How to activate candidate anonymization in Clinch Talent
It’s important to be aware that under GDPR:
- Clinch Talent is a data processor
- Clinch customers are data controllers
Alongside being a compliant data processor, Clinch Talent provides the tools to allow our customers as data controllers to behave and operate in a compliant manner.
One such tool is the means to enable candidate anonymization, which, when administered effectively, can be used to protect the privacy rights of individual data subjects.
By enabling these options and making sensible choices that suit your company, Clinch Talent allows you to be fully compliant with GDPR, in a fully automated way. In true Clinch Talent fashion, our goal is for compliance without adding chores or manual tasks to recruiters schedules.
How it works
To enable anonymization for your candidates, please follow the steps below:
In the left menu, go to Settings > Company.
Scroll to find ‘Data Protection Rules’ or click on the relevant section in the list to the right.
If GDPR applies to you, click the green "+" button to add a new rule.
N.B. Clinch Talent's Data Protection Rules works in a similar way to the platform's job routing feature, i.e. you can choose to apply different data protection rules to specific subsets of candidates based on their location.
How it works
Choose from 'Type:'
- Country – This enables a specific set of data protection rules for all candidates in a specific country.
- Political – This enables a specific set of data protection rules for all candidates in the European Union.
- Continent – This enables a specific set of data protection rules for all candidates on a specific continent, e.g. Europe, Asia, or North America.
- Default – This set of data protection rules will apply to all those candidates who fall outside of the rules set above. Typically, Clinch Talent customers leave all settings OFF for 'Default' and apply rules for candidates in specific countries or regions.
N.B. These 'Types' are listed in order of priority given. For example, where rule sets for both Country AND Continent are in place, when a candidate visits from that country and continent, they will be subject to the Country rule set only.
Make the appropriate selections regarding ' Honor Do not Track' and 'Cookie Content Required." Note that if a candidate has Do Not Track (DNT) enabled on their browser, this will be interpreted (in compliance with GDPR) as actively not consenting to tracking cookies. The Clinch Talent hosted website will operate as if consent was denied by a candidate from a cookie consent message, i.e. the Clinch Talent hosted website will continue to work. However, no candidate tracking will take place. The visit will not be recorded against the candidate’s CRM record.
Cookie consent text
On initial visit to a Clinch Talent hosted page, a GDPR compliant cookie consent message will be shown, requesting consent for use of all three cookies listed at the top of this article.
The content of the GDPR compliant cookie consent message is configurable in the ‘Cookie Consent Text’ box. Enter your message now and be aware that as data controllers, customers are responsible for ensuring that messages are compliant with GDPR regulations.
Manually added candidates that match this rule should default to:
This relates to email notifications, for example, email campaigns that a company might send to candidates in bulk. In this instance, where a manually-added candidate matches the rules set for a GDPR-applicable country, for example, that candidate should default to "unsubscribed."
Next, you will need to determine the thresholds for anonymization of candidates.
Candidate added auto anonymize policy days: This will apply to candidates who have entered into the CRM themselves, i.e. they have completed a Clinch Talent call-to-action. Please enter the number of days that must pass with no candidate interaction before that candidate is anonymized. We recommend a minimum period of 730 days / 2 years based on the valid reason that companies need to store candidate information for some time due to candidates tending to interact with careers content over considerable lengths of time.
Company added auto anonymize policy days: This will apply to candidates who have been added into the CRM by the company via manual import. For this, we recommend a period of 30 days.
Notify company contact about candidates that perform anonymization process
Under GDPR regulations a candidate can withdraw consent at any time. As part of this “right to be forgotten,” a company can choose to have a notification sent to the company contact indicating that a candidate has gone through the “right to be forgotten” process.
Allow candidates anonymize themselves
On Clinch Talent, a candidate can view and adjust their consent preferences from their “My Settings” screen at any time. Please ensure that a link to 'My Settings' is visible on your careers site; if it is not, please contact firstname.lastname@example.org
Allow candidates export their data
GDPR regulations allow candidates to request their data in a "machine-readable" format. With this option enabled, you will be able to fulfil this requirement for candidates automatically.As this option lives on the candidate's "My Settings" screen, please ensure that a link to the 'My Settings' screen is visible on your careers site; if it is not, please contact email@example.com
For more on Clinch Talent's provisioning for GDPR, click here.