Transparency data

Data Protection Statement /Job Applicant Privacy Notice (the “Notice”)

Published 21 March 2024

PLEASE NOTE: This Notice is applicable to individuals (hereinafter referred to as “you”, “your”, as appropriate in the particular context) engaging with the Student Loans Company Limited (“SLC” or “we”, “us”, “our”) candidate application and recruitment process. The Notice explains how SLC and others may use personal information (as defined below).

SLC is a non-profit making Government-owned organisation set up in 1989 to provide loans and grants to students in universities and colleges in the United Kingdom (“UK”). Certain functions relating to the student finance schemes within the UK have been transferred to SLC by:

• the Secretary of State for Education,

• the Welsh Ministers,

• the Department for the Economy, Northern Ireland, and

• the Scottish Ministers.

As part of our candidate application and recruitment process SLC  collects, processes and stores personal data about you. Personal data is any data or information from which an individual can be identified or data which when mixed with other information held about the same individual would make it obvious as to who the subject of the data is. Examples of personal data include name, telephone number and employment history.

We may also collect, process and store special category data about you. Special category data includes, for example, information about an individual’s racial or ethnic origin, religious or philosophical beliefs, biometric data (where it is used for identification purposes), health or sexual orientation. We will only process this where it is necessary, and any processing will be done in accordance with our obligations under relevant data protection legislation.

SLC is committed to being transparent about how it uses your data and meets its data protection obligations. This Privacy Notice sets out:

1. Why we process your data;

2. What data we might process; and

3. How your data is processed as part of the candidate application and recruitment process.

Throughout this Notice we use the term “processing” to cover all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of the data.

1. Why we process your data

In order to manage your application, we need to process certain data about you. SLC must have a legal basis for processing your personal data and special categories of your personal information may only be processed where an additional lawful basis applies. We will process your data for the purposes of progressing your application as required by law or regulatory requirements, so not all of the purposes for which we process your personal data will apply to you all of the time. SLC’s processing will always be fair and lawful and in accordance with applicable data protection legislation. In summary:

• We may need to process data to take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into (and comply with our obligations under) a contract with you;
• In some cases, we need to process data to ensure that we are complying with our legal obligations; for example, it is mandatory to check a successful applicant’s eligibility to work in the UK before employment starts;
• SLC has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job;
• We may also need to process data from job applicants to respond to and defend legal claims;
• SLC may process special categories of data, such as information to monitor recruitment statistics and to comply with legal obligations in relation to equality and diversity. We may also collect information about whether or not applicants are disabled in order to make reasonable adjustments for candidates who have a disability in accordance with legal obligations in relation to equality; and
• We will also process your personal data to comply with obligations and exercise specific rights in relation to employment, social security and/or social protection.

2. What data we might process

We may collect, store, and process the following categories of information:

• Personal details such as name, address (including proof of address), date and place of birth,  telephone number(s);
• Work history/job data: previous employers, positions, dates;

· Remuneration: basic salary, benefit entitlements, bonuses;

· Education and work history including professional qualifications, skills and/or memberships;

· References to include regulated references where necessary (this could include absence   information received from referees);

· Nationality/visa/right to work information (e.g. passport/driving licence/national insurance      numbers/birth certificate/evidence of name or gender change);

· Results of pre-employment screening checks (e.g. credit history and criminal records checks where permitted by law);

· Notes from interviews and/or assessment results e.g. psychometric test or written assessment results;

· Bank account details for salary payment purposes (if successful).

· Images from on site CCTV and audio recordings of telephone interviews (if relevant);

During the process we may also capture some special category data about you (e.g. disability       information), in order to make reasonable adjustments (to enable our candidates to apply for jobs with us, take online/telephone assessments, attend interviews/assessment centres,  prepare for starting at SLC if successful, and to ensure that we comply with regulatory obligations placed on us with regard to our recruitment) and to allow us to complete pre-employment checks.

3. Who we share your data with

SLC will need to share your personal data internally and may require to share it with some external third parties (e.g. Credit Reference Agencies) or associates of SLC. Some of these third parties or associates may be located and/or may carry out searches outside the European Economic Area (“EEA”). Your information will only be shared if it is necessary or required and permitted by law (for example in order to carry out pre-employment screening).

The recruitment process will involve:

• Assessing and progressing your application;
• Assessing your suitability (eg. skills, experience, and behaviours for the role); and/or
• Activities needed to complete the on-boarding and screening process should your application be successful.

To enable these processes your personal data may be shared internally, but the information shared is limited to what is required by each individual to perform their role in the recruitment process: For example, your personal data may be shared internally with:

• Employees who would have managerial responsibility for you or are acting on their behalf;
• Employees in Human Resources (HR) who have responsibility for certain HR processes (for example recruitment, assessment, pre-employment screening (including checking whether applicants have a student loan and/or arrears);
• Employees in Legal, Risk, HR, Counter Fraud with responsibility for investigating issues of noncompliance with laws and regulations, policies and contractual requirements;
• Employees in Information Technolopgy (IT) who manage user access;
• Employees in compliance and audit functions in relation to specific audits/investigations; and
• Employees in Estates / Facilities.

SLC may also need to share your data with certain external third parties or associates including:

• Companies who provide candidate interview and assessment services to SLC;
• Suppliers who undertake background screening on behalf of SLC (credit checking agencies, criminal checking bureaus, etc.);
• Academic institutions (Universities, colleges, etc.) in validating information you’ve provided; and
• Other third-party suppliers (or potential suppliers) who provide services on our behalf.

