How we use your personal data during the application process

Introduction

We collect and processe your personal information if you apply to work for us as a permanent or fixed term contract employee. In that capacity, the NMC is known as the data controller.

We also process your information if you’re an agency worker who is introduced to us by an employment agency.

This information forms part of a number of our privacy notices. 
Find out more about how we handle personal data.

If your application is successful, we’ll provide you with a further privacy notice when you start working with us, which will explain how we’ll use your information while you are working for us.

The information we collect

If you apply to work for us as a permanent or fixed term contract employee we collect and process:

• your name, address, telephone number, mobile number, email address

• information included in your CV and application including education history, employment history, and information about your skills, abilities and work experience

• information about your current salary and notice period

• information about your entitlement to work in the UK

• references from previous employers

• information about any reasonable adjustments you may require at the interview.

For the purposes of Equality and Diversity monitoring we’ll also ask you about your ethnicity, religion, sexual orientation, gender and disability.

You don’t have to provide this Equality and Diversity monitoring information to us and if you choose not to, it will not affect your application. Your Equality and Diversity monitoring information will be removed from your application when it is sent to the managers who’ll review your application.

The sources we use to collect information about you

If you apply to work for us as a permanent or fixed term contract employee, we collect information about you in a variety of ways, including from:

• your application form and CV
• any other information you provide to us during your application
• interviews or other forms of assessment
• your passport or other identity documents
• former employers.

Agency workers

If you are an agency worker, your agency is your employer and as such,when an agency introduces you to us, they’ll supply us with:

• your name

• information included in your CV including education history, employment history, and information about your skills, abilities and work experience

You may be asked to attend an interview, where we’ll assess your suitability for the temporary role for which you have been introduced by your agency.

We may provide feedback to the agency about your interview with us and your work performance and attendance while you work for us.

We consider that both the NMC and the agency are joint controllers in respect of your personal data as we’re both processing your data so that you can work for us on a temporary basis. We have arrangements in place with our agencies which set out our respective roles and responsibilities.

If you have any questions about the way your data is being handled by your agency, the first point of contact is your agency. For more information see the section below on Your rights.

Why we process your personal information

We collect and process your information to assess your suitability for the role for which you have applied or for which you have been introduced by your agency.

If you apply to work for us as a permanent or fixed term contract employee and we offer you a role, we process your information to take steps to enter into an employment contract with you.

If you’re introduced to us by an agency we process your information so that you can work for us on a temporary basis.

In the event that you make a complaint or legal claim about our recruitment processes, we’ll process your information in order to investigate and respond to your complaint or legal claim.

Your health information 

We don’t collect information about your health during the application process other than information you choose to give us about any reasonable adjustments you require at interview.

We are under a legal obligation to make reasonable adjustments to the way we offer our services to prevent people with disabilities from being placed at a substantial disadvantage and to ensure that people with disabilities have a fair and equal chance of accessing our services.

How and why we collect information about your previous roles

If you’re offered a permanent or fixed term contract with us we’ll ask your former employer for references. We’ll only seek references once a job offer has been made and we’ll tell you that we’re doing this.

The information we’ll collect will include your name, address and details of the role you have carried out.

We check references because we consider it a necessary step prior to entering into a contract with you.

How and why we collect information about cautions and convictions

As part of the recruitment process we don’t currently process personal data relating to any previous criminal convictions or cautions you have received.

Who has access to your information

Your information will be shared internally with members of the HR and recruitment team, and interviewers involved in the recruitment process. Because your data will be stored on our IT systems, our IT staff may have access to it in the course of their work.

We may share your information with external third parties in the following ways:

• to obtain pre-employment references from your former employers (If you apply to work for us as a permanent or fixed term contract employee)
  
  
• with suppliers (for example, those which provide recruitment IT systems)

• with your agency to provide feedback about your interview with us and your work performance and attendance while you work for us.

• with legal advisors in the event of a complaint or legal claim.

Our legal bases for processing your information 

If you’re applying to work for us on a permanent or fixed term contract, we process your information in order to decide whether we can enter into an employment contract with you.

Our legal basis for processing your information is that it is necessary in order to take steps at your request prior to entering into a contract with you.

In some cases we’re also under a legal obligation to process your information before entering into an employment contract with you.

For example we process information about your right to work in the UK in order to comply with our legal obligation to ensure all workers have the right to work in the UK before we employ them.

We also process any health information you provide us in order to comply with our legal obligation to make reasonable adjustments.

In order for us to fulfil our role as a public authority we need to recruit staff to work for us. In general therefore, the legal basis for processing your data is also because it is necessary for us to perform our tasks in the public interest.

We process equality and diversity information to promote and maintain equality of opportunity or treatment.

Where you make a complaint or bring a legal claim against us we consider that we both have a legitimate interest in processing your personal data so as to answer your complaint or claim.

Our legal basis for processing is therefore that it’s necessary for the purposes of our legitimate interests.

If you’re an agency worker we consider that it is in both of our interests for us to process your data so that you can work for us on a temporary basis. Our legal basis for processing your personal data is therefore that it’s necessary for the purposes of both our legitimate interests.

How we protect your information

We take the security of your data seriously. We have internal policies and controls in place to keep your data secure. Read more about these policies.

How long do we keep your information?

We only keep your data for as long as we need it for and this will depend on whether or not you are successful in your application to work for us.

If you apply to work for us as a permanent or fixed term contract employee, if your application is not successful we’ll keep your data for six months after the recruitment exercise ends.

If you are introduced to us by an agency but you are not selected to work for us, we’ll keep your information for six months. 

At the end of the six month period, we’ll delete or destroy your data except:

• We’ll keep any emails we hold about your application for longer than six months; the period of time for which we keep emails is set out in our corporate data retention schedule.

