AISI Research Unit Application Privacy Notice

This notice sets out how we will process your personal data, and your rights for when you apply for a job role within the AI Safety Institute (AISI) Research Unit. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

AISI is a directorate of the Department for Science, Innovation and Technology (DSIT). For UK GDPR purposes, DSIT is the Data Controller for the personal data processed as part of the recruitment.

1. Your Data

As part of the application stage, we will process the following personal data, provided directly by you:

• Name
• Address
• Occupation
• CV
• Contact details

As part of the application stage, we will process the following special category data where provided, directly by you:

Personal data revealing:

• Data concerning health

We will process your special category data, concerning health, when you notify us of a requirement for a reasonable adjustment or apply under the Disability Confident Scheme.

2. Purpose

The purpose(s) for which we are processing your personal data is:

• To conduct hiring process and tracking of potential applicants joining AISI.
• To gather statistics from the DSIT hiring process to inform future planning and strategy.

We need your personal data in order to:

• Accept your job application
• Review your job application and assess your suitability for the job role
• Contact you to progress your application
• Send you notifications for vacancy roles or job alerts

3. Legal basis of processing

We process personal data throughout the application on different legal bases.

• Receiving your application and assessing your suitability for the job vacancy:
  UKGDPR Article (6)(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• Retaining your application and inviting you to future job opportunities:
  UKGDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.DPA 2018 Section 8(d) – processing is necessary for the exercise of a function of the Crown, a Minister of the Crown or a government department.
• Processing of special category data:
  ‍UKGDPR Article 9(2)(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject. We have an appropriate document policy in place to meet compliance with Schedule 1, Part 1, Para 1 of the DPA.

4. Recipients

The AISI Research Unit recruitment platform is provided by Greenhouse Software, Inc. (Greenhouse). For UK GDPR purposes, Greenhouse is strictly a Data Processor, acting under the instruction of DSIT, the Controller. Greenhouse are not involved in assessing candidate suitability, they only provide the platform for AISI to manage the application process.

Data protection assurance is provided through contractual agreements. Greenhouse’s distinct privacy policy can be found here - https://www.greenhouse.com/uk/privacy-policy.

Applications are submitted directly to the Greenhouse platform or via the Civil Service Jobs platform and then transferred to the Greenhouse platform.

Despite which platform you apply via, all successful applications will be progressed on the Civil Service Jobs platform where relevant post job offer procedures will be managed. This means that those successful applicants who apply directly through the Greenhouse platform will accept their job offers via the Civil Service Jobs platform. For these applicants, a Civil Service Jobs Account will be made on behalf of them by the DSIT Talent Team for the purpose of offering you the job.

For information on how your personal data will be handled on the Civil Service Jobs platform, please refer to the distinct privacy notice here - https://www.civilservicejobs.service.gov.uk/csr/index.cgi?pageclass=StandardMessage&display=privacy

As part of DSIT IT infrastructure, your personal data may be stored on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

5. Retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for.

For documents supporting recruitment, application and sifting the retention period is 6 years. This is in line with the standard civil service recruitment process.

If you are unsuccessful, personally identifiable data, including your name, email address and phone number, will be retained for 1 year after your most recent application. This is to enable us to consider you for future applicable roles and invite you to apply.

If however, you don’t wish to be contacted about future possible roles and you don’t wish for us to retain your personal data for 1 year, you can email the Recruitment team at: aisi.talentteam_DL@dsit.gov.uk and request your contact details are deleted and you will not be contacted in the future.

6. International Transfers 

Our use of data processors means that personal data may be processed outside of the UK, however it will remain within the European Economic Area and receive the same level of data protection as it does in the UK, through the safeguard of Adequacy Decisions.

7. Your Rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement. 

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 

To exercise your rights please contact the Data Protection Officer using the contact details below.

8. Contact Details

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at: 

DSIT Data Protection Officer
Department for Science, Innovation & Technology
22-26 Whitehall
London
SW1A 2EG

Email: dataprotection@dsit.gov.uk

9. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at: 

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

https://ico.org.uk/make-a-complaint

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

10. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 19/07/24