29 May 2020
This Data Privacy Statement is intended to describe the practices EY follows in relation to the Global Recruitment Management System (“System”) with respect to the privacy of all users of the System.
At EY, we have focused on implementing fair information practices that are designed to protect your privacy and your personal information. We believe that everyone benefits from the free flow of information when that information is gathered and used responsibly. Therefore, EY has set itself the task of providing you with comprehensive information about how we will use your personal information within this System and to inform you about your rights in this regard.
Additional information about the processing of a job applicant’s personal data is available in our privacy notice (see “Purposes for which we use personal data”, subsection “Job applicants”).
If you have any questions regarding the processing of your personal information in the System, please contact the EY data protection team.
This section explains how your personal information will be used when you submit information into the System.
The provision of your personal information is optional at any time. However, please be aware that your refusal to provide us with your personal information or to process it in the System may result in the data controller not being able to carry out any activity related to your recruitment in this online environment. You have the option to send your application directly to an EY recruiter within your country. You can contact the EY recruiter directly by e-mail or by telephone. The relevant contacts to all EY member firms can be found here.
The data controller for your personal information is the EY member firm which is responsible for the advertised position and to whom you address your application. Details of the EY member firm responsible for your application can be found in our Careers site on EY.com.
It is possible that EY member firms may be jointly responsible for your personal information if you submit applications to multiple EY member firms via the System.
Our purpose for processing your personal information is to assess your suitability for a role you have applied for, to contact you for future potential roles that might be of interest to you and to help us develop and improve our recruitment process.
The lawful basis we rely on for processing your personal data in the context of the role you have applied for is article 6(1)(b) of the EU General Data Protection Regulation (GDPR), which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.
The lawful basis we rely on for processing your personal data in the context of future roles that might be of interest to you is article 6(1)(a) of the GDPR, which relates to processing for which you have given consent. Please email us if you would like to withdraw your consent.
If you provide us with any information about reasonable adjustments you require – for example under the UK Equality Act 2010 - the lawful basis we rely on for processing this information is article 6(1)(c) GDPR to comply with our legal obligations.
The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.
EY Global Services Limited ("EYGS"), a private company limited by shares in England and Wales, registered office, 6 More London Place, London SE1 2DA, United Kingdom, registered number 5483856, licenses the System from Oracle America, Inc., 500 Oracle Parkway, Redwood Shores, CA, 94065 United States (“Oracle”). Oracle manages the System on behalf of EYGS for the benefit of EY member firms globally.
The information you provide in the System may be shared by EYGS for recruitment purposes with one or more EY member firms located throughout the world (see the 'Why do we need your personal information?' section below). EYGS is acting as a joint data controller with each EY member firm which advertises a position on the Careers site of EY.com.
Access to your personal information is limited by need. All recruitment staff within the EY member firms worldwide have access to your profile on the database and are able to match your details to current and future vacancies.
Oracle can access your personal information as is necessary to perform its functions but may not share any information without first obtaining permission from EYGS. From time to time, in addition to Oracle we may need to share your personal information with other third parties (see for an example, the section on “IBM Watson” below). However, we will only disclose your personal details for the following reasons:
- When it is necessary to involve a third party service provider in order to facilitate or extend recruitment services.
- When it is necessary for (internal or external) auditors to audit our recruitment services.
- When explicitly requested by you.
- As required by a court order or any other legal or regulatory requirement.
We take appropriate security and legal precautions to safeguard the safety and integrity of personal data that is transferred within the EY organization. EY has implemented binding corporate rules (BCRs) that allow for global transfers within the EY organization of personal data originating in the EEA in accordance with applicable European privacy laws. The BCRs require all EY entities worldwide to use the same standards of protection for personal data.
You can access our BCRs here.
Ernst & Young LLP, US, and its affiliated US entities, adheres to the EU-US and Swiss-US Privacy Shield Frameworks published by the US Department of Commerce. To learn more, see Ernst & Young LLP’s Privacy Shield Data Privacy Statement.
