General Data Protection Regulation (GDPR)

Recruitment privacy notice

The scope and purpose of this privacy notice

You have expressed an interest in being considered for a role with Dechert LLP (“Dechert”, “we”, “us”, “our”). This privacy notice will explain how we collect, use, share and otherwise process your personal data in accordance with applicable data privacy laws, specifically the General Data Protection Regulation (“GDPR”).

As a global law firm, we ensure that all our offices deal with all types of data, (whether personal or confidential data), to the same high standards of protection and transparency. However, please note that certain rights available under the GDPR may only apply depending on your location and the office you are applying to. If there are specific regional privacy rules which are inconsistent with the GDPR, we will have in place regional variations to our recruitment process to account for such variations. If you would like to discuss this further, please contact your local Dechert representative.

We may provide supplemental privacy notices on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data. Those supplemental notices should be read together with this Privacy Notice.

Who we are

We are a global legal services provider strategically based in key locations, our structure includes legal entities and partnerships registered in different jurisdictions some of which are limited liability entities. For full details please view our Legal Notice available on our website.

We are a data controller, and this privacy notice is issued on behalf of all Dechert entities, all of whom are joint data controllers of your personal data.

For any privacy related queries you can contact us by emailing privacy@dechert.com. Alternatively, you may directly contact your local Dechert representative.

What is personal data?

“Personal data” means any information relating to you such as your name, where you live, email addresses, telephone numbers etc. Personal data does not include data from which you can no longer be identified.

What personal data do we collect about you, how do we collect it and what do we use it for?

The types of personal data about you which we may collect, store and use are set out in the table below, and in each case we have specified the purpose and our ‘lawful basis’ for processing it. The GDPR specifies certain ‘lawful bases’ for which we are allowed to use your personal data. Most commonly, we will rely on one or more of the following lawful bases for processing your personal data:

a) if you have consented explicitly to us doing so;
b) if we need it to perform a contract we have, or may enter into with you;
c) if we need it to comply with a legal obligation; or
d) if we have a legitimate interest which is not overridden by your interests or fundamental rights and freedoms.

Please note, this information below sets out examples of personal data we may collect, however, in practice we may not collect all of these examples but only selected examples depending on your jurisdiction.

Category of personal data

Contact details

Examples
— Name, address, email address and telephone number, and photograph if provided

Purpose
— For administration purposes during the recruitment process

Lawful basis for processing
— Legitimate interests
— To take steps prior to entering and to enter into a contract with job applicants

Legitimate interest (where applicable)
— To make contact with job applicants during recruitment process

Category of personal data

Application related documents provided by candidates

Examples
— Application form, CV and cover letter, photograph, deal sheet, GPA transcripts, education certificates and writing sample

Purpose
— To assess job applicants

Lawful basis for processing
— Legitimate interests

Legitimate interest (where applicable)
— To make recruitment decisions and maintain standards of integrity and excellence in our workforce

Category of personal data

Application documents generated by the Company

Examples
— Test results, feedback and notes from interviews or other selection processes

Purpose
— To make recruitment decisions

Lawful basis for processing
— Legitimate interests

Legitimate interest (where applicable)
— To make and justify recruitment decisions and maintain standards of integrity and excellence in our workforce

Category of personal data

Details about current remuneration

Examples
— Current level of salary and benefit entitlements

Purpose
— To make decisions about the financial package on offer

Lawful basis for processing
— Legitimate interests

Legitimate interest (where applicable)
— To ensure appropriate and attractive financial packages are offered to job applicants

Special categories of personal data

The GDPR specifies some categories of personal data as being more sensitive and as such requires a higher level of protection. This is personal data which reveals or contains:

racial or ethnic origin
political opinions
religious and philosophical beliefs
trade union membership
genetic data
biometric data
health data
sex life or sexual orientation

Where we decide to process any special categories of personal data we will only do so where we have a lawful basis for doing so, and primarily because it is necessary:

for the purposes of carrying out our obligations and exercising specific rights in the field of employment/labor law; and/or
for the assessment of your working capacity.

In limited circumstances we may be required to process special category data from job applicants to respond to and defend legal claims.

The special categories of data about you which we may collect, store and use, are set out in the table below and in each case we have specified the purpose and our ‘lawful basis’ for processing it.

Please note, this information below sets out examples of special categories of personal data we may collect, however, in practice we may not collect all of these examples but only selected examples depending on your jurisdiction.

