Skip to main content

CHI recruitment privacy notice

CHI Recruitment Privacy Notice

Introduction - Ensuring privacy

This Privacy Notice sets out how Children’s Health Ireland (CHI) collects and processes personal data in the course of its recruitment campaigns.

This Notice outlines:

  • What personal data CHI collects and processes as a Data Controller as part of its recruitment activities;
  • How CHI obtains applicants’ personal data;
  • The purposes for processing the data collected;
  • Who data may be shared with;
  • How long data will be retained for;
  • The data protection rights that applicants have under the General Data Protection Regulation (GDPR) and how to exercise them;
  • How to contact CHI’s Data Protection Officer.

Types of personal data we collect

Personal data means any information that relates to an individual. As a healthcare provider, CHI needs to collect various categories of personal data about our patients, their family, carers, job applicants, and members of the public. As part of CHI’s recruitment activities, CHI collects and processes personal data relating to applicants for CHI jobs. This data can often be sensitive in nature. Personal data that we may process includes:

  • Name, surname and title
  • E-mail
  • Address
  • Phone number
  • Visa and work permit details
  • Skills
  • Period of notices
  • CV details
  • Employment data, including references and data processed through recruitment activities, e.g., current/past employers, educational institutions
  • Correspondence relating to application process
  • Notes related to applicant interviews
  • Health data and/or information which could infer health e.g. workplace accommodations required

    Where CHI processes special category data or Garda vetting data which may indicate criminal convictions, CHI establishes additional safeguards to ensure the secure processing of such data. Examples of special category data that CHI may process include health and disability related data.

    CHI regularly reviews its processing activities to ensure that it only collects personal data that is necessary to carry out its purposes and to ensure secure processing of this data.

Obtaining your personal data

In order to effectively conduct recruitment activities, it is necessary for CHI to collect and process personal information about job applicants. As a Data Controller, CHI collects information directly from you as an applicant but may also collect information about you from third parties. For example, where CHI contracts a third party to facilitate its recruitment process, or where CHI obtains information relating to you from your referee.

Rezoomo Applicant Tracking System

CHI has contracted Rezoomo Ireland Ltd. (hereinafter ‘Rezoomo’) to facilitate its recruitment process through the use of Rezoomo’s Applicant Tracking System (hereinafter ‘the Rezoomo platform’). By creating a profile on the Rezoomo platform, the job applicant consents to data being shared with CHI for the purposes outlined in the section Purposes for processing.

Rezoomo’s role - Data Controller and Data Processor

By creating a profile on the Rezoomo platform, job applicants are entering into a separate and distinct relationship with Rezoomo. Rezoomo is an independent data controller for the data the applicant submits to manage their profile on the Rezoomo platform. Rezoomo acts as a Data Processor where it manages job applications submitted to CHI, in accordance with CHI’s instructions. For further information, please read Rezoomo’s Privacy Policy.

Purposes for processing the data collected

CHI processes personal data for a number of purposes through its recruitment activities. Such purposes include:

  • To hold an effective recruitment campaign;
  • To fill open vacancies throughout CHI;
  • To assess an applicant’s suitability for a role;
  • To carry out Garda Vetting, where required for the role;
  • To assess where accommodations may be required;

Sharing your personal data

CHI engages third parties to facilitate the recruitment process and may share your personal data with the following parties:

  • Recruitment software providers and Human Resources information systems e.g. Rezoomo;
  • Communication platforms;
  • Governmental agencies and regulators, such as the Gardaí, Commission for Public Service Appointments and Workplace Relations Commission;
  • Referees supplied by the job applicant;
  • Cloud storage providers;
  • Professional services to assist CHI across its functions, including in legal, HR and finance;
  • External reviewers who will be present during interviews

Under the General Data Protection Regulation (GDPR), CHI must always have a lawful basis for processing personal data. CHI relies on the following lawful bases for processing the personal data of its applicants:

The data subject has given consent to the processing of his or her personal data for one or more specific purposes (article 6 (1) (a) GDPR). When applying for a CHI job through our recruitment agency, you consent for certain optional data to be processed by CHI, e.g. Date of birth, the title of your thesis, any publications you might have made.

