Processing of job applicants’ data at the University of Tartu

1. The data collected by the university and the purpose of data processing

1.1. The university processes personal data only if there is a legal basis for it and only for as long as is necessary to fulfil the purpose of the processing.

1.2. For the purpose of conducting the recruitment process, the University of Tartu as the data controller collects and processes the following personal data of job applicants:

a) personal identification data – in particular, first name and surname, date of birth and age;

b) contact details necessary for contacting the applicant – e.g. email address, phone number, address;

c) data needed to assess the suitability of the new employee – data qualifications and professional development and professional experience, such as data on education, training completed and previous work experience;

d) data on research, development and creative activities, including a list of research activities and research grants received (for applicants for academic positions);

e) data on citizenship; in the case of foreigners, data confirming their right to reside and work in Estonia.

2. Legal basis for processing the data

2.1. If the applicant has provided the data required for application, the University of Tartu requires the applicant’s consent to processing the personal data for the purpose of the recruitment process.

2.2. The university also requires the applicant’s consent to contacting persons who supplied a recommendation letter, in case their details have been provided in the application documents.

3. Automatic processing of data

In order to pre-select applicants, the university may use psychometric tests (e.g. mental ability test, personality test), which require the applicant’s consent in the testing environment. Through the interpretation of the test results, the university may obtain additional personal data about the applicant from the person who conducted the test as the data processor. No decisions are taken on applicants based solely on automatic processing.

4. Data retention and access rights

4.1. If an unsuccessful applicant gives his or her explicit consent, the university may use his or her data to make future job offers. The data of unsuccessful applicants is also retained for the purpose of possible legal disputes, based on the university’s legitimate interest. In both cases, the application documents of unsuccessful applicants are kept for one year from the date of the decision of rejection.

4.2. The processing of personal data in the recruitment process of academic staff and support staff is somewhat different at the University of Tartu.

4.2.1.Academic staff positions are generally filled through a public competition and the selection process contains several stages, in accordance with the Regulations for Recruitment of Academic Staff.

4.2.2. When recruiting support staff, only staff who are involved in the recruitment process have access to the relevant application documents. Applicants’ personal data is restricted information to which third persons (including competent authorities) gain access only in cases provided by law.

5. Data subject rights

Depending on the basis on which personal data are processed, data subjects have:

a) the right obtain confirmation of whether the university is processing their personal data and to access the personal data collected about them. The university as the controller may reject a data subject’s application if the purpose of the application is other than “being notified of processing and verifying the lawfulness of processing”;

b) the right to request the correction of inaccurate personal data collected about them, or the completion of personal data if the data are inaccurate or incomplete;

c) the right to request the university to delete, without undue delay, the data subject’s personal data the processing of which no longer has a legal basis or is no longer necessary for the purposes for which the data were collected or otherwise processed;

d) the right to request the university to restrict the processing of personal data if:

• the data subject contests the accuracy of the personal data, for a period that allows the university to verify the accuracy of the personal data;
• the processing of personal data is unlawful, but the data subject requests the restriction of use of the personal data rather than deletion of the data;
• the university no longer needs the personal data for the purpose of the processing, but the data subject needs the personal data for the establishment, exercise or defence of a legal claim;
• the data subject has objected to the processing of personal data for a period until it is verified whether the university’s legitimate reasons outweigh the data subject’s reasons;

e) the right to receive their personal data which they have provided to the university, and the right to transmit the data to another controller. However, the right of data portability applies solely to the personal data which the person has communicated to the university, which the university processes by automated means and on the basis of consent or contract. Therefore, the right to data portability does not apply to job applicants, as their data are not processed by automated means (except for the results of psychometric tests);

f) the right to object to the processing of their personal data if the processing of data is either based on a legitimate interest or is necessary for the performance of public duties or due to public interest.

6. Enquiries and monitoring

6.1. In all matters related to the processing of personal data and the exercise of the rights of data subjects, you may contact the university’s data protection specialist at andmekaitse@ut.ee. Upon receiving a data subject’s request, the university may, before processing it, ask the data subject to specify which information or which operations of personal data processing the enquiry relates to. Enquiries are answered within 30 days of receipt. If it becomes evident before replying to the enquiry that a longer period of time is required to reply to the enquiry, the university may extend the deadline for responding. One copy of the personal data processed is issued to the data subject free of charge, but the university may charge a reasonable fee for additional copies to cover administrative costs.

6.2. If a person considers that the processing of his or her personal data by the university is in conflict with the legislation governing the processing of personal data, the person has the right to contact the Data Protection Inspectorate or another competent supervisory authority of the place of residence or work.