Jump to Content [Accesskey 'c']
Jump to Navigation [Accesskey 'n']
Accessibility Statement [Accesskey '0']
Homepage [Accesskey '1']
Latest News [Accesskey '2']
Site Map [Accesskey '3']
Search [Accesskey '4']
Freedom of Information [Accesskey '6']
Contact Details [Accesskey '7']
SLC on GOV.UK
Working for Us
Digital and Technology
Privacy notice for job applicants – data protection May 2018
Job Applicant Privacy Notice
As part of our candidate application and recruitment process the Student Loans Company Limited (“SLC” or “we”, “us”, “our”) collects, processes and stores personal data about you. Personal data is any data or information from which an individual can be identified or data which when mixed with other information held about the same individual would make it obvious as to who the subject of the data is. Examples of personal data include name, telephone number, age, qualifications and employment history.
We may also process special category data about you. Special category data includes, for example, information about an individual’s race, ethnic origin, politics, religion, genetics, biometrics (where used for identification purposes), health, sex life, or sexual orientation. We will only process this where it is necessary and any processing will be done in accordance with our obligations under relevant data protection legislation.
SLC is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations. This Privacy Notice sets out:
1. why we process your personal data;
2. what data is processed; and
3. how it is processed as part of the recruitment process.
Throughout this Privacy Notice we use the term “processing” to cover all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of the data.
1. Why we process your personal data
In order to manage your application we need to process certain personal data about you. SLC must have a lawful basis in order to process your personal data. Special category data may only be processed where an additional lawful basis applies. We will process your data for the purposes of progressing your application and as required by law or regulatory requirements, so not all of the purposes for which we process your personal data will apply to you all of the time. SLC’s processing will always be fair and lawful and in accordance with applicable data protection legislation. In summary:
We may need to process data to take steps at your request prior to entering into a contract with you.
We may also need to process your data to enter into (and comply with our obligations under) a contract with you.
In some cases, we need to process data to ensure that we are complying with our legal obligations; for example, it is mandatory to check a successful applicant's eligibility to work in the UK before employment starts.
SLC has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job.
We may also need to process data from job applicants to respond to and defend legal claims.
SLC may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics and to comply with legal obligations in relation to equality and diversity. We may also collect information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability in accordance with legal obligations in relation to equality.
We will also process your personal data to comply with obligations and exercise specific rights in relation to employment, social security and/or social protection.
2. What personal data we might process
SLC may process a range of information about you. This includes the following examples:
personal details such as name, address (including proof of address), date and place of birth, telephone number(s);
work history/job data: previous employers, positions, dates;
remuneration: basic salary, benefit entitlements, bonuses;
education and work history including professional qualifications, skills and/or memberships;
references to include regulated references where necessary (this could include absence information received from referees); nationality/visa/right to work information (e.g. passport/driving licence/national insurance numbers/birth certificate/evidence of name or gender change);
images from on site CCTV and audio recordings of telephone interviews (if relevant);
results of pre-employment screening checks (e.g. credit history and criminal records checks where permitted by law);
notes from interviews and/or assessment results e.g. psychometric test or written assessment results;
bank account details for salary payment purposes (if successful)
During the process we may also capture some special category data about you (e.g. disability information, change of gender information). We do this in order to make reasonable adjustments (to enable our candidates to apply for jobs with us, to be able to take online/telephone assessments, to attend interviews/assessment centres, to prepare for starting at SLC if successful, and to ensure that we comply with regulatory obligations placed on us with regard to our recruitment) and to allow us to complete pre-employment checks.
3. Who we share your personal data with
SLC will need to share your personal data internally and may require to share it with some external parties (e.g. Credit Reference Agencies) or associates of SLC. Some of these third parties and associates may be located and/or may carry out searches outside the European Economic Area (“EEA”). Your information will only be shared if it is necessary or required and permitted by law (for example in order to carry out pre-employment screening).
The recruitment process will involve:
assessing and progressing your application;
assessing your suitability (skills, strengths, behaviours for the role); and/or
activities needed to complete the on-boarding and screening process should your application be successful.
To enable these processes your personal data may be shared internally, but the information shared is limited to what is required by each individual to perform their role in the recruitment process.