To the extent your personal information originating from the European Economic Area (EEA) or Switzerland is transferred to Oracle locations outside the EEA or Switzerland that have not received a binding adequacy decision by the European Commission or by a competent national data protection authority, such transfers are subject to terms of the EU model clauses approved by the European Commission which apply to the agreement between EYGS and Oracle.
You have a responsibility to ensure you submit accurate information into the System and keep it up to date. This can be done via the "Candidate Profile". The Candidate Profile requires a valid e-mail address as a login, along with other information, some of which is mandatory. Mandatory information will be marked accordingly. Your email address allows us to communicate with you if your qualifications and/or preferences match job opportunities, or if you opt to receive automated notifications of job postings at any EY member firm.
Your Candidate Profile also makes it possible for you to access the System to monitor the progress of your application or to amend your personal details should you wish to do so.
If you wish to apply for a job in a country outside of your home country, we may need to ask you questions that are specific to the country where the job is located. This is because in certain countries, before we can offer someone a job, we have to ask certain additional questions. These questions will be relevant and necessary for the job advertised and consistent with EY's Values.
When applying for a job in Peru your agreement and consent is obtained in accordance in accordance with article 12 of Law N° 29733 Personal Data Protection. Further information can be found by accessing this web page.
When applying for a job in Mexico your agreement and consent is obtained in accordance with the Federal Law for Protection of Personal Data in Possession of the Private Sector from July 6th, 2010 about personal data protection.
When applying for a job in Colombia, your agreement and consent will be obtained under applicable Data Protection regulations. You are not forced to answer questions related to the special category data. For further information please consult our local Data Protection Policy.
When applying for a job in Malaysia, your agreement and consent is obtained in accordance with the Personal Data Protection Act 2010 (Act 709). Further information can be found by accessing this web page.
1. Purposes for which personal information will be used
Applicant's personal information will be used only within the scope of the following purposes:
- Announcing, and receiving applications for, various seminars and other events related to hiring
- Screening applicants for hiring
- Contacting applicants regarding, and handling administrative affairs related to, the screening of applicants for hiring
- Statistical analysis for future hiring activities
- In cases of applicants who have been hired, the following purposes after commencement of their employment
- Audit and other assurance activities, advisory activities, risk management and control related activities, transaction service related activities, and other various service activities
- Announcement of, and activities involved in the operation of, various seminars and study meetings
- Personnel affairs, accounting, and other management activities
- Internal control activities, such as independency and quality control
2. Shared use of personal data within the EY member firms
Personal information provided by applicants will be stored in Taleo’s servers located in the U.S. and will be shared among the EY member firms (including those located in foreign countries), including EY Global Services Limited (UK), for the purposes listed in (1) above.
Person responsible for the management of shared personal data:
- Chairman, Ernst & Young ShinNihon LLC.
- Leader, Ernst & Young Tax Co.
- President, Ernst & Young Transaction Advisory Services Co., Ltd.
- Representatives, EY Advisory & Consulting Co., Ltd.
- President, EY Japan Co., Ltd.
Items of shared personal information: Name, e-mail address, address, telephone number, educational background, work experience, etc.
For the scope of the EY member firms, please visit this web page.
For the scope of the EY Japan member firms, please visit this web page.
3. Safety management of personal information
In order to prevent applicants’ personal information from being divulged or otherwise misused, we will handle such personal information safely under strict management in accordance with our “Policies on protecting personal information” and “Control Rules for the Protection of Personal Information.”
Personal information of those who are hired after screening for hiring will be appropriately managed as basic information after joining us. Personal information of those who are not hired will be disposed of or deleted appropriately after completion of the screening activities.
In India, the United Kingdom and the United States, we use IBM Watson Recruitment Express (“IBM Watson”) to assist with the screening of candidates for jobs within EY. Your personal data will be processed by IBM Watson for the following purpose: to perform an artificial intelligence analysis and provide a suitability score to EY recruiters in relation to your job application. Although IBM Watson provides an automated recommendation based on a candidate’s suitability score, an EY recruiter is required to manually make the final decision about which candidates are successful.
