Factsheet: Protecting privacy in recruitment
Overview
Agencies collect, use, and disclose personal information when managing employment matters under the Public Service Act 1999. In the context of recruitment, the collection, use, storage, and disclosure of personal information must also be undertaken in accordance with obligations arising under privacy and information management legislation.
When sharing merit lists[1] agencies must handle all candidates’ personal information in accordance with the Privacy Act 1988(Cth) (Privacy Act) and the Australian Privacy Principles (APPs).
The Australian Government Agencies Privacy Code also sets out specific requirements and key practical steps agencies must take as part of complying with the APPs. Agencies must also comply with their own privacy management plans and policies developed within this legislative framework. They should also ensure staff are adequately trained on privacy, merit-based recruitment, and records management practices.
Privacy notices
APS agencies must have a privacy collection notice relating to the collection of personal information for all recruitment activities. The notice must outline how the agency collects, stores, and uses or discloses personal information provided during the recruitment process, including who it may be shared with.
Privacy notices support compliance with the Privacy Act and encourage informed participation of candidates by explaining what personal information is required and how it will be used.
Agencies may only use or disclose personal information for the original or primary purpose for which it was collected (unless an exception applies). Privacy collection notices should highlight the primary purpose of the collection, the types of personal information agencies will collect and why, how the agency will use and disclose the information (including examples of usual disclosures) and should seek consent for any secondary use (including for the purposes of sharing merit lists). A privacy notice is for transparency and awareness, whereas express consent is where a candidate’s agreement to a use of their personal information is specifically obtained and where they have given a clear indication of their agreement, e.g. by ticking an unticked box or saying yes.
Privacy notices should inform candidates that the agency and panel may obtain personal information through its own inquiries, including information collected outside planned recruitment activities or from sources other than the nominated referees, where such collection is relevant to assessing work-related qualities and any relevant affirmative measure eligibility (where it is appropriately tested and subject to procedural fairness.)
Privacy notices should also outline that, if the candidate is placed on a merit list, their details may be used within the agency or disclosed to other APS agencies seeking to fill similar vacancies. To comply with their legislative privacy obligations an agency must obtain the candidate’s express consent in order for the merit list or pool to be shared. This could be obtained by requiring the candidate to a check a box indicating their consent (or alternatively that they do not give consent).
Privacy notices should also include information relating to Public Service Gazette notification requirements. Specifically, the notices should capture, if the candidate is offered a promotion within the APS or an APS engagement at a higher ongoing equivalent-level from the Parliamentary Service, following a recruitment process, the promotion or engagement (including the candidate’s name) will be notified in the Public Service Gazette via the APSJobs platform in accordance with the Australian Public Service Commissioner’s Directions 2022 (the Directions). It is important to note in instances such as this the candidate’s consent is not required. However, names can be withheld in certain circumstances. Please see Guidance on Public Service Gazette requirements.
Selection panels should only receive information relevant to the assessment
When providing selection panels with the candidate pack, panel members should only receive the candidate information necessary to undertake a merit-based assessment of the candidate’s suitability for the role. This includes information about candidates’ skills and experience and should exclude, for example, information relating to diversity, and residential information (where it is not required for the panel to assess candidate suitability). Recruitment systems should be configured to support this approach.
If candidates voluntarily include personal information within attached documents (such as a resume) agencies can reasonably assume the candidate expects the panel may receive this information and therefore it is not expected agencies redact the information.
Answers to integrity questions would not usually be provided to the selection panel (these are usually considered by the delegate with the support of the agency’s HR team and/or other relevant areas.[2])
There are some exceptions to this general rule that selection panels should only receive information relevant to the assessment. This includes but is not limited to:
- reasonable adjustments: where the information is required for consideration of a request for a reasonable adjustment to allow a candidate to participate equitably in a recruitment process, and
- administration of assessments: where the information is necessary to inform the appropriate and inclusive administration of assessments. An example of this can include providing the candidate’s contact number to the chair of the panel to enable them to be contacted if there are technology issues in an online interview. The guiding principle should be whether the person has a ‘need to know’ the information.
Providing the selection panel with only the information necessary to conduct the assessment of candidates limits any real or perceived impact of unconscious bias on the selection process. The panel’s attention can be focused on conducting a merit-based assessment and the selection process is more inclusive. It can also enhance the reputation of the APS as a fair and equitable employer.
Information should only be used for the purpose of collection
Agencies should only use and disclose a candidate’s personal information as outlined in the relevant privacy collection notice and in ways the individual would reasonably expect.
Where information is collected during recruitment for statistical purposes it may only be used for this purpose. It cannot be used to assess candidates. For example, demographic or personal information may be collected from candidates during the recruitment process, and an agency may use this data, in line with their privacy notice, to inform workforce planning and support diversity initiatives.
