Recruitment Privacy Notice

1. Introduction


At Slaughter and May, we take the protection of your personal information seriously and we are committed to safeguarding the privacy of the personal information that you share with us or is collected by us during the course of our interactions with you. This Recruitment Privacy Notice (“RP Notice”) supplements and should be read together with the firm’s Privacy Notice.

This RP Notice sets out the basis upon which Slaughter and May processes the personal information we collect from you when you apply for a permanent or fixed term role, a work experience opportunity or an insight event, as well as the subsequent selection process.

Under relevant data protection law, we are obliged to share detailed information about how we process your personal information. This invariably results in long, formal notices using technical and legal jargon, so in summary:

  1. we commit to only asking you for information that we consider relevant to the recruitment process;
  2. we endeavour to share only relevant information with colleagues internally and trusted external third parties to enable us to administer the recruitment process and, for successful candidates, the subsequent onboarding process;
  3. we constantly review our processes to keep the information you provide secure and we commit to deleting it in line with agreed retention periods; and
  4. we are always available to answer any concerns you may have around how your personal information is used, shared, stored or deleted during this process. You can either contact us via your recruitment contact, through the recruitment portal or by using our [email protected] email address. For more information about your rights, please see the firm’s Privacy Notice.

2. Scope of this RP Notice


Like most businesses, we hold and process a wide range of information, some of which relates to individuals who are interested in exploring opportunities with us. This RP Notice explains the type of information we process, our reasons for doing so and how that processing may affect you. For the purposes of this RP Notice, Slaughter and May means Slaughter and May, the partnership, Slaughter and May Services Company and the various other Slaughter and May entities operating in London, Brussels, Hong Kong and Beijing (also referred to in this RP Notice as the “firm” or “we”).

The RP Notice focuses on individuals who are applying to work for us as an employee, partner, contingent worker, contractor, consultant or work experience student, and the data that we process as part of the application, recruitment and onboarding process only.

References in this RP Notice to employment, work (and similar expressions) include any arrangement we may have under which an individual provides us with work or services, or applies for such work or services, including but not limited to partners of any Slaughter and May entity.

We use the word “you” to refer to anyone within the scope of this RP Notice.

In brief, this RP Notice explains:

  1. what personal information we hold and why we process it;
  2. the legal grounds allowing us to process your personal information;
  3. where the data comes from, who gets to see the data and how long we keep it;
  4. how to access your personal information and other rights; and
  5. how to contact us concerning your data.

3. Types of personal information processed


The types of personal information we process will vary depending on the opportunity you are applying for, your location and the terms and conditions of employment or engagement (if any) relevant to you.

Slaughter and May generally processes data for the purposes of our business, including providing services to our clients, management, administrative, employment and for legal and regulatory purposes.

4. Sources of personal information


When you apply to work for us, the initial data about you that we process are likely to come from you: for example, your contact details, information on your immigration status and whether you can lawfully work within the jurisdiction.

Where necessary, and in accordance with this Notice, we will require references and information to carry out pre-engagement screening (“PES”) or background checks. If you have concerns about this in a particular context, you should speak to your contact within our Recruitment team.

We may also receive data from third party recruiters, agents or other intermediaries as part of the recruitment process, or as a referral from one of our employees or clients.

5. Disclosures of personal information

5.1 Internal use

  • Your personal information will be seen internally by members of the Recruitment team, and other HR team members, hiring managers and, in some circumstances (if you are interviewing or you join us), other prospective colleagues on a need-to-know basis only.
  • We may also disclose your data to other employees of the firm where it is necessary for decision-making regarding your application, and this will depend on the type of role you are applying for.

5.2 External use

  • We will only disclose your personal information outside the firm if disclosure is consistent with a ground for processing on which we rely and doing so is lawful and fair to you.
  • We will disclose your data if it is necessary for our legitimate interests or the interests of a third party (but we will not do this if these interests are overridden by your interests and right to privacy). For example, we will disclose your data to third parties with whom we work to provide you with access to events or to event or training platforms.
  • Where necessary, we will also disclose your personal information, if you consent, or where we are required to do so by law or in connection with a criminal or regulatory investigation. Please note that, when we disclose your data in such circumstances, where applicable, we will ensure that any necessary due diligence has been undertaken on the recipient and any necessary contractual documentation is in place to ensure the integrity and security of the data as required by law.

