Candidate Data Compliance - Are you prepared for the risks?

Beamery.com Private & Confidential - Do Not Share © Beamery Inc. All rights reserved
Candidate Data Compliance
1
Are you prepared for the risks?

Beamery.com Private & Confidential - Do Not Share © Beamery Inc. All rights reserved 2
Sultan runs product, technology and customer experience at
Beamery, partnering with customers to find and apply best
recruiting practices, including on compliance and data
management. He is a frequent speaker on all things product,
recruiting, data, talent operations and compliance.
Your speaker today
Sultan Saidov
President and Co-founder, Beamery
Icon
Placeholder

Charity giveaway!
Please submit questions during the Q&A session, and get an e-charity card from Beamery to
donate to your favorite charity

Disclaimer:
This discussion should not be
construed as legal advice , and you
should take your own legal opinion
on this subject matter

Agenda ■ Why are we here?
■ Data compliance in recruiting
● Recruiter experience
● Candidate experience
● Infrastructure
■ Compliance Q&A

Why are we here?
6
Today’s regulatory environment presents many risks to talent teams

GDPR (2018)
Why are we here?
Schrems ii - EU-US privacy shield invalidated (2020)
China Cybersecurity Law (2017)
CCPA (2020)
Russian data localization law (2015)
Global regulation is getting more complex
Schrems i - Safe Harbor invalidated(2015)

Why are we here?
Fines, brand image, and other risks
Russia
Fines up to $ 100,000 for an initial violation, up to $280,000 after that
GDPR
160,921 personal data breaches within the EEA, from May 25, 2018, up until now. However only ~350 fines
so far totalling 176m euros (most of this in 2020). Largest fine was for Google (50m euros in 2019), and in
2020 TIM telecoms 27.8m euros.
CSL
Fines and criminal prosecution for illegal collection of private data
Data Breaches
Fines can take place outside of GDPR including - British Airways (EUR 204M), Marriott Alliance (EUR 110M)
8

Impact of Schrems ii
9
Considerations for Talent Acquisition

Why are we here?
Schrems ii - privacy shield invalidated
SCC
Make sure your suppliers have ensured that not only they but their suppliers will replace any privacy shield
reliant mechanisms , with another valid method of data transfer - either through SCC with safeguards built in,
and/or binding corporate rules within their organisational entities. Note, that for 11 countries (e.g. Israel,
Switzerland) SCCs are not required (e.g. for your vendors and/or their sub processors that are based there)
Privacy policies
Companies (e.g. your vendors) will likely need to have updated their privacy policies (eg to remove references to
privacy shield), and the Privacy compliance statement
EU Servers
Some businesses - particularly those who have activities located solely with the EU - are choosing to work only
with vendors who can host their data solely in the EU (e.g. in Beamery we oﬀer EU hosting, in countries such as
in the Netherlands or Germany). However, this is not required by the GDPR regulations and is a business choice
10

Data compliance in recruiting
11
What areas of recruiting operations are aﬀected by global data regulation?

How can talent teams be compliant, while
still staying agile and offering competitive
candidates experiences?

How are daily recruiting activities
aﬀected?
What constraints should recruiters
be aware of?
What are the right of candidates
throughout the hiring process?
Is the recruiting experience
hindered by compliance
requirements?
What technical support is needed
to be compliant?
Recruiter experience Candidate experience Infrastructure
3 main areas of impact to take in consideration

Recruiting workflows need to adapt
14
Considerations
Consent Management Needs to be explicit under GDPR (EU) - or specifically the PECR rules
Data retention and deletion
Only opted-in data should be stored under GDPR. Data on citizens
from Russia or China might need to be stored in those territories.
Sourcing
Recruiters might need to send a consent link when first reaching out
to candidates in order to record consent
Diversity data visibility Certain data fields must be restricted access under EEO

Candidates understand their data rights
Candidates want to…
★ Easily opt out of communications or ask for their data to
be deleted (GDPR, CCPA)
★ Know what private data the company is collecting about
them (GDPR, CCPA)
★ Be reassured that they won’t be discriminated against
based on data shared in the application process (EEO)
15
Recruiters have to...
Where applicable, ensure their candidates have
been asked to opt-in (or equivalent).
Provide opt-out links, understand how to
delete/anonymize data
Be able to access and share candidate data
Restrict access to sensitive data

Consent capture in applications

Consent capture - include messaging channels

Beamery.com Private & Confidential - Do Not Share © Beamery Inc. All rights reserved 19
Give candidates control
Talent Portals
● Give candidates granular control of
communication preferences, including for
types of message, and for medium (e.g.
email, sms, notification)
● Enable more granular data capture for opt
out reasons
● Give candidates control of accessing their
Data, and requesting it to be forgotten /
deleted.
Provide a control center to manage
communication and compliance (e.g.
GDPR preferences)

Recipe: Data Privacy
Anonymize
profile
Consent is
opted in
(364 days)
Contact
Checked
(24hrs)When…
Then...
Trigger
Filter
Action
If…

What are the infrastructure and technology considerations?
21
Hosting requirements Automation and AI
Sub-processing and
integrations
Where the data is stored and processed, who can access it and from where, how long it is stored and if a record of all processing
is kept, how recruiting teams can manage their workflows in a compliant way at scale… all of the above are influenced by the
infrastructure in place.

Data infrastructure considerations:
“Critical information operators
[and Network operators] that
gather or produce personal
information...within the mainland
territory of the People’s Republic
of China, shall store it within
mainland China.”
Example: China
Cybersecurity Law

Data infrastructure considerations
“Personal data of Russian citizens
must be recorded, systematized,
accumulated, stored, refined (i.e.
updated, modified), and retrieved
only using databases located
within Russia. [However],
trans-border transfer of personal
data to foreign jurisdictions is not
prohibited...”
Example: Russia data
localization requirements

Ask me about global data compliance
24
A guided Q&A… More questions welcome!

Compliance Q&A
What are some common misunderstanding around data compliance
regulation that you see in TA teams?
25

Compliance Q&A
Any low-hanging fruits around data compliance that talent teams can
easily address?
26

Compliance Q&A
What are the some of the most confusing requirements you’ve seen, and
how do companies deal with them?
27

Compliance Q&A
What is the first thing to start with when trying to assess the state of your
candidate data?
28

Compliance Q&A
What should you ask your talent team to understand how compliant you
are with applicable data regulation?

Thank you!

Candidate Data Compliance - Are you prepared for the risks?

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Candidate Data Compliance - Are you prepared for the risks?

Similar to Candidate Data Compliance - Are you prepared for the risks? (20)

More from Beamery

More from Beamery (17)

Candidate Data Compliance - Are you prepared for the risks?