The Energy and Water Agency
Privacy Notice – Job Applicant
Last Modified: 13/08/2019
This Privacy Notice sets out the way in which The Energy & Water Agency (the “Agency”, “we” or “us”), collects and processes Personal data relating to job applicants, as well as the steps we take to protect such information. We take data privacy seriously and are committed to managing your personal data professionally and in compliance with Applicable Data Protection and Privacy Laws. This policy is made compliant with the General Data Protection Regulation EU 2016/679 (“GDPR”, “Regulation”).
1.1 As part of any recruitment process, the Agency collects and processes personal data relating to job applicants. The Agency is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
1.2 This privacy notice is based on the following data protection principles:
- The processing of personal data shall take place in a lawful, fair and transparent way;
- The collection of personal data shall only be performed for specified, explicit and legitimate purposes and will not be further processed in a manner that is incompatible with those purposes;
- The collection of personal data shall be adequate, relevant and limited to what is necessary in relation to the purpose for which they are processed;
- The personal data shall be accurate and where necessary, kept up to date;
- Every reasonable step shall be taken to ensure that personal data that is inaccurate having regard to the purposes for which they are processed, are erased or rectified without delay;
- Personal data shall be kept in a form which permits identification of the data subject for no longer than it is necessary for the purpose for which the personal data are processed;
- All personal data shall be kept confidential and stored in a manner that ensures appropriate security.
1.3 By submitting your personal data, you shall:
- Declare that you have read, understood and accepted this Privacy Notice;
- Declare that the information given is complete and true to the best of your knowledge, and understand that incorrect statements could lead to your application being rejected;
- Declare that consent was obtained from any third party whose details are included in the information provided;
- Authorise us to verify statements contained in your application and to make any necessary checks.
2. What information do we collect?
2.1 The Agency collects the following information:
- Your name, surname and contact details, including email address and phone number.
- Your Curriculum Vitae including details of your qualifications, skills, experience and employment history.
- Whether or not you have a disability for which the Agency needs to make reasonable adjustments during the recruitment process. The legal basis we rely on when processing special category data, is article 9(2)(b) of the GDPR, which also relates to our obligations in employment and the safeguarding of your fundamental rights, and article 9(2)(h) for assessing your work capacity as an employee and making reasonable adjustments if necessary.
- Information about your entitlement to work in Malta.
2.2 We may collect this information in a variety of ways. From you, from third parties or public sources as needed to support the recruitment process. We shall carry out checks, subject to your consent where required by law.
2.3 The information will be stored in a range of different locations managed by us directly, including human resources management systems and other business applications.
2.4 If any information is indirectly collected e.g. from social media, the data subject must be informed at the latest within 1 month. Additionally, it needs to be indicated which type of data (category) were processed and which source has been used. If the personal data is being proceeded with the goal to communicate with the person concerned, this information needs to be provided during the time of the first contact.
3. Why does the Agency process personal data?
3.1 The legal basis for processing your personal data is based on Article 6(1)(c) of the Regulation whereby we ensure to comply with our legal obligations in relation to Employment, Anti-discrimination, and Data Protection laws.
3.2 The Agency has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process as per Article 6(1)(f) of the Regulation. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide whom to offer a job. We may also need to process data from job applicants in the exercise and defence of legal claims.
3.3 We also may rely on Article 6(1)(b) of the GDPR for processing your personal data which relates to the necessary processing to perform a contract or to take steps at your request, before entering into a contract. This same basis will also be relied upon for any contractual agreement we may have in place with recruitment agencies through which you would have submitted your application.
3.4 We also may process your personal data on the basis of Article 6(1)(a) of the GDPR which relates to consent. In certain instances, due to the nature of the processing operations, we shall only process such personal data upon obtaining consent for one or more specific purposes.
4. Who has access to your data?
4.1 Your information may be shared internally and externally for the purposes of the recruitment exercise. This includes members of the human resources department, interviewers, managers in the respective areas and external recruitment agencies (if they supplied us with your information in the first place).
4.2 We may disclose your personal data to third party entities under the following scenarios:
- To comply with our legal obligations or contracts, or to respond to a court order, administrative or judicial process, such as a subpoena or search warrant;
- In response to lawful requests by public authorities (such as national security or law enforcement);
- As necessary to establish, exercise or defend against potential, threatened or actual litigation;
- Where necessary to protect the Agency’s, your, or those interests of any other person; or
- In connection with the sale, assignment or other transfer of all or part of our services to the interested party.
4.3 We shall not share your data with any other third parties (unrelated to the recruitment process), unless we request and obtain your explicit consent.
5. How does the Agency protect data?
5.1 We take the security of your data seriously. We have controls and internal policies in place to protect your data against loss, misuse and unauthorised access, alteration, disclosure, or destruction. Moreover, all efforts are being taken to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services processing personal information.
5.2 If we learn of a security systems breach, we will inform you of the occurrence of the breach in accordance with applicable law.
6. For how long does the Agency keep data?
6.1 If your application for employment is unsuccessful, we will hold your data on file for 12 months after the end of the relevant recruitment process. for consideration for future employment opportunities. At the end of that period, or once you withdraw your consent, your data shall be securely purged.
6.2 If your application for employment is successful, the personal data gathered during the recruitment process will be transferred to your personal file stored by the Human Resources department and retained throughout the duration of your employment. Once your onboarding is completed, you will be able to access our Data Retention Policy which defines the retention periods for your and other data.
7. Your rights
7.1 We respect your privacy rights and provide you with reasonable access to the Personal Data that you may have provided during the recruitment process. As a data subject you have the following rights:
- The right for information;
- The right to access;
- The right to rectification;
- The right to erasure;
- The right to restrict processing;
- The right to object;
- The right to data portability;
- The right to complain to a supervisory authority; and
- The right to withdraw consent.
7.2 If you would like to exercise any of these rights such as accessing, amending or requesting deletion of any information about you, please contact the Agency at firstname.lastname@example.org. We will respond to these requests within a month, with the possibility to extend this period for particularly complex requests in accordance with Applicable Law.
7.3 If you believe that the Agency has not complied with your data protection rights, you can complain to the Lead Supervisory Authority’s at email@example.com.
8. What if you do not provide personal data?
8.1 You are under no statutory or contractual obligation to provide data to the Agency during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly in part or in full.
9. Contact us
9.1 Any matters relating to the recruitment process can be forwarded to the following address: firstname.lastname@example.org. or Energy and Water Agency, WSC Complex, Qormi Road, Luqa, LQA 9043 Malta.
10. Changes to this Privacy Notice
10.1 Please note that this Privacy Notice may change from time to time. If we change this Notice in ways that affect how we use your personal information, we will advise you of the choices you may have as a result of those changes.