HR recruitment and selection - references - privacy notice

PN0167-2
Chief Executive’s Office
Human Resources

Calderdale Metropolitan Borough Council of Town Hall, Crossley Street, Halifax, HX1 1UJ is registered with the Information Commissioners Office (ICO) under the provision of the Data Protection Act 2018. The Council takes its responsibilities as Data Controller under the Data Protection Act and UK GDPR very seriously. 

This privacy notice explains how your personal information will be processed by Calderdale Council if you choose to provide a reference in respect of a prospective employee, panel member or volunteer.

The type of information we will collect

We collect the following types of information from you directly or the person naming you as a referee:

• Name
• Contact details

Professional references:

• Job Title
• Organisation

Personal references:

• In what capacity you know the person (e.g., tutor, family friend) 
• How long have you known them         

Why we collect and hold this information 

Your information is required in order to:

• run recruitment processes to ensure the suitability of the candidate for the position they have applied for
• maintain a record of fair and transparent recruitment procedures. 

Sharing your personal data

The Information Commissioner’s Office recommend that it is good data protection practice to be open as possible with individuals about information which relates to them, particularly when, as in the case of a reference, this may have an adverse impact on them. Therefore, please note that in line with this guidance, any reference given will be shared with the individual to whom it relates upon their request.

We will only ever share relevant information about you with third parties where there is a legal basis for us to do so.

The lawful basis for the processing your data

We process personal information under the following GDPR lawful bases:

• Article 6(1)(b) – for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• Article 6(1)(f) – for the purposes of the legitimate interests pursued by the controller

Retaining your personal information

Your personal information will be kept for a maximum of 6 years (or 25 years if the individual works with vulnerable groups) after the end of the individual’s employment/involvement with the Council, at which time it will be securely destroyed. 

Your rights

The GDPR provides the following rights for individuals. Not all rights are absolute and therefore will only apply in certain circumstances:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

You also have the right to complain to the Data Protection Officer if you feel that your data has not been handled in accordance with the law. You can contact the Council’s Data Protection Officer at information.management@calderdale.gov.uk.

You also have the right to lodge a complaint with the Information Commissioner’s Office at www.ico.org.uk.