For EU and EEA Job Applicants

Privacy Notice for all Job Applicants in the EU and EEA

Introduction

As part of any recruitment process, Copyright Clearance Centre (CCC) collects and processes personal data relating to job applicants.

CCC is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

In accordance with the requirements of the General Data Protection Regulation (GDPR) the purpose of this privacy notice is to make all job applicants aware of how and why we collect and use your personal information, both during and after a job application process.

It should be noted that our legal basis for processing your data is your consent. This notice is designed to provide you with information to ensure that your consent is informed, freely given, specific and unambiguous.

By submitting your details, you acknowledge that you have read this statement and that your submission is an affirmative action signifying your consent and agreement to the processing of your personal data. Please do not provide your personal data if you do not consent to CCC processing it.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

For the purposes of the GDPR, CCC is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. As a data controller, we are required under GDPR to notify you of the information contained in this privacy notice.

What data does the organization collect?

CCC collects a range of information about you. This may include:

Your name, address and contact details, including email address and telephone number;
Details of your qualifications, skills, experience and employment history;
Information about your current level of remuneration;
Whether or not you have a disability for which the organization needs to make reasonable adjustments during the recruitment process;
Information about your entitlement to work in the relevant country; and
Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

CCC collects this information in a variety of ways. For example, data might be contained in application forms, CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.

After requesting consent from you CCC will collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers including information from criminal records checks. CCC will seek information from third parties only once a provisional job offer to you has been made.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

Why does CCC process personal data?

CCC needs to process data prior to entering into a contract with you. It also needs to process your data to enter into a contract with you.

In some cases, CCC needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in a particular country before employment starts.

The organization has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the organization to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. The organization may also need to process data from job applicants to respond to and defend against legal claims.

CCC relies on legitimate interests as a reason for processing data, and has considered whether or not those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not.

The organization processes health information if it needs to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment. Where the organization processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes.

For some roles, the organization is obliged to seek information about criminal convictions and offences. Where the organization seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

The organization will not use your data for any purpose other than the recruitment exercise for which you have applied.

The lawful basis for processing any personal data relating to the acknowledgement of your application or in determining your suitability for current and future vacancies is:

Your consent. By signing this privacy statement you are providing consent to this processing and are acknowledging that your consent is freely given, specific, informed and unambiguous (applying GDPR Art 6.1a )
The Organization’s requirement to ensure that our business is resourced with employees able to perform to the required standard (applying GDPR Art 6.1f – a legitimate interest)

The lawful basis for processing any personal data relating to making a decision about your recruitment, determining the terms of an offer of employment made to you, checking the validity of your qualifications and previous employment history, checking that you are legally entitled to work in the country of employment and undertaking additional pre-employment checks as required by law is:

Your consent. By signing this privacy statement, you are providing consent to this processing and are acknowledging that your consent is freely given, specific, informed and unambiguous (applying GDPR Art 6.1a). NOTE THAT WE WILL SEEK SEPARATE EXPRESS CONSENT FROM YOU IF CRIMINAL OR FINANCIAL CHECKS ARE REQUIRED.
To comply with a legal obligation to ensure a candidate has the lawful right to work or to complete mandatory medical checks (applying GDPR Art 6.1c- compliance with a legal obligation)
To ensure we select the best candidates for employment based on their experience and ability (applying GDPR Art 6.1f – a legitimate interest )
To check whether you have criminal convictions (when it is required and authorised by law and with appropriate safeguards for the rights and freedoms of data subject- applying GDPR Art 10)

The lawful basis for processing any personal data relating equality opportunities monitoring is:

NOTE: candidates are NOT required to provide this (other than when required by law- as per point below) and therefore the supply of this data will be completely voluntary and a failure to provide will not affect your application. AT THE TIME OF OUR REQUEST WE WILL SEEK SEPARATE EXPRESS CONSENT FROM YOU AND YOU ARE FREE TO OBJECT.
To satisfy mandatory government reporting (when it is required to be collected by law) – applying GDPR Article 9 .2b and g).

