Privacy notice for job applicants

Personal data processing of job applicants at the Ģ��ֱ��

Published

3.10.2023

What should you know about the processing of your personal data?

The Ģ��ֱ�� collects personal data about you to carry out its duties. You have rights to this data, such as the right to access the data and the right to be sure that it is stored securely and only for the necessary time. Above all, you have the right to know the following:

what information we collect about youand why,
for how long, and where we keep this information, and
to whom we share this information.

All of these points are explained in this privacy notice.

Millaisista opinnoista olisi hyötyä liiketoiminnan parissa? Tutustu ja valitse opintosi!

How to find the information you are looking for?

We have created this privacy notice to be as easy as possible to use and understand. That is why you will find the key points summarised under each section. If you are interested in knowing more, please follow the links in the sections or contact the data protection officer of the Ģ��ֱ��.

Contact the data protection officer

Why we process your personal data?

When you apply for a job at the Ģ��ֱ��, we will process your personal data as described in this privacy notice. Job applicants’ data are used in dealing with job advertisements and applications as well as in selecting personnel for employment relationships at JYU. Security clearance vetting is conducted in connection with certain positions.

What data we process and how long?

We will process your personal data that you give in the job application, its attachments or an interview. If we are going to collect personal data from other sources than from you as a job applicant, we will ask for your consent for it.

In addition, in order to fill certain vacancies, we may save in the system the name and email data of an evaluator/expert from outside JYU.

The job applications may also include contact information of possible referees.

The time we store your personal data varies from six months to permanent storage. To get more information about what personal data we collect and how long we keep certain information, check the sections below.

Basic data, such as name, date of birth, first language, citizenship, and contact information, such as email address, phone number and postal address.

Information on professional qualification, such as study and other educational data; work history; research, artistic, teaching and other merits relevant to the job in question; and competences, language skills and other special expertise.

Other information connected to the application, such as a CV, a photo, a description of personal characteristics, various certificates and assessments or competence-related samples, by which the applicant wishes to demonstrate his/her merits and suitability for the job.

In addition, we process the following data:

Assessment statements, such as proposals of preparatory workgroups or independent applicant assessments carried out in connection with the recruitment process (such as statements on research, artistic or teaching merits) as well as possible organs’ or other such units’ statements on the applicants’ merits or suitability to the job.

Suitability assessment: the results of a suitability assessment if conducted.

Checking applicant’s credit data: If the particular job or position requires checking the applicant’s personal credit data, we will inform about this already in the call for applications / job advertisement.

Criminal record extract, the checking of which is stated in the call for applications. Act on Checking the Criminal Background of Persons Working with Children. The Ģ��ֱ�� asks employees (employment relationship of over 3 months) working with persons under the age of 18 to show a criminal record extract. Before a person can be selected for such a position and a related employment contract can be drafted, the person needs to present a criminal record extract.

In addition, if necessary, drug test results, occupational health care doctor’s statements about the medical examination for employment, or personal security clearance documents will be processed.

Sanctions screening (legal obligation) which are based on based on identity, nationality, domicile, or address
Where do we get the personal data from? Sanction lists (held by international organisations such as the EU and UN as well as national organisations such as Office of Foreign Assets Control (OFAC), registers held by credit-rating agencies and other commercial information providers providing information on e.g. beneficial owners and politically exposed persons. From the person him-/herself or from organization to which a person is connected in a manner relevant to sanctions.

When hiring academic staff JYU can use automatic analysis based on the applicants ORCID ID. The sources used for the analysis are publication databases: Dimensions and Overston. Based on the analytics we will have reliable information of

what the applicant has researched
what research questions the applicant has addressed
what is the applicant's impact
the applicant's network of co-authors of publications

The data in the job applicant register are processed for the time needed to fill the vacancy. Job applications for a specific position are kept for 2 years from the end of the application process, and unspecified applications for 6 months from submitting the application. Video interview material is kept in the electronic system for 2 years. The time limit for prosecution and the rules on employment discrimination in the Criminal Code give the controller a legitimate reason to keep personal data collected during the recruitment process for two years after the end of the recruitment process (rejected applicants). Personal data won’t be deleted during this period based on data erasure request. The period is calculated from the end of the recruitment process.

The application with attachments of the person selected to the job is kept permanently in the system as well as in printed form in the archive of the JYU Registry Office.

The retain time for personal security clearances is determined in each case in accordance with the Security Clearance Act.

Criminal record extract, Act on Checking the Criminal Background of Persons Working with Children (504/2002) (confidential material, Act on the Openness of Government Activities, section 24.1.4). Not kept.

Drug test statement (confidential material, Act on Privacy Protection in Working Life). Not kept.

Medical examination for employment, occupational health care doctor’s statement (confidential material, Act on the Openness of Government Activities section 24.1.25). Not kept.

Security clearance, Security Clearance Act 726/2014, confidential material, kept for 6 months.

Suitability testing, test for suitability assessment, confidential material, Act on the Openness of Government Activities 24.1.29 (Data from psychological tests and suitability tests, data from assessments used for selecting an employee or for defining a pay criterion), kept for 14 months (from the selection decision).

For teaching and research staff, as a rule the employment proposals and related documents, such as decision proposals, expert statements and assessments of teaching and language skills, are kept permanently.

What rights you have and how to exercise them?

You have the following rights:

Right to access your data.
Right to have any incorrect information corrected.
Right to have your data erased (right to be forgotten), in certain situations. If university has the obligation to retain the data permanently or for a certain period of time we will deny your erasure request.
Right to restrict processing.
Right to have the responsible unit inform the party to which your data is disclosed of your data being corrected, erased, or the processing being restricted.
Right to object processing, e.g. direct marketing.
Right to have your data transferred from one system to another, when processing is based on an agreement or your consent.
Right to be notified of any information security breaches resulting in a high risk.
Right to file a complaint with the supervisory authority.
Right to withdraw consent

You can exercise your rights by sending a request to the university's Registry Office. You can use the form on the Registry Office's website or send your request informally. Keep in mind that withdrawing your consent doesn’t change the processing that happened before the withdrawal.

Get to know your rights

Use the form of the Registry Office

Send an informal request to the Registry Office

Who can access your personal data?

A job applicant’s personal data can be handled by the persons who are involved in preparing and making the employment decisions in the particular faculty or unit as well as in HR Services. Requests and responses for personal security clearances are handled by the HR Legal Counsel only.

A job applicant / an employee can be tested, with their consent, by means of personal and suitability assessments in order to define capacity for the work tasks or needs for educational or other professional development. In such cases, the employer ensures that the testing methods are reliable and used by adept professionals (Act on Privacy Protection in Working Life, section 13). Separate agreements are signed for the processing of personal data.

Also, the service providers we use can access your personal data in their role as data processors. However, these providers do not actively process your personal data, but they have access to it for maintenance reasons.

Learn more about data processors

To whom we transfer your data?

We transfer your personal data to bodies outside the university.

Find more information about the transfer of your personal data outside the university below.

Job applicants’ data are delivered as follows:

To the person concerned
To the Finnish Security Intelligence Service (Security Clearance Act 726/2014)

In addition, data are delivered to an expert reviewer, if filling the vacancy requires an expert procedure concerning applicant evaluation. The procedure is prescribed in the Universities Act (558/2009, section 33.3) and also in the University’s guidelines. The use of the expert procedure is mentioned in connection with the job advertisement. According to the Universities Act (558/2009, section 51), data can also be delivered to the Ministry of Education and Culture.

In addition, data can be delivered based on a data delivery request made to the data controller, if an employee has given his/her consent or if the recipient is entitled to process the personal data on the grounds of GDPR (EU 679/2016, Article 6) or other legislation.

Information and documents concerning a job applicant are public unless they are specifically determined confidential by law (Act on the Openness of Government Activities 621/1999).

As a rule, the data are not transferred outside the EU/EEA area. You can find a list of transfers outside the EU/EEA through the link below.

Personal data processors and transfers outside the EU/EEA

On what basis we process your personal data?

We process your personal data based on legal grounds, agreements, or your consent. If you want to dive deeper into our legal bases, such as the relevant legal provisions, you can find more information through the menu below.

The EU General Data Protection Regulation (GDPR, 2016/679) and the national Data Protection Act (1050/2018) are the general laws applicable to the processing of job applicants’ personal data. In addition, where applicable, the Act on the Protection of Privacy in Working Life (759/2004) applies to the processing job applicants’ personal data. Based on the necessity requirement of the GDPR and the Act on the Protection of Privacy in Working Life, JYU cannot process any job applicant’s personal data other than those directly necessary for the recruitment process, and this necessity requirement is to be sustained without exceptions, irrespective of the job applicant’s possible consent.

For the processing of personal data, there must always be a legal basis in accordance with the GDPR. Legal basis for the processing of job applicants’ personal data:

GDPR (EU 2016/679), Article 6.1 (c): The processing is necessary for fulfilling the legal obligation of the data controller.

Universities Act (558/2009) professor’s selection, duties and title.

Security Clearance Act (2014/726), Requesting a security clearance, as regards a security clearance, the legal basis for processing is consent and section 5 of the Security Clearance Act.

Act on the Protection of Privacy in Working Life (759/2004), dealing with personal credit data, submitting a drug test certificate upon recruitment, personality and suitability assessments. The employer may receive a drug test certificate with the consent of the employee selected for a job, and only when the work tasks call for precision, reliability, ability for independent discretion or good response capacity, and where work performance may evoke a situation stipulated in the Act on the Protection of Privacy in Working Life, section 7. An employee can be tested, with the employee’s consent, for personal and suitability assessment in order to check the employee’s capability for the work tasks or needs for educational and other professional development. Upon the employee’s request, the employer or the tester designated by the employer must give the employee, free of charge, the written statement received from the personal or suitability assessment. If the employer received the statement orally, the employee should be given an account of the content of the statement. Act on the Protection of Privacy in Working Life, section 13.

Act on Checking the Criminal Background of Persons Working with Children (504/2002) stipulates on the procedures by which the criminal background is checked for persons to be selected to work with minors.

Criminal Records Act (770/1993), right to get information about a criminal record.

Occupational Health Care Act (1383/2001), an employee’s obligation to participate in a medical check.

The employer is entitled to receive and use personal credit data concerning an approved job applicant, with reference to Chapter 4 of the Credit Information Act (527/2007), in order to assess the job applicant’s reliability when the person is going to work in a position calling for special reliability and the case concerns a situation provided for in the Act on the Protection of Privacy in Working Life, section 5a.

The processing of such personal data that disclose health information is forbidden. This ban is not applied, however, if the processing is necessary in order to comply with the data controller’s or the data subject’s obligations and specific rights in the field of labour law, insofar as it is allowed in EU regulations or a Member State’s legislation or in a collective labour agreement complying with the Member State’s legislation stipulating on appropriate safety measures regarding data subject’s fundamental rights and benefits (GDPR, Article 9.2b). Within the above-described legal frame, it is possible to derogate from the ban for the processing of health data.

Personal data can also be processed on the grounds of the GDPR Article 6b, i.e. when there are no separate legislative stipulations on such processing, but it is necessary in order to implement an agreement in which the data subject is an agreeing party, or to carry out, on the data subject’s request, relevant measures preceding the signing of such an agreement.

The University can use personal data for statistical purposes or to perform a planning and investigation duty (GDPR Article 6.1e and Data Protection Act section 4, public benefit).

Sanctions screening (legal obligation) which are based on based on identity, nationality, domicile, or address.

How to contact us?

If you want more information about the processing of your personal data, do not hesitate to contact our data protection officer via email or phone (+358 40 805 3297).

Contact our data protection officer

Below you find the contact information of the responsible unit. If you wish, you can directly contact the responsible unit instead of the data protection officer.

If you want to exercise your rights (withdraw your consent for example) you can contact the Registry Office by email:

Send a request to the Registry Office

Ģ��ֱ��