• In the event that you make a complaint or legal claim relating to the application process we’ll keep your information for as long as we need to in order to investigate and respond to your complaint or claim; the period of time for which we data relating to complaints of legal claims is set out in our corporate data retention schedule.

We may ask your consent to keep your data on file for future job vacancies. If you consent to us keeping your information for this reason, we’ll keep your data for twelve months after the initial recruitment exercise ends. At the end of this period, we’ll delete or destroy your data.

You can withdraw your consent before this period ends by contacting recruitment@nmc-uk.org. In this case, we’ll delete or destroy your data upon your withdrawal of consent.

If your application is successful, your information will be kept by us and we’ll provide you with a further privacy notice explaining how we’ll use your information during the time you are working for us and after you finish working for us.

International transfers of data

We’ll only transfer your personal data outside the United Kingdom where we use a supplier to process personal data on our behalf and the supplier operates outside the UK.

We have policies and procedures in place to ensure that where your data is processed outside the UK it is adequately protected.

Use of Closed Circuit Television (CCTV) at our sites

CCTV is in operation at our sites at:

• 23 Portland Place, London
• 61 Aldwych, London
• 1 Kemble Street, London
• Floor 17, 1 Westfield Ave, Stratford, London
• 114-116 George Street, Edinburgh.

Where we are not the sole occupier of the building (all offices other than 23 Portland Place) there’s additional CCTV which is controlled by the building owners or management company.

We record CCTV images of people when entering and leaving our premises as well as at strategic locations throughout the buildings. This information is recorded for the purposes of security and safety monitoring and the investigation of alleged criminal offences. The images may be shared with law enforcement and courts if this is needed.

What if you don’t provide personal data?

Most of the information we ask for, such as contact details, and information about your right to work in the UK have to be provided to enable the NMC to enter a contract of employment with you. If you don’t provide this information we won’t be able to enter into an employment contract with you.

For the purposes of Equality and Diversity monitoring we’ll ask you about your ethnicity, religion, sexual orientation, gender and disability. You don’t have to provide this Equality and Diversity monitoring information to us and if you choose not to, this will not affect your application.

Your rights and your data

Right to be informed

You have the right to be informed about how and why we collect and use your information. This privacy notice forms part of our work to inform you about the information we hold about you and how we use it.

You can request further information or clarification on our use of your information at any time by emailing us at foi&dparequest@nmc-uk.org.

Right of access

You have the right to request a copy of the information we hold about you.

In most cases the information will be provided to you free of charge. Only if the request is manifestly unreasonable or excessive or is a repeated request for the same information can we apply a charge. Any charge would be based on the costs of providing the information.

There are circumstances where we’ll hold information but will not be able to provide it in response to a request. An example of this would be where doing so would interfere with the rights of another person (if your data includes information about another individual).In such circumstances we would tell you that this is the case (unless compelled by law not to do so). We would also not supply information about a person if we haven’t been given enough details to identify them from that information

You can request a copy of the information we hold about you by emailing foi&dparequest@nmc-uk.org.

Right to rectification

You have the right to ask us to correct any information we hold if it’s incorrect.

Where proportionate and practical we’ll ensure that any organisation we have shared the information with also corrects it.

You can make your request by emailing foi&dparequest@nmc-uk.org.

Right to erasure

In some circumstances you may have the right to ask us to remove information we hold about you.

There are limitations to this right. For example, if we are compelled by law to keep information about you or it is integral to our activities as a regulator.

To make your request email us at foi&dparequest@nmc-uk.org.

Right to restrict processing

You have the right to ask us to restrict the processing of your information for specific purposes for specific periods of time.

In many instances the right to restrict the processing of your information does not arise, for example, where we process your information because of a legal obligation.

To make a request to restrict processing contact foi&dparequest@nmc-uk.org.

Right to data portability

You have the right to request your information in a machine readable format, using common standards or file types. This right only applies where you have provided the information to us yourself and we are processing the information based on your consent or to fulfil a contract and when the processing is carried out by automated means.

To make a request email foi&dparequest@nmc-uk.org.

Right to object

You have the right to object to us processing your information. This includes the right to object to direct marketing and the right to object to your information being used for research.

There are a number of exemptions to this right. If we’re not able to comply with your request we’ll advise you of our decision within one month of your request setting out the reasons.

You can tell us of your objection by contacting foi&dparequest@nmc-uk.org.

Rights related to automated decision making including profiling

You have the right to request human intervention in any automated decision making processes where this process is not based on your consent, authorised by law or necessary for the performance of a contract.

Automated decision making is where a decision is taken about you using an electronic system without human involvement. No decision will be made about you based on automated decision making which has a significant impact on you.

If you have an enquiry about our use of automated decision making, contact foi&dparequest@nmc-uk.org.

Consent

If you have consented to the processing of your data you have the right to withdraw that consent at any time. To withdraw your consent, contact foi&dparequest@nmc-uk.org.

As outlined in this privacy notice, in most instances we process your data for employment purposes on a legal basis other than consent.

Data Protection Officer

Our Data Protection Officer can be contacted by emailing DPO@nmc-uk.org.

Your right to complain to the Information Commissioner’s Office (ICO)

You have a right to complain to the Information Commissioner’s Office (ICO). 

What the data controller does

The NMC is the data controller in relation to your personal information.

If you were introduced to the NMC by a recruitment agency or online recruitment site before you made your application to us, that agency or recruitment site will also be a data controller in relation to your data.

If you wish to make a request about the way in which the agency or recruitment site processes your data, you should contact the agency or recruitment site in the first instance.

If you wish to make a request about the way we process your data or wish to obtain a copy of information which is held about you, you should make a request to us at foi&dparequest@nmc-uk.org.