21.06.2018

Job applicants

Personal data about job applicants, Jyväskylä University, HR Services, privacy notice.

For what purposes do we process personal data and what are the legal grounds for processing?

When you apply for a job at the University of Jyväskylä, we process your personal data as described in this privacy notice. Data about job applicants is used when processing job advertisements and applications and when selecting new employees at the University of Jyväskylä. Security clearances are processed in relation to specific positions.

Grounds for processing personal data about job applicants (EU General Data Protection Regulation (GDPR, 679/2016):

Consent (article 6.1(a)) or explicit consent (article 9.2(a)) which is requested separately if personal data included in specific personal data groups is requested exceptionally from a job applicant.

Legal grounds for processing security clearances also include consent and section 5 of the Security Clearance Act (726/2014).

With regard to selected applicants, processing is necessary to take steps prior to entering into an employment contract and to implement the employment contract (article 6.1(b)).

The university can use personal data for statistical purposes (article 6.1(e), public interest).

What type of personal data do we process?

We process personal data you have provided in your job application. If we collect personal data about you from other sources in the role of an employer, we will request you to give your consent.

In addition, the name and email address of an external evaluator/expert can be saved in the system when recruiting staff to specific positions.

Who can access your personal data?

Personal data about job applicants can be processed by individuals who take part in making and preparing recruitment decisions in each faculty or unit, in HR Services or the Service Centre. Security clearance applications and responses are only processed by the director of HR and the HR legal counsel.

The University of Jyväskylä is also responsible for the processing of personal data when it has outsourced the processing of personal data. With regard to the job applicant register, processing has been outsourced to Visma Enterprise Oy, the supplier of the electronic recruitment system (Saima), and MobileCV Oy, the supplier of the video interview tool (RecRight). The data processing agreements required have been entered into with these suppliers.

Job applicants and employees can be tested, with their consent, by means of personal assessments and aptitude tests in order to identify their ability to carry out their tasks or any needs for training or other professional development. In this case, the employer must ensure that the testing methods are reliable and the evaluators have the necessary competence (section 13 of the Act on the Protection of Privacy in Working Life). Separate agreements are made on the processing of personal data.

Data about job applicants is disclosed to the following:

  • The parties concerned
  • Finnish Security Intelligence Services (Security Clearance Act 726/2014)

In addition, data is disclosed to an expert evaluator if an expert is needed in the recruitment process to evaluate job applicants. Expert procedures are defined in the Universities Act (section 33(3) of the Universities Act 558/2009) and in the regulations of the University of Jyväskylä.  The use of any expert procedure must be indicated in conjunction with the job advertisement. According to section 51 of the Universities Act (558/2009), data can also be disclosed to the Ministry of Education and Culture.

In addition, data can be disclosed on the basis of a request for data sent to the data controller if the job applicant has given their consent to this or the recipient has the right to process personal data under article 6 of the GDPR or another legal provision.

Is your personal data transferred outside the EU/EEA and how is data protected during transfers?

No personal data is transferred outside the EU/EEA.

For how long do we process your personal data and do we archive your data?

Data included in the job applicant register is processed for as long as is necessary in the recruitment process. Job applications for a specific position are stored for 36 months after the end of the application period. Open applications are stored for six months after receiving an application. Video interview material is stored in the electronic system for 36 months. The application of the selected person, including its attachments, is stored permanently in the system and as a printed paper version in the registry office of the University of Jyväskylä. The storage period of security clearances is defined in the Security Clearance Act.

Withdrawing consent

You can, at any time, withdraw your consent to processing your personal data in the purposes of use defined in this privacy notice. Withdrawing consent is easy: send an email to kirjaamo@jyu.fi. Please state that your message is in reference to a recruitment process.  Withdrawing consent has no impact on any processing carried out before you withdrew your consent.

What rights do you have as a data subject?

You have the following rights as a data subject:

  • Right to access your data (right of access)
  • Right to have any incorrect data rectified (remember to keep your contact information up to date); job applicants can update any data they have saved in the system during the application period
  • Right to have your data erased (right to be forgotten) in certain situations
  • Right to restrict processing in certain situations
  • Right to have the unit responsible for the register notifying the party to which data is disclosed of your personal data being rectified or erased or of processing being restricted
  • Right to object to processing in certain situations, such as in direct marketing
  • Right to have your data transferred from one system to another in certain situations
  • Right not to be subject to a decision that is based merely on automated processing, such as profiling, and that has legal impact on you or that has a similar significant impact on you
  • Right to obtain information about any information security breaches resulting in a high risk
  • Right to file a complaint with the supervisory authority

If you have any questions about your rights, please contact the data protection officer of the University of Jyväskylä or the contact person in register-related matters.

How can you exercise your rights?

The University of Jyväskylä has general guidelines on how data subjects can exercise their rights.

General description of technical and organisational protection

Only necessary data about job applicants and the data required for processing are collected. The University of Jyväskylä, as the data controller, uses proper technical and organisational means to protect personal data against unauthorised or unlawful processing or the destruction or loss of personal data. Within the organisation, data about applicants can only be processed by individuals who need to process the data in their work-related tasks. Processing job applications is subject to access rights and logging in to the system. Access rights to the system have only been assigned to separately defined employees. The University of Jyväskylä provides its employees with training related to the processing of personal data.

Contact information

Data controller

The University of Jyväskylä acts as the data controller and HR Services is the unit responsible for processing personal data.

Contact information of the responsible unit:

Contact persons in matters related to the job applicant register of the University of Jyväskylä are Jouni Valjakka, director of HR, jouni.valjakka(at)jyu.fi and Mari Nirkkonen, HR legal counsel, mari.j.nirkkonen(at)jyu.fi.

Contact information of the data protection officer of the University of Jyväskylä

tietosuoja@jyu.fi, +358 40 805 3297 

This privacy notice was published and sent to data subjects starting from 25 May 2018.