The Office of the Data Protection Commissioner (the Office) is an office established by the Data Protection Act 2019. In line with the Office’s vision, we aim to enhance trust and build transparency in how personal data collected during the recruitment process is handled. The Office processes your personal data in line with the Data Protection Act 2019 (the Act) and the Data Protection (General) Regulations.

This Privacy Statement describes how we collect, handle and protect your personal data in relation to our recruitment processes and programs. It only applies to the personal data of job applicants, potential candidates for employment, and those who participate and interact with our recruitment processes and programs. Your personal data is submitted directly to the Office through our online recruitment portal and directly from you through any additional requests the Office may make relating to the recruitment process. The recruitment process includes a direct job application, secondment application from another organization, pre-employment checks, shortlisting, interviewing, selection and onboarding of potential employees.

Processing personal data for the recruitment process means any operation or sets of operations which are performed on personal data or on sets of personal data whether or not by automated means, such as

1. Collection, recording, organization, structuring;
2. Storage, adaptation or alteration;
3. Retrieval, consultation or use;
4. Disclosure by transmission, dissemination, or otherwise making available; or
5. Alignment or combination, restriction, erasure or destruction.

Data Protection Principles

The Office will comply with data protection law. It requires that the personal information we hold about you must be: -

a. Processed fairly, lawfully and in a transparent manner.

b. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

c. Relevant to the purposes we have told you about and limited only to that which is necessary for those purposes.

d. Accurate and kept up-to-date.

e. Kept only for as long as necessary for the purposes we use it for and which we have told you about.

f. Kept securely.

By submitting your personal data to us you shall be deemed to acknowledge that:

• You have read and understood this Privacy Statement and agree to the use of your personal data as set out herein.
• You are not required to provide any requested information to us, but your failure to do so may result in our being unable to continue with our evaluation of your application for the job you have applied for.
• All of your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for employment.

Contact Us

We are committed to working with you to promptly respond to any questions or concerns you may have. If you have a question related to the Office’s recruitment process and a request regarding your personal data and would like to exercise your rights please reach out to us through vacancies.dpo@odpc.go.ke

What personal data do we collect?

The type of personal data requested by the Office in its recruitment process may vary depending on the role and position applied for. Personal data we may collect and process, as appropriate throughout the recruitment process will include, but is not limited to:

• name and contact details (such as telephone number, e-mail address and postal address);
• date of birth;
• KRA Personal Identification Number, proof or registration with NHIF and NSSF;
• curriculum vitae / résumé;
• current and previous employment details;
• academic background (such as your university or school diplomas/certificates and other educational achievements);
• languages spoken and level of proficiency;
• gender;
• marital status;
• evidence of identity such as national ID/passport/resident card;
• photographic images submitted or made as part of the recruitment process.
• criminal proceedings or convictions data including Ethics & anti-corruption related clearances;
• racial / ethnicity information;
• professional bodies memberships
• health related information including physical/mental health to ensure the Office provides reasonable accommodation where necessary.

After the Office makes an offer to you for employment, we may conduct further background checks and, to the extent permitted by applicable law, collect data related to criminal offences and proceedings from third parties such as, your references, your prior employers, and employment background check providers. We may also collect personal data about you online to the extent that you have chosen to make this information publicly available.

For what purpose do we collect your personal data?

We collect and use your personal data for legitimate human resources and business management reasons, including:

• identifying and evaluating candidates for potential employment
• maintaining records in relation to recruiting and hiring;
• ensuring compliance with legal requirements, including those relating to public health and workplace safety;
• carrying out criminal record checks and pre-employment searches, where applicable laws permit with your consent;
• protecting our legal rights to the extent authorized or permitted by law;
• where you are offered the position, verifying the Personal Data provided including your identity, address, right to work, employment history and academic background and other background screening purposes including, where allowed by law and criminal record checks; and
• protecting the workplace and communicating with medical professionals, law enforcement, or other public authorities in the event of an emergency or public health event, such as when the health or safety of you or one or more individuals may be endangered, including, to the extent permitted by applicable law, sharing data about the status of an infection, test results, and vaccination status.
• We may also use your personal data for analytics purposes, including in aggregated/anonymized form, to improve our recruitment and hiring process.

How we collect your personal data and the legal basis relied on.

We collect personal data through the Office’s online recruitment portal when you submit a job application and/or create a profile. The Office may also collect your personal data from social media channels such as LinkedIn when you choose to provide us with a link to your profile as part of your job application. Your personal data may also be collected from third parties during the recruitment process, such as references from previous employers.

