For positions that are filled after they have been advertised, this means that – other than administrative case officers – only members of the appointment committee and, where appropriate, the assessment committee, may have access to the applications.
Applications, attached documents and assessments may only be accessed in AU’s recruitment system.
When the position has been filled and accepted, and rejections have been sent out to other applicants, the personal data of any rejected applicants must be destroyed/deleted. This might e.g. be own notes and email correspondence with applicants concerning interviews, etc.
To ensure that personal data is handled correctly, HR recommends that unsolicited applications are not forwarded to other managers at AU. If you receive an unsolicited application that you believe might be relevant for another AU manager, the easiest solution is to request the person who submitted the application to send the application to the relevant manager(s). This ensures that the person submitting the application is responsible for his or her own data and that you do not need to consider obtaining consent for, or notification of the forwarding of, the application.
The guidelines also include CVs submitted “as applications”.
Proposed response text to be sent as soon as the application has been received and read:
“Dear [name], Thank you for your application. Unfortunately, we are unable to offer you employment. However, you are welcome to check AU’s website for any new vacancies that may arise. Your unsolicited application has not been, and will not be, forwarded, and will be erased immediately. Aarhus University is the data controller for the processing of personal data. Our data protection officer can be contacted by email at: dpo@au.dk. You have the right to complain about the erasure of your data to the Danish Data Protection Agency at: dt@datatilsynet.dk”.
Proposed response text to be sent as soon as the application has been received and read:
“Dear [name], Thank you for your application. We do not currently need your competencies, but we would like to retain your application for up to six months in the event of a job opportunity arising. If you do not hear from us, your application with supporting documents will be erased no later than six months from today’s date, unless you request erasure at an earlier time. Your application will not be forwarded by me to other recipients within AU. [Insert any contact details for another manager at AU, if you believe that it might be relevant for the applicant to send the application to this manager.] Aarhus University is the data controller for the processing of personal data. Processing of your data is authorised under Article 6(1)(a), and possibly Article 9(2)(a) of the General Data Protection Regulation, cf. Section 6(1) and possibly Section 7(2) of the Danish Data Protection Act. Our data protection officer can be contacted by email at: dpo@au.dk. You are entitled to access the data, to have incorrect data rectified or erased, and to complain about the data processing to the Danish Data Protection Agency at: dt@datatilsynet.dk”
When you save the application, you should save it on a secure drive that is logged. You should also set up a “reminder procedure” to ensure that you erase the application no later than after six months.
Proposed response text to be sent as soon as the application has been received and read:
“Dear [name], Thank you for your application. [Write what you wish to achieve from initiating a dialogue with the applicant.] If we cannot offer you employment at the moment, we would like to retain your application for up to six months in the event of a job opportunity arising. If you do not hear from us, your application with supporting documents will be erased no later than six months from today’s date, unless you request erasure at an earlier time. Your application will not be forwarded by me to other recipients within AU. [Insert any contact details for another manager at AU, if you believe that it might be relevant for the applicant to send the application to this manager.] Your application will not be forwarded by me to other parts of Aarhus University. Aarhus University is the data controller for the processing of personal data. Processing of your data is authorised under Article 6(1)(a), and possibly Article 9(2)(a) of the General Data Protection Regulation, cf. Section 6(1) and possibly Section 7(2) of the Danish Data Protection Act. Our data protection officer can be contacted by email at: dpo@au.dk. You are entitled to access the data, to have incorrect data rectified or erased, and to complain about the data processing to the Danish Data Protection Agency at: dt@datatilsynet.dk”
When you save the application, you should save it on a secure drive that is logged. You should also set up a “reminder procedure” to ensure that you erase the application no later than after six months.