Only data from applicants will be gathered. Additional information about applicant family members will only be gathered at pre-employment check stage to confirm dependents and specifically for the financial check to confirm if the applicant has children.

Data is gathered to highlight if our recruitment approach is having or has had an adverse impact on applicants from protected groups such as Disabled, Black, Asian and Minority Ethic, age etc. This data will be used generally to support improvements in processes for future campaigns, individuals will not be specifically identified as part of this data analysis.

DWP will ensure that we comply with Data Protection law ensuring we use it lawfully, fairly and in a transparent way. The personal information we hold about candidates must be:

Used lawfully, fairly and in a transparent way.

• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept and destroyed securely.

4. What information do we collect about you?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

DWP collects personal data from a range of sources during the recruitment process.

• Information provided by the applicant through an application form (when submitted) via Oleeo, or via a paper form for applicants requiring a reasonable adjustment.
• Information provided by the applicant through the Tazio hosting platform for pre-recorded video interviews and the Situational Judgement Test and through Oleeo platform for the management of vacancies, application submission and progression of applicants through the recruitment process.
• Onboarding information through an e-form in Oleeo.
• Pre-employment checks (Trust ID for Digital identity and right to work in the UK and UK Civil Service – if not a face to face check is carried out), criminal record, health, employment history) data gathered through Ucheck, DBS/Disclosure Scotland, Equifax, OH Assist, ACRO and HMRC to support Pre-employment check validation.
• From references obtained from people who you list as referees.
• From complaints or queries you make about the recruitment process.

General browsing data is also gathered via Google Analytics on microsite usage – source of entry to site, length of time on site, number of pages viewed, new or returning user.

Occasionally we may contact you to take part in online surveys hosted on our third-party research partner’s platform. This will allow us to capture feedback on your experience. In these circumstances personal information is only collected with the explicit consent of respondents and will only be stored if necessary. This is not used as part of the decision making in relation to your application process.

The personal data we collect, and use will include personal data and special category personal data.

Types of personal data we process may include information such as.

• personal details such as name
• contact information including address, E-mail Address, Telephone number.
• date of birth
• video and audio content, as part of the pre-recorded video interview
• question responses
• employment details
• Information relating to education, work experience, preferences, and interests.

Special category personal data may include:

• racial or ethnic origin
• political opinions
• religious beliefs, or those of a similar nature
• trade union membership
• genetic data
• data concerning a natural person’s sex life or sexual orientation.
• biometric data for the purpose of uniquely identifying a natural person.
• data concerning health.

The lawful basis for collecting this personal data is, depending upon the processing undertaken, ‘Public Task’ under Article 6(1)(e) UK GDPR, because it is necessary to enter into a contract under Article (6)(1)(b) UK GDPR or because you have consented to give your information under Article (6)(1)(a) UK GDPR.

When making their application, applicants can choose whether to share any data, or chose to prefer not to say. Article 9 (2) a and b provides further information.

However, details about health are also gathered as part of the pre-employment checks and applicants must provide information to enable their checks to be validated and passed/rejected.

All health data is held as restricted data and only specific users can view details to support decision making around checks.

DWP will only use the minimum amount of personal information necessary to carry out a particular activity.

5. Whose personal data do we handle?

Personal data is processed by DWP, SSCL and Tazio and is linked to applicants applying for vacancies advertised on Civil Service Jobs and the Microsite. We process information relating to applicants for these vacancies.

6. The Purposes for which we collect personal data

Gathering personal information is essential to the campaign as DWP must be able to confirm identity of successful applicants and their right to work in the UK and in the UK Civil Service. Access to personal data of applicants supports the prevention of fraudulent or duplicate applications and ensures the Department’s recruitment campaigns are in line with the Civil Service Recruitment Principles

• to enable DWP as the Data Controller to recruit into the relevant vacancies and measure effectiveness of the recruitment process.
• to enable DWP and SSCL to develop future recruitment campaigns and processes. We ask your consent to collect and process this data.
• for the management of vacancies, application submission and progression of applications through the selection process
• to request and manage references for successful applicants.
• to enable the onboarding of successful applicants, including the creation of their HR and payroll records on DWP systems
• to provide and agree an employment contract with successful applicants.
• to report on various aspects of the recruitment campaign as required by law e.g., equality of opportunity to people from protected groups such as Black and Minority Ethnic or Disabled applicants.
• to follow the Civil Service Recruitment Principles
• to make appropriate reasonable adjustments under the Equality Act 2010 for applicants with a disability, for example, we may need to know about health conditions to do this.
• to meet the specific requirements of the onboarding process for the Civil Service (Baseline Personnel Security Standard) and access to personal data such as criminal records is necessary under the condition of Employment, social security, and social protection. By completing the required checks at the onboarding stage of recruitment, DWP ensures new recruits who will have access to official information and assets will meet the required standards of propriety.

