For positions that are filled after they have been advertised, this means that – other than administrative case officers – only members of the appointment committee and, where appropriate, the assessment committee, may have access to the applications.
Applications, attached documents and assessments may only be accessed in AU’s recruitment system.
When the position has been filled and accepted, and rejections have been sent out to other applicants, the personal data of any rejected applicants must be destroyed/deleted. This might e.g. be own notes and email correspondence with applicants concerning interviews, etc.
To ensure that personal data is handled correctly, HR recommends that unsolicited applications are not forwarded to other managers at AU. If you receive an unsolicited application that you believe might be relevant for another AU manager, the easiest solution is to request the person who submitted the application to send the application to the relevant manager(s). This ensures that the person submitting the application is responsible for his or her own data and that you do not need to consider obtaining consent for, or notification of the forwarding of, the application.
The guidelines also include CVs submitted “as applications”.
Template for reply to be sent immediately after the application has been received and read:
“Dear [name]
Thank you for your application. Unfortunately, we are unable to offer you employment. However, you are welcome to check AU’s website for any new vacancies that may arise. Your unsolicited application has not been, and will not be, forwarded, and will be erased immediately. Aarhus University is the data controller for the processing. Our data protection officer can be contacted by email at: dpo@au.dk. You have the right to complain about the erasure of your data to the Danish Data Protection Agency at: dt@datatilsynet.dk”.
Proposed response text to be sent as soon as the application has been received and read:
“Dear [name],
Thank you for your application. We are unfortunately unable to offer you a position at this time, but we would like to retain your application for up to six months, so that we can contact you in the event that a relevant job opportunity arises. If you do not hear from us, your application with supporting documents will be deleted no later than six months from today’s date, unless you request deletion prior to this time. I will not forward your application to other recipients at AU. [Insert any contact details for another manager at AU, if you think that it might be relevant for the applicant to send the application to this manager.] Aarhus University is the data controller for the processing. The legal basis for the processing of your data is Article 6(1)(e) of the General Data Protection Regulation. Our data protection officer can be contacted by email at: dpo@au.dk. You are entitled to access the data, to have incorrect data rectified or erased, and to complain about the data processing to the Danish Data Protection Agency at: dt@datatilsynet.dk.”
When you save the application, you should save it on a secure drive with logging. You should also set up a reminder so that you can be sure you remember to delete the application after a maximum of six months.
Proposed response text to be sent as soon as the application has been received and read:
“Dear [name],
Thank you for your application. [Write what you wish to achieve from initiating a dialogue with the applicant.] If we cannot offer you employment at the moment, we would like to retain your application for up to six months in the event of a job opportunity arising. If you do not hear from us, your application with supporting documents will be deleted no later than six months from today’s date, unless you request deletion prior to this time. I will not forward your application to other recipients at AU. [Insert any contact details for another manager at AU, if you think that it might be relevant for the applicant to send the application to this manager.] I will not forward your application to any other recipients at Aarhus University. Aarhus University is the data controller for the processing. The legal basis for the processing of your data is Article 6(1)(e) of the General Data Protection Regulation. Our data protection officer can be contacted by email at: dpo@au.dk. You are entitled to access the data, to have incorrect data rectified or erased, and to complain about the data processing to the Danish Data Protection Agency at: dt@datatilsynet.dk”
When you save the application, you should save it on a secure drive with logging. You should also set up a reminder so that you can be sure you remember to delete the application after a maximum of six months.