Category of special categories of personal data

Medical/health information provided as part of application process

Examples
— Details relating to any disability

Purpose
— To make reasonable adjustments

Lawful basis for processing
— Compliance with legal obligations and employment/labor law obligations

Category of special categories of personal data

Immigration information

Examples
— Passport, driving licence, visa, work permit

Purpose
— To check your right to work in the relevant jurisdiction

Lawful basis for processing
— Compliance with legal obligations and employment/labor law obligations

Category of special categories of personal data

Information for equal opportunities monitoring

Examples
— Race/ethnicity, sexual orientation, religion/philosophical belief & disability

Purpose
— To allow us to monitor equal opportunities

Lawful basis for processing
— Compliance with legal obligations and employment/labor law obligations

Category of special categories of personal data

Membership in religious organizations

Examples
— Details relating to membership in a religious organization

Purpose
— To make applicable tax deductions and provide tax records to religious organizations

Lawful basis for processing
— Compliance with legal obligations

We do not require you to provide any special categories of personal data other than those outlined in the table above. We recommend that you do not include any additional special categories of personal data in your application (unless requested by us), as it is unlikely to be relevant to the application process.

Personal data relating to criminal convictions and offences

For some roles we are obliged to seek personal data about criminal convictions and offences because it is necessary to carry out obligations and exercise specific rights in relation to employment/labor law and regulatory standards.

What if you do not provide the personal data we request?

It is in your sole discretion to provide personal data to us. If you do not provide us with all or some of the personal data we request, we may not be able to process your application to join us.

Change of purpose

We will only use your personal data for the purposes for which we collected it (as identified in the tables above), unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, you will be notified of the legal basis which allows us to do so.

Collecting personal data about you from third parties

In addition to the data we collect from you during the recruitment process, we may receive personal data about you from third parties, such as:

recruitment consultants/search firms;
public sources including any services accessible on the internet which you are using for professional networking purposes, for example LinkedIn;
Law schools;
Regulatory bodies, supervisory authorities; and
Other third party agencies who we instruct to run background checks.

With whom will we share your personal data?

We will not share your personal data with external third parties, unless your application for employment is successful and we make you an offer of employment. We will at this stage instruct our employment background check providers to contact you directly to facilitate contact with former employers to obtain references for you and where required, to obtain necessary criminal records checks. You will receive further information about this process directly from our employment background check provider. Additionally we may share your personal data with a relevant regulator such as the Solicitors Regulation Authority or otherwise to comply with the law.

Transferring personal data from the European Economic Area (EEA)

IF you are a Candidate applying for a role in the EEA We may transfer your personal data from the EEA to a Dechert office outside of the EEA. We will always ensure that there is a legal basis and a relevant safeguard method for such data transfer so that your personal data is treated in a manner that is consistent with, and respects the EU laws and other applicable laws and regulations on data protection. We have put in place EU standard contractual clauses as our safeguard method. If you require further information about this you can request it from privacy@dechert.com.

How long do you keep my personal data?

If your application for employment is unsuccessful, we will hold your data on file for up to two years after the end of the relevant recruitment process. If you agree to allow us to keep your personal data on file, we will hold your data on file for a further one year for consideration for future employment opportunities. At the end of that period or earlier you may withdraw your consent by notifying us at privacy@dechert.com, your data will be deleted or securely destroyed in accordance with our Records Retention Policy.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file. The periods for which your personal data will be held are explained in our Staff Privacy Notice which will be available to you should you be successful.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.

Your rights in relation to your personal data (for candidates applying for roles in, or based in the EEA)

You have rights as an individual which you can exercise under certain circumstances in relation to your personal data that we hold. These rights are to:

— request access to your personal data (commonly known as a “data subject access request”) and request certain information in relation to its processing;

— request rectification of your personal data;

— request the erasure of your personal data;

— request the restriction of processing of your personal data;

— object to the processing of your personal data.

You also have the right to receive your Personal Data in a structured, commonly used and machine-readable format and to have us transmit your Personal Data to another controller if:

— you have provided the Personal Data to us; and
— the processing is based on consent pursuant to:

— point (a) of Article 6(1)of GDPR; or
— point (a) of Article 9(2) of GDPR; or
— point (b) of Article 6(1) of GDPR and the processing is carried out by us by automated means, subject, to any legal restrictions which may apply.

If you want to exercise one of these rights please contact us at privacy@dechert.com.

Complaints

In the event you have a complaint, please discuss this with your local Dechert representative, or please contact us at privacy@dechert.com.

For Candidates applying for roles in, or based in the EEA, you also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Fees

Fees are not required to exercise any of your individual rights mentioned in this Privacy Notice. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

No automated decision making

We do not apply automated decision making or profiling techniques.

Data Protection Officer

Our data protection officer is Olaf Fasshauer. He can be reached at Dechert LLP, 160 Queen Victoria Street, London, EC4V 4QQ, United Kingdom or by emailing privacy@dechert.com.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us by emailing privacy@dechert.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless we now have an alternative legal basis for doing so.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will make an updated copy of such privacy notice available on our website.

Further information

If you have any concerns or require any further information, please do not hesitate to contact privacy@dechert.com.