Pre-employment checks:

Given the nature of our business, we have legal and regulatory obligations to ensure that the people we employ can be relied on to handle public money and customer information responsibly. As part of the selection process, SLC uses third parties to perform a number of pre-employment checks (reference, criminal record and credit reference; for example, credit reference agencies will supply us with information that will assist us with our recruitment decision. The agencies will record details of the search, but will not make them available for use by lenders to assess your ability to obtain credit. You have the right of access to your personal records held by credit reference agencies). These pre-employment checks are only performed on candidates who have been selected for a role. We provide the third parties with your name, address and email address; they will then contact you direct in advance of carrying out the checks. We can supply the names and addresses of the third parties we use upon request. We will also check whether an applicant has a student loan and/or arrears.

4. How we protect your information

We have  in place appropriate organisational and technical (security) measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This is done in accordance with SLC’s Information Security Policy.

We may transfer the personal information we collect about you to other countries outside the EU in carrying out the specific purposes that the personal information was collected for. We will only transfer your personal information to other countries outside of the EU whose data protection laws offer an equivalent or greater level of protection than EU and UK data protection laws. Where this is not possible, we will ensure appropriate safeguards are in place to ensure that your personal information is protected.

5. Automated Decision making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We are allowed to use automated decision-making:

1. Where we have notified you of the decision and given you 21 days to request a reconsideration;

2. Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights; and

3. In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

6. How long SLC keeps your data

If your application for employment is unsuccessful, SLC will hold your data on file in accordance with our Records Management Policy. For more information on data retention, see the SLC Records Management Policy by visiting www.gov.uk/government/publications/slcs-data-retention-policy

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file and retained in accordance with our Records Management Policy. If successful, our Employee Privacy Notice will apply to you.

You may be asked when you submit your CV whether you give us consent to hold your details in order to be considered for other positions.

7. Your duty to inform us of changes

It is your responsibility to keep your personal data up to date so that accurate application records can be maintained. If you need to make any changes to your personal data once you have submitted your application, then you should contact SLC’s HR Department.

8. Your rights of access, correction, erasure, and restriction

You have the following rights in relation to your personal information:

• Request access to your personal information: You have a right to have access to the personal information which we hold about you, subject to certain limitations - this is referred to as a data subject access request, or DSAR. Visit https://www.gov.uk/government/publications/data-subject-access-request for more information if you wish to exercise this right.

• Request correction of your personal information: You have a right to have your personal information corrected, or rectified, if it is inaccurate or incomplete. If you become aware that any of the data which we hold about you is inaccurate, you should contact us as soon as practicable. You must notify us immediately on becoming aware of any change of circumstances which require changes to be made to any of the personal information which we hold about you.

• Request erasure (or deletion) of your personal information: You have a right to request the deletion or removal of your personal information where there is no compelling reason for its continued processing. Your right to make such a request will arise in specific circumstances, for example, where data is no longer necessary for the purpose for which it was collected or where you withdraw your consent for processing your data (and this is the sole basis on which your data is processed). If you would like to exercise this right, you must submit a written request specifying the information which you wish deleted. We will then consider this request in accordance with our obligations under data protection laws.

• Request the restriction of processing of your personal information: You have a right to block or suppress the processing of your personal information in certain circumstances. If for example you contest the accuracy of the personal data, processing may be restricted until the accuracy of the personal information has been verified. This may also apply where you contest that the processing is unlawful. If you would like to exercise this right, you must submit a written request to specifying the information on which you would like us to impose a processing restriction.

• Request the transfer of your personal information to another party: You have a right to obtain and re-use your personal information for your own purposes across different services – this is referred to as the right to data portability. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. If you would like to exercise this right, you must submit a written request to specifying the information which you wish to be transferred. Where the right applies, we are obliged to comply with any such request within one month.

• Object to us processing your personal information: You have the right to object to the processing of your personal data if it is based on the performance of a task carried out in the public interest. You also have a right to object where we process your information for research purposes or where we carry out automated processing (see Automated Decision-Making section above). If you would like to exercise this right, you must submit a written request to outlining the grounds upon which you object. We will consider any request in accordance with our obligations under data protection laws.

• Right to Withdraw Consent In the limited circumstances where you may have provided your consent to us processing your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please see the relevant contact numbers listed on page one of this Notice. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are required to do so by law, or have another legitimate basis for doing so in law.

If you want to exercise any of these rights, please write to: Subject Access Requests, Verification Operations, Student Loans Company Limited, 100 Bothwell Street, Glasgow, G2 7JD. Please note that we may need to request specific information from you to help us confirm your identity and ensure that we comply with the right you are exercising. We are obliged to comply with any such requests within one month. This may be extended to an extra two months when the request is complex.

9. What if you do not provide any data

You are under no statutory or contractual obligation to provide personal data to SLC during the recruitment process, however, if you do not provide all of the information we require, we may not be able to process your application properly or at all.

10. Data Protection Officer and the Right to Complain

We have appointed a Data Protection Officer (“DPO”) to oversee compliance with this Notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO:

Data Protection Officer

100 Bothwell Street

Glasgow

G2 7JD

Email: DPO@slc.co.uk

You also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues about the way in which we process (or have processed) your personal information. You can contact the ICO by writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

Email: icocasework@ico.org.uk

Telephone – 0303 123 1113

11. Changes to this Notice

We reserve the right to update this Notice at any time. We may also notify you in other ways from time to time about the processing of your personal information.

V11 - March 2023

(Notice reviewed annually)