The Israeli Law Information and Technology Authority (ILITA) has published new guidelines on privacy principles for applying the provisions of the Protection of Privacy Act on jobs placement services.
The guidelines are a result of a four years process of consultations led by ILITA with placement services, employers and other relevant stakeholders. Their main objective is to enhance the privacy protection of job applicants in an environment where they have little if any choice with respect to the processing of their personal information.
Under the guidelines, the employer is the owner of the data that the placement service collects and processes at the employer's request. The placement service is the holder of that database. According to the Privacy Protection Act, as the holder of the database, the placement service does not have any rights to process the data for any purpose other than the purposes that the employer defined. Therefore, a placement service may not transfer such data to another employer without a separate and specific consent of the applicant.
ILITA regards the placement services as outsourcing services. Therefore, the employer must make sure that the placement service agreement is in-line with ILITA's guidelines for outsourcing the processing of personal information.
If a placement service holds data for multiple employers, then it must make sure that every employer has access to data that is relevant to that employer only. A placement service that holds information for five or more employers must appoint an information security supervisor.
The guidelines further provide that an applicant cannot waive the right to view data related to that applicant, and held by the placement service and the employer. Generally, placement services and employers must allow the applicant access without any cost to an exact copy of the placement service's opinion of that applicant. However, an applicant can provide a prior informed consent to limit the scope of the right to review the data, if the applicant is likely to suffer from a mental injury because of being exposed to that data, or if the data contains confidential information of the placement service, or of the employer.
The Protection of Privacy Act does not contain any explicit data retention provisions. However, ILITA believes that the prohibition on processing information for a purpose other than consented purposes forms a de-facto data retention provision. It follows that the employer and placement service must destroy or anonymize the data about that applicant, immediately after the use of the data for the placement process has ended. The above prohibition does not prevent employers from keeping opinions in an archive for lawful purposes, under strict 'need-to-know' access arrangements. Additionally, employers may keep a copy of the opinion in the employee's personal file.
The guidelines were published on February 28, 2012 and they take effect immediately. A copy of the guidelines (Hebrew) is available on ILITA's website.
For further detalis contact Dan Or-Hof, CIPP, at Pearl Cohen Zedek Latzer.
The guidelines are a result of a four years process of consultations led by ILITA with placement services, employers and other relevant stakeholders. Their main objective is to enhance the privacy protection of job applicants in an environment where they have little if any choice with respect to the processing of their personal information.
Under the guidelines, the employer is the owner of the data that the placement service collects and processes at the employer's request. The placement service is the holder of that database. According to the Privacy Protection Act, as the holder of the database, the placement service does not have any rights to process the data for any purpose other than the purposes that the employer defined. Therefore, a placement service may not transfer such data to another employer without a separate and specific consent of the applicant.
ILITA regards the placement services as outsourcing services. Therefore, the employer must make sure that the placement service agreement is in-line with ILITA's guidelines for outsourcing the processing of personal information.
If a placement service holds data for multiple employers, then it must make sure that every employer has access to data that is relevant to that employer only. A placement service that holds information for five or more employers must appoint an information security supervisor.
The guidelines further provide that an applicant cannot waive the right to view data related to that applicant, and held by the placement service and the employer. Generally, placement services and employers must allow the applicant access without any cost to an exact copy of the placement service's opinion of that applicant. However, an applicant can provide a prior informed consent to limit the scope of the right to review the data, if the applicant is likely to suffer from a mental injury because of being exposed to that data, or if the data contains confidential information of the placement service, or of the employer.
The Protection of Privacy Act does not contain any explicit data retention provisions. However, ILITA believes that the prohibition on processing information for a purpose other than consented purposes forms a de-facto data retention provision. It follows that the employer and placement service must destroy or anonymize the data about that applicant, immediately after the use of the data for the placement process has ended. The above prohibition does not prevent employers from keeping opinions in an archive for lawful purposes, under strict 'need-to-know' access arrangements. Additionally, employers may keep a copy of the opinion in the employee's personal file.
The guidelines were published on February 28, 2012 and they take effect immediately. A copy of the guidelines (Hebrew) is available on ILITA's website.
For further detalis contact Dan Or-Hof, CIPP, at Pearl Cohen Zedek Latzer.