6. Examples of disclosure


Specific circumstances in which your personal information may be disclosed include:

  • disclosure to third party providers to carry out reference checks, credit checks and other PES checks and on-boarding activities in the event you accept an offer of employment or engagement from us, for example to our third party PES providers, Vero Screening;
  • disclosure to organisations that process data on our behalf, such as our payroll service, insurers and other benefits providers, our bank and organisations that host our IT systems and data. This would normally occur if you accepted an offer from us and would be carried out as part of the onboarding process; and
  • disclosure to any regulator as necessary as part of the recruitment process, for example in order to conduct a s.43 check with the Solicitors Regulation Authority.
  • In the United Kingdom we also use a third party applicant tracking system (“ATS”), which securely stores your personal information for us once you have made an application in order to enable the relevant hiring managers and recruiters to consider your application.

7. Purpose and legal basis for processing


Under data protection law, there are various legitimate and lawful grounds we can rely on when processing your personal information. In some contexts, more than one of the stated grounds will be applicable.

We have summarised these grounds under four headings:

  1. contractual;
  2. legal obligation;
  3. legitimate interests; and
  4. explicit consent.

Each of the aforementioned grounds is defined in the following table:

Applicable term

Ground for processing

Explanation / definition

i. Contractual

Processing the data is necessary for the performance of contractual obligations with you or is necessary as a precursor to enter into a contract at the request of an individual.

This covers carrying out our contractual obligations and exercising our contractual rights.

ii. Legal obligation

Processing the data is necessary in order to ensure compliance with our legal obligations.

Ensuring we perform our legal and regulatory obligations. For example, in the avoidance of unlawful discrimination as part of the recruitment process or complying with our SRA regulations.

iii. Legitimate interests

Processing the data is necessary for our interests or for the legitimate interests of a third party.

The firm or a third party have legitimate interests in carrying out, managing and administering our respective businesses effectively, and it is necessary to process your data in the course of doing so.

Your data will not be processed on this basis if the firm’s interests or those of a third party are overridden by your own interests, rights and freedoms.

iv. Explicit Consent

You have given specific consent to our processing of your data.

In general, processing of your data in connection with employment is not conditional on your consent, however there may be occasions where we rely on your consent to do so, for example when we request a reference from a former employer.

 

8. Special categories of personal information


If we process special category personal information, as well as ensuring that one of the grounds for processing mentioned in section 7 applies, we will also make sure that one or more of the additional grounds for processing this type of personal information applies. The grounds include:

  1. processing being necessary for the purposes of your or our obligations and rights in relation to employment insofar as it is authorised by law or collective agreement;
  2. processing relating to data about you that you have manifestly made public;
  3. processing being necessary for the purpose of establishing, making or defending legal claims;
  4. processing being necessary for provision of health care or treatment, medical diagnosis, and assessment of your working capacity;
  5. processing for equality and diversity purposes, to the extent permitted by local law; and
  6. processing for which you have given us your explicit consent.

9. Data processing examples and grounds


The firm’s Privacy Notice outlines the purposes for which we process your personal information. More specific, recruitment-related information on these, examples of the information and the grounds upon which we process this information are in the table below (these examples cannot, of course, be exhaustive):

Purpose

Examples of personal information that may be processed

Grounds for processing

(i) Recruitment in relation to any job for which you apply and/or any job we think you might be suitable for in the future

Standard information related to your identity (e.g. your name, address and email address), ID information and documents, telephone numbers, place of birth, nationality, contact details, salary information, professional experience and education (including university degrees, academic records, professional licenses, memberships and certifications, awards and achievements, and current and previous employment details), financial information (including current salary information), language skills, and any other personal information that you present us with as part of your application related to the fulfilment of the role.

Information concerning your application and our assessment of it, your references, any checks we may make to verify information provided or background checks and any information connected with your right to work.

If necessary, we will also process information concerning your health, any disability and in connection with any adjustments to our application process, our recruitment process and working arrangements.

Contractual

Legal Obligations (for example any information proving your right to work here, information provided to payroll to fulfil our obligations to HMRC, for health and safety purposes in CCTV, or diversity information collected for diversity monitoring and reporting)

Legitimate Interests

(ii) Administering our recruitment process

Evaluating your experience and qualifications against the requirements of the position you are applying for (or any future job for which we think you may be suitable).

Administering our ATS.

Communicating with you in respect of any offer of employment we choose to make and providing you with information about our onboarding process.

Contractual

Legal Obligations

Legitimate Interests

(iii) Entering into a contract with you (if you are made an offer by us)

Information on your terms of employment from time to time including your hours and working patterns, your pay and benefits, such as your participation in pension arrangements, life and medical insurance and any bonus or share schemes.

Contractual

Legal Obligations

Legitimate Interests

(iv) Contacting you or others on your behalf

Your address and phone number, emergency contact information and information on your next of kin.