Your personal data may be shared internally with the following people:
employees who would have managerial responsibility for you or are acting on their behalf;
employees in HR who have responsibility for certain HR processes (for example recruitment, assessment, pre-employment screening (including checking whether applicants have a student loan and/or arrears);
employees in Legal, Risk, HR, Counter Fraud with responsibility for investigating issues of noncompliance with laws and regulations, policies and contractual requirements;
employees in IT and system owners who manage user access;
Audit employees in relation to specific audits/investigations; and
our estates team
SLC may also need to share your data with certain external third parties including:
companies who provide candidate interview and assessment services to SLC;
suppliers who undertake background screening on behalf of SLC (credit checking agencies, criminal checking bureaus, etc.);
academic institutions (Universities, colleges, etc.) in validating information you’ve provided; and
other third-party suppliers (or potential suppliers) who provide services on our behalf.
4. How we protect your information
Our systems are protected to ensure that unauthorised or unlawful processing of personal information, accidental loss or destruction of, or damage to, personal information does not occur. This is done in accordance with SLC’s Information Security Policy.
Where we share data with other parties located outside of the UK, as a minimum, SLC will require that such personal data is protected as required to a standard or level equivalent to that required by UK data protection laws. SLC also requires its third party suppliers or recipients of personal data to guarantee an equivalent level of protection as provided by SLC. Your personal data will be retained in accordance with the SLC’s Information Retention Policy.
5. Automated Decision Making
Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We are allowed to use automated decision-making:
1. where we have notified you of the decision and given you 21 days to request a reconsideration;
2. where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights; and
3. in limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
6. How long SLC keeps data
If your application for employment is unsuccessful, SLC will hold your data on file in accordance with our Information Retention Policy (which means that we hold your personal information after our recruitment process is complete). A copy of our Information Retention Policy is available on our website.
You may be asked when you submit your CV whether you give us consent to hold your details in order to be considered for other positions.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file (electronic and paper based) and retained in accordance with our Information Retention Policy. If successful, our Employee Privacy Notice will apply to you.
7. Your Rights
Subject to certain conditions, you have the following rights in relation to the personal data we hold about you:
the right to be informed about the collection and use of your personal data;
the right to access the personal data that SLC holds about you (subject access request or Data Subject Access Request (“DSAR”));
the right to request changes to be made to incorrect data (rectification);
the right to request deletion of your personal data (deletion);
the right to request transfer of your personal data (data portability);
the right to ask for use of your personal data to be restricted (restriction);
the right to object to the processing of your personal data (objection); and
rights in relation to automated decision making and profiling.
If you have any queries about this Privacy Notice or your personal data generally, you should contact SLC’s HR Department in the first instance.
It is your responsibility to keep your personal data up to date so that accurate application records can be maintained. If you need to make any changes to your personal data once you have submitted your application you should contact HR
8. Pre-employment checks
Given the nature of our business, we have legal and regulatory obligations to ensure that the people we employ can be relied on to handle public money and customer information responsibly. As part of the selection process, SLC uses third parties to perform a number of pre-employment checks (reference, criminal record and credit reference; for example, credit reference agencies will supply us with information that will assist us with our recruitment decision. The agencies will record details of the search but will not make them available for use by lenders to assess your ability to obtain credit. You have the right of access to your personal records held by credit reference agencies). These pre-employment checks are only performed on candidates who have been selected for a role. We provide the third parties with your name, address and email address; they will then contact you direct in advance of carrying out the checks. We can supply the names and addresses of the third parties we use upon request. HR will also check whether an applicant has a student loan and/or arrears.
9. What if you do not provide personal data?
You are under no statutory or contractual obligation to provide personal data to SLC during the recruitment process, however, if you do not provide all of the information we require, we may not be able to process your application properly or at all.
10. Monitoring and review of this Privacy Notice
This Privacy Notice is reviewed on a needs basis but no less than once in any rolling 12 month period and may be amended at any time. The DPO will continue to review the effectiveness of this Privacy Notice to ensure it is achieving its stated objectives. Recommendations for any amendments should be sent to the DPO.
11. Contact Details – DPO and ICO
SLC’s DPO has overall responsibility for the processing of the personal data at SLC. If you have any questions about this Privacy Notice or would like more information about any of the issues covered in it, please contact the DPO.
Data Protection Officer
100 Bothwell Street
Glasgow G2 7JD
To report any breaches of this Privacy Notice or data protection legislation please report this in accordance with the Data Protection Breach Management Procedure by following the SLC complaints process.
You have the right to complain to the Information Commissioner’s Office (ICO) if you think that there is a problem with how we are handling your data. The ICO advises that any concern should be raised with them within three months of your last meaningful contact with the organisation concerned.1
The ICO’s contact details are:
Information Commissioner’s Office
Cheshire SK9 5AF
Telephone – 0303 123 1113 (local rate) or 01625 545745
Website: https://ico.org.uk 1
delivered by the
Student Loans Company
Freedom of Information