Candidate Privacy Notice
Introduction
The Lloyd's Market Association ("LMA") is committed to protecting the personal data of its job applicants. This Notice sets out important information about how the LMA ("we" or "us") collect and use your personal data during the course of the application and recruitment process. Any references used during the course of this Candidate Privacy Notice that refer to "employer", "employee", or "employment" should not be used to infer that any employment relationship exists or will exist between the LMA and any workers, contractors or consultants to whom this Privacy Notice applies.
Any questions you may have should be directed to the LMA Data Protection Contact, whose details are provided at the end of this notice.
Scope
This Notice applies to job applicants located in the UK. In connection with the recruitment process, the relevant data controller is the LMA, Suite 426, One Lime Street, London EC3M 7DQ.
Other provisions apply to the personal data of employees and that provided by the LMA’s membership. For more information, please contact the LMA’s Data Protection Contact via the details provided below.
What is personal data?
In order to consider your suitability for a job with the LMA, we need to review your personal data, including that contained within your Curriculum Vitae. The LMA therefore needs to process (including the activities of collecting, storing and using) personal data about you and other personal data provided by you.
Personal data means information which identifies you or any other individual. The LMA will collect, use and store personal data provided by you for a wide variety of reasons in connection with the application and recruitment process.
What is our legal basis for using your personal data?
Under data protection law, there are various grounds on which we can rely when processing your personal data. In some contexts, more than one ground applies. We have summarised these grounds as Contract, Legal Obligation, Legitimate Interests and Consent, and outline what those terms mean in the following table.
| Term |
Ground for processing |
Explanation |
| Contract |
Processing necessary for performance of a contract with you or to take steps at your request to enter a contract.
|
This covers carrying out our contractual duties and exercising our contractual rights. |
| Legal Obligation |
Processing necessary to comply with our legal obligations.
|
Ensuring we perform our legal and regulatory obligations. For example, providing a safe place of work and avoiding unlawful discrimination. |
| Legitimate Interests |
Processing necessary for our or a third party’s legitimate interests. |
We or a third party have legitimate interests in carrying on, managing, and administering our respective businesses effectively and properly and in connection with those interests processing your data.
Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights, and freedoms.
|
| Consent |
You have given specific consent to processing your data. |
In general processing of your data in connection with employment is not conditional on your consent. But there may be occasions where we do specific things, such as provide a reference and rely on your consent to our doing so.
|
More information about how these legal bases apply is set out below in the section ‘What personal data do we collect and how do we use it?'
What personal data do we collect and how do we use it?
Examples of the data we process, how we use it, and which legal basis applies can be found in the table below.
| Purpose |
Examples of personal data that may be processed |
Grounds for processing |
| Recruitment |
Standard data related to your identity (e.g. your name, address, email address, ID information and documents, telephone numbers, place of birth, nationality, contact details, professional experience and education (including university degrees, academic records, professional licenses, memberships and certifications, awards and achievements, and current and previous employment details), financial information (including current salary information) language skills, and any other personal data that you present us with as part of your application related to the fulfilment of the role).
Information concerning your application and our assessment of it, your references, any checks we may make to verify information provided or background checks and any information connected with your right to work.
If necessary, we will also process information concerning your health, any disability and in connection with any adjustments to working arrangements.
|
Consent
Legal obligation
Legitimate interests
|
| Physical and system security |
CCTV images. |
Legal obligation
Legitimate interests
|
| Providing information to third parties in connection with transactions that we contemplate or carry out |
Information on your contract and other employment data that may be required by a party to a transaction, such as a prospective purchaser, seller or outsourcer. |
Legitimate interests |
| Disputes and legal proceedings |
Any information relevant or potentially relevant to a dispute or legal proceeding affecting us. |
Legitimate interests
Legal obligation
|
Where does the data come from?
The majority of the personal data to be provided by you is mandatory in connection with our recruiting activities. Failure to provide mandatory personal data may affect our ability to accomplish the purposes stated in this Notice, including considering your suitability for employment and/or entering into an employment contract with you or your suitability for a working relationship with us and/or entering into a contract for services.
The list set out above is not exhaustive and there may be other personal data which the LMA collects, stores and uses in the context of the application and recruitment process. The LMA will update this Notice from time to time to reflect any notable changes in the categories of personal data which it processes.
The majority of the personal data which we process will be collected directly from you. However, your personal data may also be provided to us by third parties, such as recruitment agencies, former employers, background vetting companies, official bodies (such as regulators), and/or medical professionals.
Referencing and vetting
As part of our referencing and vetting procedures, we may contact certain third parties in order to verify your personal information (including personal information that you provide as part of the application and recruitment process). These third parties may include:
- former employers in order to verify your previous employment history
- universities and/or other education establishments that you attended in order to verify your education history
- professional bodies
- background vetting companies.
We will only seek this information in relation to successful candidates that have accepted a conditional offer of a working relationship with us and we will inform such candidates before doing so. Where you provide us with the personal data of others in the recruitment process including, but not limited to, in relation to obtaining references, we assume that you have obtained the permission of that person to disclose their personal data to us. If you do not have permission, please do not provide their personal data to us.
How do we use your personal data?