7. Asking for your consent to process personal data

DWP and SSCL may ask for your explicit consent to gather personal data to improve future recruitment campaigns and processes. By accepting cookies, applicants give DWP, as the Data Controller, consent to use their data as specified in the privacy notice and cookie declaration.

8. Information about criminal convictions

We will only collect information about criminal convictions or allegations of criminal behaviour where it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions/allegations as part of the recruitment process or if we are notified of such information directly by you in the course of you working for us.

9. How long do we keep personal data?

DWP currently must gather and retain records for up to 3 years regardless of whether applicants are successful or unsuccessful in the campaign in line with Civil Service Recruitment Principles.

Requests to exercise the right of erasure.

1) Where an applicant requests that their data be deleted under GDPR. In such scenarios cases are referred via SSCL Data Protection team to DWP as Data Controller and consideration given as to whether we can erase any personal information. You should be aware this right is not absolute.

In line with standard data retention

2) SSCL has a system in place to regularly review data sets and purge digital records as appropriate, action will be taken at close of the project to agree an appropriate timeframe for review and deletion of digital records with DWP. The project has been logged with SSCL Data Protection and Assurance team, captured on data registers and additional future dated reminders set for review.

10. Who will we share data with?

DWP is the Data Controller for the recruitment campaign and SSCL are the data processors.

SSCL are contracted to deliver the recruitment process on behalf of DWP and they are the “data processors” for this project. DWP will share personal data gathered from the recruitment process with SSCL to enable them to deliver contracted requirements.

SSCL provide a contact centre service and applicants can either telephone or email their query for action. In some cases, personal information may be shared through this route.

SSCL is contracted to deliver the recruitment process for DWP. The main system used is Oleeo which enables applicants to submit an application and progress through the stages of the process to onboarding as appropriate. Communications about each stage outcome are also managed through the system.

Tazio links directly with the Oleeo system and provides applicants’ recorded video interviews for assessment. Interview questions are recorded and applicants reaching this stage of the recruitment process are sent a link to access the questions and record their responses on the Tazio system.

Data gathered during the recruitment process e.g., interview recordings is critical to the recruitment campaign as without this data, DWP cannot assess suitability against agreed standards and fill the vacant roles.

Data will be used to validate successful applicants’ identity and Right to Work in the UK and UK Civil Service as well as confirming pre-employment checks are passed.

Contractual arrangements with SSCL confirm that the data may only be used for this campaign and all personal data is stored securely in the Oleeo portal. Oleeo users have access profiles, and these are strictly controlled to ensure that users only have access to profiles that are needed to undertake their role. Users access the system with a user identification and a password.

DWP access to this Oleeo information is tightly controlled and DWP users access the data through user profiles, user IDs and passwords. The DWP Recruitment Project is responsible for approving access to other DWP colleagues who require the information as part of their role i.e., DWP Diversity and Inclusion Team. All reports are password protected if downloads are required. Only general information will be shared, and individual applicants will not be identifiable in the data.

If the applicant is an internal member of DWP staff who is suspected of committing plagiarism, in line with standards of behaviour and DWP employee privacy notice, the interview recording will be shared with their manager. The manager will review the interview along with the supporting evidence of plagiarism. An independent decision maker will assess the level of misconduct and decide a discipline penalty.

11. How do we keep your data secure?

SSCL adhere to DWP retention schedule for recruitment records.

Personal data (employment contract, application including Diversity data, posting information, interview and panel scoring) is held and stored on secure servers, the majority within the Oleeo Portal which is UK based. Access to stored data is controlled by role and can only be accessed with user identification and password.

If your application reaches the on-boarding stage, some data is held on 3rd party secure servers as follows: -

BPSS – Ucheck, UKBA and ACRO (for fraud check)

Financial check – Equifax

Criminal Record – Ucheck and DBS

Health Check – OH Assist

Employee References and Counter signatory – HMRC

All 3rd party providers have appropriate IT security and Cyber Essentials in place.

All other data captured as part of the recruitment process will be held digitally within Oleeo and moved to secure online or paper storage facilities if retention is required beyond the end of the recruitment campaign.

Tazio, are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, they have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Our processors will not share personal outside of the United Kingdom (UK), there is no offshoring by service providers as all servers are based in the UK.

12. Is my data subject to automated decision making or profiling?

The recruitment process does not rely solely on automated decisions, the sift and interview stage are assessed by human intervention.

The Situational Judgement Test is an automated decision process although there is human involvement to confirm the pass mark for each vacancy.

The decision-making process is as follows:

Although the score for the Situational Judgement Test is an automated decision, there is human intervention to set the pass mark to ensure that there is minimal adverse impact on applicants from protected groups and that sufficient applicants are progressing through to the next stages.

SSCL and DWP recruiters confirm the specific pass mark for each vacancy, lowering this where required to ensure the flow of applicants is maintained and to minimise impact for protected groups, taking into account Disability Confident Scheme. All applicants who meet a lowered pass mark progress to sift stage not just applicants from a protected group.

