CHI recruitment privacy notice

Personal data means any information that relates to an individual. As a healthcare provider, CHI needs to collect various categories of personal data about our patients, their family, carers, job applicants, and members of the public. As part of CHI’s recruitment activities, CHI collects and processes personal data relating to applicants for CHI jobs. This data can often be sensitive in nature. Personal data that we may process includes:

• Name, surname and title
• E-mail
• Address
• Phone number
• Visa and work permit details
• Skills
• Period of notices
• CV details
• Employment data, including references and data processed through recruitment activities, e.g., current/past employers, educational institutions
• Correspondence relating to application process
• Notes related to applicant interviews
• Health data and/or information which could infer health e.g. workplace accommodations required
  
  Where CHI processes special category data or Garda vetting data which may indicate criminal convictions, CHI establishes additional safeguards to ensure the secure processing of such data. Examples of special category data that CHI may process include health and disability related data.
  
  CHI regularly reviews its processing activities to ensure that it only collects personal data that is necessary to carry out its purposes and to ensure secure processing of this data.

CHI has contracted Rezoomo Ireland Ltd. (hereinafter ‘Rezoomo’) to facilitate its recruitment process through the use of Rezoomo’s Applicant Tracking System (hereinafter ‘the Rezoomo platform’). By creating a profile on the Rezoomo platform, the job applicant consents to data being shared with CHI for the purposes outlined in the section Purposes for processing.

CHI processes personal data for a number of purposes through its recruitment activities. Such purposes include:

• To hold an effective recruitment campaign;
• To fill open vacancies throughout CHI;
• To assess an applicant’s suitability for a role;
• To carry out Garda Vetting, where required for the role;
• To assess where accommodations may be required;

Under the General Data Protection Regulation (GDPR), CHI must always have a lawful basis for processing personal data. CHI relies on the following lawful bases for processing the personal data of its applicants:

The data subject has given consent to the processing of his or her personal data for one or more specific purposes (article 6 (1) (a) GDPR). When applying for a CHI job through our recruitment agency, you consent for certain optional data to be processed by CHI, e.g. Date of birth, the title of your thesis, any publications you might have made.

The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (article 6 (1) (b) GDPR). When applying for a job at CHI, it is necessary for CHI to process certain categories of personal data in order to take steps prior to entering into an employment contract with you.

The processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6 (1) (c) GDPR). According to Part 1 and Part 2 of Schedule 1 of the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016, anyone who works with or undertakes an activity, of which a necessary and regular part of it consists of having access to or contact with children or vulnerable adults, is required to be vetted. Therefore, CHI is under the legal obligation to conduct vetting prior to you commencing employment. The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (article 6 (1) (f) GDPR). CHI holds a legitimate interest in holding an effective recruitment campaign.

Lawful basis to process special category data and data relating to criminal convictions and offences

CHI may be required to process special category data for the purposes of:

• fulfilling its obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law (article 9(2) (b) GDPR);
• preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services (article 9 (2) (h) GDPR).

CHI may be required to process data relating to criminal convictions and offences (article 10 GDPR). Under the Section 55 (1) (b) (ii) of the Data Protection Act 2018, CHI is processing criminal conviction data where necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

Under the GDPR, you have the following rights:

a) The right to be informed about the collection and use of your personal data. This privacy notice meets this requirement, but you can always contact us to find out more or to ask any questions using the details below in the section ’Contacting us’.

b) The right to access the personal data we hold about you. The next section ‘How can I access my personal data?’ outlines how to exercise this right.

c) The right to have your personal data rectified if inaccurate or incomplete.

d) The right to be forgotten i.e., the right to request that your personal data is deleted.

e) The right to restrict the processing of your personal data.

f) The right to object to us for using your personal data for a particular purpose or purposes.

g) The right to withdraw your consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. This only applies if consent is the basis on which we process your data.

h) The right to data portability to transmit your personal data to another data controller, where CHI is processing your information under a specific lawful basis.

i) The right not to be subject to a decision based solely on automated processing, including profiling, unless certain conditions are met (article 22 (2) GDPR).

j) The right to make a complaint to the supervisory authority. To exercise any of your rights, please contact the data protection office through the contact details outlined in final section, ’Contacting us’.

We hope you have found this privacy notice useful. To provide feedback in relation to any aspect of how CHI has handled your personal information, exercise your rights, have any questions and/or would like to make a complaint, you can contact our Data Protection Officer by post, email or phone through the contact details below. CHI has appointed a Data Protection Officer (DPO) to oversee CHI’s compliance with its data protection obligations. If you have questions regarding CHI’s data protection practices, please do not hesitate to contact us as follows: