Data Protection Notice – Recruitment

  1. Controller and data protection officer

The Office of the Information Data Protection Commissioner (the “IDPC”) in its capacity as the controller is hereby providing you with this data protection notice pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”). This notice applies to the processing of personal data collected by the IDPC by receiving job applications and to the personal data subsequently collected by the IDPC in the recruitment process, including information obtained orally during an interview. The processing of personal data of candidates who are made and accept a job offer is governed by a separate protection notice provided upon onboarding.

In the event you wish to exercise any of your data subject rights as enshrined under the GDPR. or have any comments or queries related to this notice you may contact IDPC’s data protection officer by e-mail on idpc.info@idpc.org.mt, by postal mail at Airways House, Second Floor, High Street, Sliema SLM 1549, Malta, or by phone on +356 2328 7100.

  1. Purpose and legal basis

The IDPC processes personal data for recruitment purposes. As part of this processing activity, the IDPC assesses the applications received in response to a vacancy, creates a shortlist of suitable candidates who meet the vacancy requirements and invites them for an interview.

The IDPC processes job applicants’ personal data because it is necessary to perform a task in the exercise of an official authority vested in the IDPC, which is the supervisory authority responsible for monitoring and enforcing the application of the GDPR and other laws in Malta. This is also prescribed by Recital 121 of the GDPR: “The supervisory authority should have its own staff, chosen by the supervisory authority or an independent body established by Member State law, which should be subject to the exclusive direction of the member or members of the supervisory authority”.

  1. Recipients of personal data

Personal data will be circulated internally amongst a limited number of IDPC members who is the staff involved in the recruitment process. Personal data will not be shared with any recipient outside of the IDPC, unless required by law or judicial order.

  1. Storage period

The IDPC retains job applicants’ personal data for six (6) months from the date of submissions of an application. The IDPC may extend this period in the event that a decision made by the IDPC in relation to recruitment is contested by the job applicant by instituting legal and / or judicial proceedings. The duration of such extension is determined on a case-by-case basis taking into account the principle of storage limitation.

  1. Your rights

You have the right to access and to rectify your personal data, and the right to restrict processing.

You also have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you. In this case, the IDPC shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You also have the right to file a complaint with the IDPC or alternatively, with the supervisory authority of your habitual residence, place of work or place of the alleged infringement.

Depending on the circumstances and under the appropriate safeguards, one or more of your rights listed above may be restricted pursuant to Regulation 4 of S.L. 586.09 for the performance of the functions of the Commissioner.

You can exercise your rights by contacting the IDPC’s data protection officer using the details provided above.

Skip to content