The LMA uses your personal data for a variety of purposes in order to take steps necessary to enter into a working relationship with you, to comply with legal obligations or otherwise in pursuit of its legitimate business interests. We have set out below the main purposes for which candidate personal data is processed:
- to identify and evaluate job applicants, including assessing skills, qualifications and experience
- to verify candidate information and carrying out employment, background and reference checks, where applicable and in order to prevent fraud
- to communicate with you about the recruitment process and your application
- to comply with our legal, regulatory, or other corporate governance requirements
- to conduct data analytics to review and improve the operation of our recruitment processes.
In addition to using your personal data to consider you for the role you applied for, we may retain and process your personal data to inform you about and to consider you for other roles that may be of interest to you. If you do not want us to consider you for such roles, please inform us.
Again, this list is not exhaustive and the LMA may undertake additional processing of personal data in line with the purposes set out above. The LMA will update this Notice from time to time to reflect any notable changes in the purposes for which its processes your personal data.
What special categories of personal data do we process?
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to special protection and considered by UK and EU privacy law to be “special category personal data”.
If we process special category personal data about you (for example (but without limitation), storing your health records to assist us in ensuring that we provide you with a healthy and safe work workplace or processing personal data relating to diversity monitoring), as well as ensuring that one of the grounds for processing mentioned above applies, we will make sure that one or more of the grounds for processing special personal data applies. In outline, these include:
- Processing relating to data about you that you have made public;
- Processing being necessary for the purpose of establishing, making or defending legal claims;
- Processing being necessary for provision of health care or treatment, medical diagnosis, and assessment of your working capacity;
- Processing for equality and diversity purposes to the extent permitted by law.
We will always treat information about health as confidential and it will only be shared internally where there is a specific and legitimate purpose to do so.
When do we share candidate personal data?
The administration of LMA’s recruitment process involves various third parties. Accordingly, your personal data will be shared when you provide it to the LMA. When you upload your Curriculum Vitae, available start date, telephone number, email address and home address as part of the application process, for example, this is done online via our Applicant Tracking System on our HR Information System.
Part of the administration of the process is also carried out by the LMA’s outsourced providers.
The LMA will also share candidate personal data with other parties only in limited circumstances in order to take steps necessary to enter into an employment contract or contract for services or where necessary to comply with a legal obligation, or otherwise in pursuit of its legitimate business interests. Such parties may include:
- Recruitment agencies
- Background vetting specialists (if relevant)
- Occupational health providers (if relevant)
- HMRC and/or any other applicable government body
- Accountants, lawyers and other professional advisers
- Applicable regulatory bodies.
In all cases, the personal data will be shared under the terms of a written agreement between the LMA and the third party which will include appropriate security measures to protect the personal data in line with this Notice and our obligations. The third parties are permitted to use the personal data only for the purposes which we have identified, and not for their own purposes, and they are not permitted to share the data any further without our express permission.
In all cases, should personal data be transferred to a country which is deemed not to have the same level of protection for personal data as the UK, the LMA will put in place written data transfer agreements to protect the personal data. In the case of any transfer of personal data from a country within the European Economic Area (EEA) to a country outside of the EEA, these transfer agreements will incorporate the standard contractual clauses approved by the European Commission.
For how long will my personal data be retained?
The LMA will retain personal data only for as long as needed to fulfil the purpose(s) for which it was collected, or otherwise as required under applicable laws and regulations. Under some circumstances we may anonymise your personal data so that it can no longer be associated with you. We reserve the right to retain and use such anonymous data for any legitimate business purpose without further notice to you.
For unsuccessful candidates:
- We will typically retain personal data collected during the recruitment process for a maximum period of 12 months from the end of the process subject to any exceptional circumstances and/or to comply with particular laws or regulations.
- We may retain certain data relating to particular candidates on file for a longer period than 12 months in order to follow up with the candidates in relation to future vacancies; if you do not wish for your personal data to be maintained on file for this purpose, please inform us.
If you are offered and accept a position with us, the personal data we collected during the application and recruitment process will become part of your personnel record and we may use it in connection with your working relationship with the LMA.
What are my rights in relation to my personal data?
You will not be subject to hiring decisions based solely on automated data processing without your prior consent.
In certain circumstances, you have the right to seek the erasure or correction of your personal data, to object to particular aspects of how your data is processed, and otherwise to seek the restriction of the processing of your personal data. You also have the right to request the transfer of your personal data to another party in a commonly used format. If you have any questions about these rights, please contact the LMA's Data Protection Contact using the details set out below.
You have a separate right of access to your personal data processed by the LMA. You may be asked for information to confirm your identity and/or to assist the LMA to locate the data you are seeking as part of the LMA's response to your request. If you wish to exercise your right of access, you should set out your request in writing to the LMA's Data Protection Contact using the details set out below.
Finally, you have the right to raise any concerns about how your personal data is being processed with the Information Commissioner's Office (ICO) by going to the ICO's website: https://ico.org.uk/concerns/ or contacting the ICO on 0303 123 1113 or casework@ico.org.
Where can I get further information?
The LMA's Data Protection Contact has responsibility for overseeing compliance with this Notice and for dealing with any questions or concerns. If you would like further information about the matters set out in this Notice, please contact the Data Protection Contact at the LMA.
The contact details for the LMA's Data Protection Contact are set out below:
Data Protection Contact
Lloyd's Market Association
Suite 426
One Lime Street
London
EC3M 7DQ
Telephone: 020 7327 3333
Or you can email to dataprotection@lmalloyds.com.