In this case, the information should only be provided to the area of the agency responsible for the use of this information. Agencies should have clear protocols regarding access to the data and be clear and transparent about who has access to it and why, to avoid any real or perceived bias in the recruitment process. Agencies should ensure their recruitment system supports this use and limits access to information as appropriate.
Sharing merit lists or pools and privacy
Sharing merit lists between agencies supports the efficient use of resources and management of talent across the APS. The proper management and sharing of merit lists builds community trust in APS recruitment practices and promotes effective use of merit lists. It also ensures decision-making is transparent and accountable by supporting agencies to justify candidate selections and clearly document all employment decisions.
When sharing a merit list an agency should:
- obtain prior informed candidate consent to sharing
- remove the details of any individuals who have declined to have their details shared
- share only relevant information that is reasonably necessary, and
- comply with all relevant record-keeping obligations.
Candidates on a merit list must give their explicit informed consent to sharing their details. Agencies can determine the most appropriate method of obtaining candidate consent to sharing, for example prominently as part of the application process by opting in to a statement agreeing to have their details shared as part of a merit list. However, if consent to sharing is not provided during the application process, it must occur before candidates’ details are shared.
Where a candidate has advised they do not want their details shared with another agency, the candidate’s details must be removed before sharing a merit list or pool. Candidates can withdraw consent at any time, so agencies should have administrative processes in place to efficiently remove candidate details.
In SES recruitment, agencies may also need to provide candidate details to the Australian Public Service Commission. Agencies should ensure their notice to candidates covers this provision and candidate consent is obtained.
What to include when sharing a merit list or pool
When sharing a merit list, sufficient information to inform a decision should be included. This should include the selection report (which should include the referee reports) and any other relevant information used to determine candidates’ suitability for a vacancy, such as candidates’ resumes.
To support the delegate’s assurance the process was merit-based all relevant documents should be provided in full, where reasonable and practicable. Information not relevant to the assessment of suitability that has already been redacted in the course of conducting the recruitment process or information about third parties that is not relevant can be excluded. Referees should be notified during the course of providing their referee report that the report may be shared.
Agencies must provide all ranked or pooled candidates (yet to accept a role) when sharing a merit list or pool with another agency, where candidates have agreed for their details to be shared.
Implement effective records management practices
Good records management practices are essential for transparency and accountability in decision making and supports the APS Value of Stewardship. Effective information management also enables the APS to uphold information access rights for individuals and the community, handle personal information responsibly, ensure work is informed by accurate data and comply with legal responsibilities.
Agencies may be required to provide information as required by legislation. Effective records management practices will enable an agency to comply with these responsibilities.
Privacy and using recruitment providers
When working with recruitment providers agencies should take reasonable steps to ensure the provider is complying with their privacy obligations. This includes ensuring communication is secure and recruitment providers abide by any terms relating to privacy (including the use, storage, and deletion of personal information) contained in its agreement with the agency. This may require ongoing oversight of recruitment providers’ privacy practices. For more information, agencies should reach out to their Privacy Officers.
APS Agency privacy notices should also include information about the access, use and/or disclosure of personal information to third party providers such as scribes, recruitment agencies or other third parties assisting the agency to undertake the recruitment activity. The agency should draw the candidates’ specific attention to the privacy policy prominently, for example when the candidate is just about to submit their application.
For more information
For more information on legislative privacy obligations, please refer to your agency’s Privacy Officer, legal or governance team. For information on the Privacy Act or the APPs, please refer to the Office of the Information Commissioner Contact us | OAIC
For information on withholding names from the Public Service Gazette please read our webpage on Public Service Gazette requirements.
For information on records management, please refer to your agency’s Record Management Officer or the National Archives of Australia Contact us | naa.gov.au
The APSC have also developed Recruitment factsheets, case studies and templates to support recruitment in the APS, please see our webpage Selecting in recruitment.
For further guidance on merit-based recruitment please contact the Employment Team at employmentpolicy@apsc.gov.au
Footnotes
[1] For the purpose of this fact sheet the term merit list is used to refer to the various types of merit lists created by agencies, including ranked merit lists, merit pools and ranked merit pools. ↩ Return to text
[2] Answers to integrity questions may be relevant to the assessment of suitability for role. However, responses that contain personal information (including sensitive information) should only be provided to the minimum number of persons required. It may be appropriate, in some circumstances, for the delegate to make any decisions as they relate to merit, with the support of a HR practitioner and/or any other relevant areas (e.g. Integrity and Fraud / Professional Standards teams) rather than such information being provided to the panel. ↩ Return to text