The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (article 6 (1) (b) GDPR). When applying for a job at CHI, it is necessary for CHI to process certain categories of personal data in order to take steps prior to entering into an employment contract with you.

The processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6 (1) (c) GDPR). According to Part 1 and Part 2 of Schedule 1 of the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016, anyone who works with or undertakes an activity, of which a necessary and regular part of it consists of having access to or contact with children or vulnerable adults, is required to be vetted. Therefore, CHI is under the legal obligation to conduct vetting prior to you commencing employment. The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (article 6 (1) (f) GDPR). CHI holds a legitimate interest in holding an effective recruitment campaign.

Lawful basis to process special category data and data relating to criminal convictions and offences

CHI may be required to process special category data for the purposes of:

  • fulfilling its obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law (article 9(2) (b) GDPR);
  • preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services (article 9 (2) (h) GDPR).

CHI may be required to process data relating to criminal convictions and offences (article 10 GDPR). Under the Section 55 (1) (b) (ii) of the Data Protection Act 2018, CHI is processing criminal conviction data where necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

How long we will keep your data for

CHI only keep personal information for a period that is deemed necessary to carry out the function and operational purpose for which it was collected as outlined in this privacy notice, unless it is specifically required by law to keep your information for longer. All personal information is subject to a specified retention period in line with the HSE’s Health Service Policy on Record Retention Periods and HSE Standards and Recommended Practices for Health Records Management and is securely destroyed once no longer needed.

Your rights as a Data Subjects

Under the GDPR, you have the following rights:

a) The right to be informed about the collection and use of your personal data. This privacy notice meets this requirement, but you can always contact us to find out more or to ask any questions using the details below in the section ’Contacting us’.

b) The right to access the personal data we hold about you. The next section ‘How can I access my personal data?’ outlines how to exercise this right.

c) The right to have your personal data rectified if inaccurate or incomplete.

d) The right to be forgotten i.e., the right to request that your personal data is deleted.

e) The right to restrict the processing of your personal data.

f) The right to object to us for using your personal data for a particular purpose or purposes.

g) The right to withdraw your consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. This only applies if consent is the basis on which we process your data.

h) The right to data portability to transmit your personal data to another data controller, where CHI is processing your information under a specific lawful basis.

i) The right not to be subject to a decision based solely on automated processing, including profiling, unless certain conditions are met (article 22 (2) GDPR).

j) The right to make a complaint to the supervisory authority. To exercise any of your rights, please contact the data protection office through the contact details outlined in final section, ’Contacting us’.

How can I access my personal data?

If you want to access the personal data we hold on you, a request can be made in writing and sent to the email or postal addresses shown in in the final section, ’Contacting us’. We aim to provide a complete response, including a copy of your personal data within one month from the date of receipt of your request. In some cases, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be informed if an extension is required.

Contacting us, making a complaint or submitting feedback

We hope you have found this privacy notice useful. To provide feedback in relation to any aspect of how CHI has handled your personal information, exercise your rights, have any questions and/or would like to make a complaint, you can contact our Data Protection Officer by post, email or phone through the contact details below. CHI has appointed a Data Protection Officer (DPO) to oversee CHI’s compliance with its data protection obligations. If you have questions regarding CHI’s data protection practices, please do not hesitate to contact us as follows:

Contact Information

CHI at Crumlin
Site Data Protection Officer
Telephone: +353 1 409 6100
CHI at Temple Street
Site Data Protection Officer
Telephone: +353 1 878 4200

CHI at Tallaght
CHI Data Protection Officer
Telephone: +353 1 409 6100

CHI at Connolly
CHI Data Protection Officer
Telephone: +353 1 878 4200

Supervisory Authority – Data Protection Commission (DPC)
If you are unhappy with the outcome of a review of your complaint by our Data Protection Office, you also have the right to make a complaint to the Data Protection Commission directly.
01 7650100 / 1800 437 737
Post: Dublin Office: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
Portarlington Office: Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23, Co. Laois.

Share this page