The processing of your personal data in line with the reasons disclosed herein above shall be based on the following legal basis:

a.Consent - Where you provide your personal data as part of any job application advertised by the Office

b.Legitimate interest – the Office will process your personal data to evaluate your application, to ensure that we recruit suitable employees in line with the advertised job description, to manage our relationship with you and generally to evaluate and maintain the efficacy of our recruiting process;

c.Performance of contract - the Office will process your personal data in view of the potential contract of employment to be entered into upon successful recruitment process

d.Legal obligations – the Office will process your personal data in line with legal and regulatory requirements

Where we store your personal data?

Your personal data is collected through our recruitment online portal and stored on our secure servers locally. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the Office’s website for the recruitment process, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

How long will we keep your personal data for?

The personal data collected for recruitment purposes is store for up to 6 months if your application is unsuccessful and you do not proceed to interview stage, unless there is a specific stipulated statutory period. If you proceed to interview stage we will keep your personal data for 1 year unless you are successful in which case your personal data will be transferred to our human resource department to constitute part of your employee personal file, which is retained in line with our HR Staff Retention Policy.

Who do we share your personal data with?

Your personal data will be shared with individuals involved in the recruitment and interview process. These individuals will either be the ODPC recruitment team or senior management depending on the position applied for. Where third/ external parties are involved in the recruitment process, they shall do so as data processors under instructions from the Office and with contracts in place to ensure confidentiality and safeguard you right to privacy. If the Office relies on partner and/or third party to carry out any processing activities on your personal data, the same shall be disclosed on the recruitment portal and require your consent for the transfer of your personal data to the partner and/or third party.

Except to the extent described and for the purposes stated in this Privacy Statement, we do not disclose your personal data to third parties. We do not otherwise share or sell your personal data to third parties.

How do we safeguard your Personal Data?

We maintain appropriate organizational and technical measures to protect the security of your personal data. However, the Office requests your understanding that any data transmitted online cannot be guaranteed to be 100% secure due to the inherent risks of online data transmission.

Consequently, the Office recommends that you also take additional measures to protect your personal data. For example, install up-to-date anti-virus software, close browsers after use, keep confidential your login credentials and passwords, and regularly update software and apps to ensure you have the latest security features. If we learn of a data breach, we may attempt to notify you electronically so that you can take appropriate protective steps.

By using the Office website or providing personal data to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your personal data during the recruitment process. We may post a notice via our office website if a security breach occurs and also send an email to you at the email address you have provided to us in these circumstances. If you have any questions on the security measures we use, you may contact us using the contact information provided at the top of this Privacy Statement.

What rights do you have in relation to the personal data we collect?

In accordance with the Constitution of Kenya, the Data Protection Act and any other applicable law, you have the following rights as a data subject when the Office collects and processes your personal data: -

A right to have your personal data processed in accordance with your right to privacy;
• A right to request for access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information we hold about you, including the details of how we use that information and who we share it with;
• A right to amend or rectify your personal data if any of the information held about you is incorrect or out of date;
• A right to portability of your personal data;
• A right to request human intervention in automated processing activities to prevent occurrences like discrimination;
• A right to request erasure of your personal data;
• A right to demand that we cease the processing of your personal data or that we restrict the processing of your personal data;
• A right to request the transfer of your personal data to a third party.
• A right to withdraw your consent to the processing of your personal data, to the extent our processing relies on your consent as the lawful basis for processing. This right may not apply if there are other legal justifications to continue processing or we need to retain certain personal data where required or permitted under applicable law.
• The Office will take reasonable steps to verify your identity before granting you access to your personal data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by law. Depending on the circumstances and the request, we may not be permitted to provide access to personal data or otherwise fully comply with your request; for example, where producing your information may reveal the identity of someone else. We reserve the right to to deny your requests, where, in our discretion, they may be unfounded, excessive, or otherwise unacceptable under applicable law.

Disclaimers

a. Automated decision making and profiling -The Office uses diverse assessment tools throughout its recruitment process which may include aptitude tests or behavioral assessments. How you perform on these assessments may determine your progression to the next stage of the recruitment process. Data analytics and algorithms may from time to time be used to review applications. These algorithms help us prioritize the application review process and sort candidates based on professional characteristics that suggest strengths and capabilities necessary to perform the relevant role. The algorithms are designed to analyze the candidate’s application data and compare it to the job description and qualifications requested for the position. Any automated results will be considered in tandem with, and not in lieu of, human judgement. We evaluate each individual candidate on their own merits.

b. ODPC Job advertisements featured on third-party websites - This Privacy Statement does not apply to any processing of your Personal Data carried out by or on behalf of any third-party websites where our recruitment advertisements are displayed or to linked third-party websites that we not operate or control.

c. Job Application Fees – The Office does not charge a fee at any time during the recruitment process. You are advised to refrain from paying any fees to and/or sharing your personal data with third-parties.

If you have questions about this Privacy Statement, or if you wish to exercise your privacy rights, please contact us through vacancies@odpc.go.ke with the reference Attention: ODPC – Recruitment DPO.