Contractual

Legitimate Interests

(v) Payroll administration

Information on your bank account, pension contributions and on tax and national insurance.

Your national insurance number or other government issued identifier.

Contractual

Legal Obligations

Legitimate Interests

(vi) Financial planning and budgeting

Information such as your proposed salary including any applicable bonus eligibility.

Legitimate Interests

(vii) Physical and system security

CCTV images upon attendance for interview at our premises.

Legal Obligations

Legitimate Interests

(viii) Providing information to third parties in connection with transactions that we contemplate or carry out

Information on any offer made to you and your proposed contract and other employment information that may be required by a party to a transaction such as a prospective purchaser, seller or outsourcer.

Legitimate Interests

(ix) Monitoring of diversity and equal opportunities (where permitted under local law)

Information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age as part of diversity monitoring initiatives. Such information will be aggregated and used for equality of opportunity monitoring purposes.

Legal Obligations

Legitimate Interests

Explicit consent (only where necessary)

(x) Disputes and legal proceedings

Any information relevant or potentially relevant to a dispute or legal proceeding affecting us.

Legitimate interests

Legal Obligation (necessary for the purpose of establishing, making or defending legal claims)


If you accept an offer from us we will process further information as part of the employment relationship. You will then be signposted to our internal Privacy Policy as part of the onboarding process.

10. Retention of data


Our general approach is to retain your personal information only for as long as is required to satisfy the purpose for which it was collected by us or provided by you. If you become employed by us we will keep your personal information for the duration of your employment and for a period afterwards.

The length of time for which we keep information collected during the recruitment process will depend on the type of role or opportunity you are applying for. If you would like more information about the firm’s retention periods for recruitment activity, please contact us at [email protected]

11. Cross border transfers


The global nature of our business means that your personal information may be disclosed to other Slaughter and May entities, or to third party suppliers or partners, located outside the United Kingdom, including (but not limited to) our offices in Brussels, Hong Kong and Beijing. These jurisdictions may not offer a level of protection of privacy equivalent to the level within the United Kingdom.

Where we transfer your personal information outside the United Kingdom, the firm will ensure that adequate safeguards have been provided by the entity receiving the information.

In respect of internal transfers between Slaughter and May offices, we undertake to ensure your information receives a level of protection which is at least in line with the requirements of data privacy legislation applicable in the United Kingdom.

In respect of transfers of your personal information to third party suppliers outside the United Kingdom, we will take steps to ensure that your personal information receives an adequate level of protection, including by, for example, entering into data transfer agreements or by ensuring that third parties are certified under appropriate information security certifications or relevant data protection schemes.

12. Data Subject Rights


You have a variety of rights to exercise control over your personal information, including rights of access, erasure and objection. These rights are subject to certain exemptions which we may need to apply, and certain rights (such as erasure) only apply in limited circumstances. For more detailed information about your rights, please refer to the ‘Your Rights’ section of our Privacy Notice.

13. Automated decision making


We do not currently use any automatic decision making as part of our recruitment processes, although we may use filtering questions in order to assist us with the administration and progression of your application throughout some stages of the application process.

14. Recruitment queries

You may contact us to find out more about your application and the recruitment process more generally by any of the following methods:

  • for trainee recruitment: [email protected]; or
  • for all other recruitment: [email protected]; or
  • by writing to: Recruitment Team - Data Privacy, Slaughter and May, One Bunhill Row, London EC1Y 8YY, United Kingdom; or
  • by telephone +44 (0) 20 7600 1200 and asking to be put through to the Recruitment Team.

15. Data privacy contact details and complaints


In processing your personal information, we act as a data controller. For questions or requests about your personal information which are not specific to the recruitment process, for example any queries relating to access and your rights, you should contact the firm’s Privacy Partner mailbox ([email protected]) to ensure we respond as quickly as possible.

If you have complaints relating to our processing of your personal information, you should raise these via the Privacy Partner mailbox ([email protected]) or via the relevant recruitment team as detailed in 14 above.

You may also raise complaints with the relevant regulatory authority. In the United Kingdom, the Information Commissioner’s Office is responsible for data regulation, and can be contacted via +44 (0) 303 123 1113 or via the ICO’s live chat facility, which you can access via your browser by clicking here.

16. Status of this Notice


This RP Notice does not form part of any contract of employment you might enter into and does not create contractual rights or obligations. It may be amended by us at any time. Nothing in this RP Notice is intended to create an employment relationship between Slaughter and May and any non-employee.

Updated: August 2021