#Recruitment and the Data Protection Act – Did you know this?

Today, I received my renewal notice from the Information Commissioner’s Office (ICO).

Because I last paid this a year ago, it has been out of mind for a while. Best practice with candidate details mean that I naturally store everything on a secure database, and that I don’t send candidate details anywhere without their express permission. The same goes for client information: All data is stored on my database, safe from prying eyes. And I use it with great care and consideration.

I don’t really think about it – It’s an internal process that has simply become part of my daily working practices. But this renewal notification has drawn my mind to it again, and I wonder how many candidates and clients are aware of it?

To quote from the ICO’s leaflet: “The Data Protection Act 1998 places obligations on organisations that use personal information and gives individuals certain rights … every organisation (data controller) the process personal information (data) must notify the Information Commissioner’s Office …. Failure to notify is a criminal offence.”

There are 8 data protection principles embodied in the Act. Summarised, they require that data shall be:

1. fairly and lawfully processed;

2. processed for limited purposes;

3. adequate, relevant and not excessive;

4. accurate;

5. not kept longer than necessary

6. processed in accordance with the data subjects’ rights;

7. secure; and

8. not transferred to countries outside the European Economic Area without adequate protection.

Before you next engage with a recruitment agency, it may be worth asking the following questions:

• Is your recruitment agency registered with the ICO, or are they contravening the Data Protection Act?
• Do you know what they are doing with your personal data, how it is stored and how secure it is?
• Do you give permission every time your CV is sent out somewhere?

If they are not registered, you are vulnerable. Food for thought, methinks!