Privacy Notice for Recruitment

The HPRA has created this data protection notice as the controller of your personal data to demonstrate our firm commitment to privacy and to inform you about the information we collect and process in connection with our recruitment process. 

What information do we process?

We collect information that is specifically provided by you as part of an application process. We will collect the following (but not limited to):

• Name, address, email, telephone number
• CV (if applicable) containing work and educational history
• Equal opportunities monitoring information (defined as special category data) - this information is purely for statistical analysis and monitoring purposes
• Answers to application questions
• Any other information you wish to provide in support of your application

Evaluation/scoring records may also be processed if you attend for interview. If your application for employment is successful, personal data gathered during the recruitment process, e.g. information provided by referees, pre-employment medical report, etc., will be transferred to your Human Resources file and retained during your employment. 

Legal basis for processing

The legal basis for the processing under the GDPR are: 

• Article 6(1)b processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• Article 6(1)c processing is necessary for compliance with a legal obligation to which the controller is subject
• Article 6(1)f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
• Article 9(2)b processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject

The legislation we rely on for processing due to a legal obligation is:

• Employment Equality Acts, 1998 – 2015
• Organisation of Working Time Act, 1997
• Employment Permits Act, 2003 to 2014
• Terms of Employment (Information) Act,1994

Your personal data is used for the following legitimate interests pursued by the HPRA:

• To assess your suitability for employment with us
• To enable us to run our business and manage our employment relationship with you effectively, lawfully and appropriately 
• To protect employees’ rights and interests
• To manage the employment contract if your application is successful
• To comply with legal obligations and to protect our legal position in the event of legal proceedings against the HPRA
• To carry out statistical analysis of our recruitment processes.

What happens if you do not provide us with your information?

You may decline to provide us with your personal data. However, we require relevant information to properly manage our recruitment process, and we may not be able to evaluate or assess your application if you decline to provide us with required personal data.

Registering with HPRA recruitment

If you choose to register your details with the HPRA, you may access your profile, correct and update your details, or delete your details at any time. To access, correct, update or delete your details, please access your personal profile by using the secure login. Within your candidate account, you can also use the ‘Download Data’ feature to generate an XML file of the current data we hold on you that you have provided and/or have access to within the account.

How is your information processed and shared?

Your information may be shared with organisations who provide services to the HPRA, e.g. HR advisors, expert panel members, legal advisors.  

The HPRA uses third party service providers and suppliers (also known as data processors) in order to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

Your data will be transferred to third countries including the UK, USA and India. The European Commission has granted an adequacy decision to the UK which recognises that the country provides an equivalent level of data protection to that guaranteed under EU law. Other measures to protect your data are in place in relation to data transferred to the US and India and you may contact the HPRA at the details below or our data processor IRIS-Networx for further information on these measures. 

Your personal data will be stored for 18 months after the vacancy you apply for has closed. After this period, it will be fully anonymised. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality.  

What are your rights under data protection law?

Data protection legislation provides you with the following rights regarding the processing of your personal data:

• the right to request access to your data
• the right to request your data be rectified or erased 
• the right to request processing of your data be restricted 
• the right to object to processing 
• the right to lodge a complaint with the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Please provide sufficient information in your request to enable us to deal with your query. 

Further information regarding data protection at the HPRA can be found in our main privacy notice.