SSCL recruiters manually confirm the pass mark for each vacancy in the Oleeo system, and the system sends automatic communications to all applicants linked to their outcome.

Any requests from individuals to have decisions made by automated means looked at again by human beings would be considered via the SSCL Contact Centre.

13. Your rights as a data subject

The Right of Access

This enables you to receive a copy of the personal information we hold about you and check that we are lawfully processing it and that it is accurate (commonly known as a Right of Access Request) Applicants may request to see all data DWP and service partners hold about them through a Right of Access Request. The Recruitment campaign has a process in place to ensure recruitment data is fed through to meet these requests.

Any Right of Access requests received will be forwarded to a single point of contact in DWP. Right of Access Requests received direct to the DWP Data Controller will also be forwarded direct to the Recruitment team for action.

To request a Right of Access, candidates will be required to contact the customer hub in the first instance on the details below. The customer hub will liaise with relevant team and then they will reach out to the candidate directly.

0345 241 5365 DWP-Customer_Hub@gov.sscl.com

The Right to Rectification

This enables you to have any incomplete or inaccurate information we hold about you corrected. Applicants are required to include personal details such as name, address etc. on their application form and more detail is gathered at the onboarding stage of the process.

If an applicant’s personal details are wrongly recorded on the Oleeo they should contact SSCL at 0345 241 5365

DWP-Customer_Hub@gov.sscl.com

https://uk.meetandengage.com/alfi93ipa

Should a change to personal information be required prior to an applicant starting in the organisation, the applicant should contact SSCL, as the processing organisation via their Contact Centre to alert them of the required change or speak to the local office who they have been dealing with to agree their start date. SSCL would amend information following confirmation in writing about the change.

After starting with DWP, the new recruit can request changes are made to their personal details via a service request or directly through Single Operating Platform (SOP).

The Right to Erasure

This enables you to ask us to delete or remove personal information where there is no lawful reason for us to continue to process it. Within the current General Data Protection Regulation (UK GDPR), right of erasure requests can only be upheld if personal data is no longer necessary in relation to the purposes for which it was collected or processed. Data processed under the lawful basis of public task, is not subject to the right of erasure.

Applicants may request Right of Erasure for any details held however DWP must retain data for applicants in line with DWP Retention schedule and to comply with the Civil Service Recruitment principles. These principles are in place to ensure recruitment is open, fair and without prejudice and DWP currently must retain records for up to 3 years regardless of whether applicants are successful or unsuccessful in the campaign therefore Right of Erasure is not possible in all cases.

Applicants who registered on the applicant hub but did not submit an application are able to have their data erased by contacting SSCL.

After no longer than a 3-year period, your personal data will be erased.

The Right to Restriction

This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

14. Cookies

A cookie is a small file which asks permission to be placed on your computer's hard drive. This site uses only cookies that are strictly necessary to providing the service.

Cookies are used on this website to improve user experience and for essential functionality; they are not used for identification purposes.

All Civil Service roles are advertised via Civil Service Jobs.

Cookies are in place on CS Jobs site and appear for approval/rejection on the applicant’s first interaction. Cookies are used to measure website usage and how it can be updated and improved, remember the notifications shown to applicants and remember applicants when they have logged in to enable the system to show their account and information relevant to them. CS Jobs cookies do not contain personally identifiable information.

CS Jobs and Jobs Help websites direct applicants through to the DWP microsite for more information and to apply.

Cookies are in place on the microsite on first interaction for approval or rejection to enable analysis of usage and support future marketing strategy. Information gathered includes source of entry to site, length of time on site, number of pages viewed, new or returning user.

Applicants have the option to accept, reject and update cookies at any time. If rejected, no data will be gathered from that applicant.

Cookies are in place on Tazio on first interaction. Cookies are used to monitor usage and enable applicants to undertake the Situational Judgement Test and Pre-Recorded Interview. Assessment scores linked to the applicant test and interview are also held.

Oleeo is available to each applicant who applies for the campaign and cookies appear on first interaction. This system captures applicant information, notifications, progress, and outcomes through the recruitment process and through the use of cookies, enables the applicant details to be linked to their log in information.

Cookie policy:

Microsite - Cookie Declaration Executive Officer Recruitment DWP

Oleeo - Oleeo applicant cookie policy

Tazio - currently only use functional cookies, under the lawful basis of their legitimate interest.

15. Contact Information

DWP tries to meet the highest standards when processing personal data. We take queries and complaints very seriously. If you have any concerns about the way that we have handled your personal data, please bring it to our attention via the following means:

Dominic Hartley
Caxton House
6-12 Tothill Street,
Westminster
London
SW1H 9NA

Or email data.protection@dwp.gov.uk

You are also able to submit complaints to the Information Commissioner’s Office, advice on how to contact them based on the nature of your concern is available at Contact us | ICO