Your consent

Under the terms of the GDPR for your consent to be valid it should be given by a clear affirmative act establishing a freely given specific, informed and unambiguous indication of your agreement to the processing of data relating to you.

For online applications, we have ensured that personal data can only be supplied by a candidate if they have first checked a box which confirms that they have read this statement and also consent to the processing of their data as described in this statement.

If data has been supplied to us via a different route, then on receipt we will contact you and request that you provide your consent by signing a copy of this statement and advise you that in the absence of receiving this within 3 weeks of our request your data will be destroyed.

Note that the consent you provide by virtue of this statement does not cover the processing of special categories of data (as defined by the GDPR, namely, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and data concerning health or data concerning a natural person’s sex life or sexual orientation) . We will seek separate and express consent to the processing of this type of data.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the organization during the recruitment process. However, if you do not provide the information, the organization may not be able to process your application properly or at all. Where possible we will work with candidates to ensure that an application is not prejudiced.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Will your personal data be subjected to automated decision making?

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:

Authorised by law;
Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights; or
With your explicit written consent and where appropriate measures are in place to safeguard your rights.

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes and request your express consent.

Who has access to data?

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR department, interviewers involved in the recruitment process, managers in the department with a vacancy and IT employees if access to the data is necessary for the performance of their roles.

The organization will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment.

You can contact us if you require further information about these protective measures.]

If there is a requirement for your personal information to be transferred to our corporate headquarters in the United States, the organization can confirm that it is a member of the EU-US and Swiss- US Privacy Shield Framework. This provides confirmation under Regulation (EU) 2016/679 of the European Parliament and of the Council that there is an adequate level of protection of personal data when transferred within the organization to the United States of America from the European Economic Area. (CCC’s data security and privacy team is actively reviewing the recent decisions by the Court of Justice of the European Union and the Swiss Federal Data and Information Commissioner related to the Privacy Shield and will update this statement as appropriate.)

If we transfer the personal information we collect about you to countries outside the European Economic Area in order to perform our contract with you, we will ensure that your personal information does receive an adequate level of protection and we will put in place contractual obligations with any such third parties, to define technical and organizational measures to provide protection that is consistent with and which respects the laws on data protection.

You can contact us if you require further information about these protective measures.

How does the organization protect data?

The organization takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

Data security

When we process your personal data, we will always apply the core principles of the GDPR to ensure it is:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

For how long does the organization keep data?

If your application for employment is unsuccessful, the organization will hold your data on file for six months after the end of the relevant recruitment process. If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment with Copyright Clearance Centre (CCC) or for such longer period as required by legal, accounting or reporting standards applicable to our business.

In order that you may be considered for future vacancies if you are unsuccessful we request that you consent to your data being retained for 12 months commencing from the date that your application has been rejected. Please note that you have the right to object to this at the time of rejection, whereupon your data will be destroyed or returned to you.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may continue to use such information without further notice to you.

Your rights

As a data subject, you have a number of rights. You can:

Access and obtain a copy of your data on request (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request that the organization to change incorrect or incomplete data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you correct.
Request that the organization deletes or stops processing your data, for example, where the data is no longer necessary for the purposes of processing. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing
Object to the processing of your data where the organization is relying on its legitimate interests (or those of a third party) as the legal ground for processing and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you would like to exercise any of these rights, please contact privacy@copyright.com

Where the processing of your data is based on your consent, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact hr@copyright.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Contact details

We have appointed a Privacy Officer to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact privacy@copyright.com.

Raising a complaint

If you are unhappy with the way in which your personal data has been processed, you may in the first instance raise a complaint by contacting the Company using the contact details above.

If you remain dissatisfied, then you have the right to apply directly to the Privacy Officer for a decision – contact details below:

Email: privacy@copyright.com

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

This page was updated on March 23, 2020
Materials available on copyright.com are protected by the copyright laws of the United States and other countries. © 1995-2020 Copyright Clearance Center, Inc. All rights reserved.