EY Global Services Limited licenses IBM Watson from IBM Global Business Services, PO Box 41, North Harbour, Portsmouth, PO6 3AU, United Kingdom. IBM Watson is hosted on servers in Sterling, Virginia at a colocation facility (Cyxtera), Washington, D.C., and San Jose, California. To the extent your personal information is transferred to IBM Watson locations outside the EEA that have not received a binding adequacy decision by the European Commission or by a competent national data protection authority, such transfers are subject to terms of the EU model clauses approved by the European Commission which apply to the agreement between EYGS and IBM Watson.
Your personal data can be accessed by:
- Third party IBM users who have access to EY’s instance of IBM Watson to provide technical support upon EY’s request; and
- Internal EY Recruiters who process the suitability scores as part of the candidate screening process.
This processing is necessary for the purposes of the legitimate interests pursued by us (except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data). The specific legitimate interest pursued is: human resource management, including performance reviews and recruitment.
You may wish to forward an advertised job vacancy in the System to a friend. You can do this by clicking on the "SHARE" link which can be found in each job description. When you use this functionality, we may require your e-mail address and the e-mail address of the recipient, your friend. We collect this information so that we can forward the job description and your e-mail address to avoid the possibility of the information being treated as spam. In addition, when we contact your friend, he/she will be provided with full details of how their information will be used, specifically in relation to their rights and details of the EY Member Firm acting as a data controller, in line with this statement.
All data submitted in the System, unless deleted earlier at written request, will be retained as long as you have expressed interest in EY or until you have secured a position with EY (i.e., you have obtained an ‘hire’ status in our System). However, please note that your data will not be kept more than 36 months after the last contact with you. We will provide you the opportunity to re-opt in every 36 months. If you do not opt-in, your data will be removed from the System.
For some countries, a different retention period will be applied:
- 4 weeks: the Netherlands (measured from finalization of recruitment process; with explicit consent, the data of applicants can be kept for 12 months)
- 6 months: Germany, Denmark and Greenland, Finland, Iceland & Sweden; Belgium (measured from finalization of recruitment process; with explicit consent, the data of applicants can be kept for 12 months)
- 12 months: India, Austria & Switzerland
- 18 months: Luxembourg, Ireland, United Kingdom, Italy, Portugal, Spain, Norway
- 24 months: France
- 48 months: United States
Please email us if you want your personal information to be deleted from the System. We will comply with your request without undue delay, unless we have a legal or regulatory reason to keep your personal information. If you have applied for a job in multiple countries, we will have to consider the legal and regulatory requirements in all these countries.
After the end of the data retention period specified in the policies and/or procedures set out above, your personal data will be deleted.
In the initial stages of the recruitment process, we do not seek to collect special categories personal information from you (this is also known as “sensitive personal information”). Special categories of personal information includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data for the purpose of uniquely identifying a natural person, information concerning health, information concerning a natural person's sex life or sexual orientation and in some cases, social security numbers or financial information.
We may need to collect special categories of personal information from you at a later stage in the recruitment process if local employment laws or regulations require us to do so. To the extent you provide us with any special categories of personal information to support your application or as part of your personal profile, you agree that we may use this information in accordance with local applicable law or regulations and in line with this Data Privacy Statement.
Your Candidate Profile contains free-text boxes. If you provide us with personal details for your application or as part of your Candidate Profile, please do not include any special categories of personal information. If you provide us with this information, you agree that we may use this information in accordance with applicable local law or regulations and in line with this Data Privacy Statement.
If you provide any information in relation to third parties or referees, you are responsible for obtaining their consent and ensuring they are aware that their details will be forwarded to, and used by, the EY network.
EY does not collect or compile personal information obtained by this site for dissemination or sale to outside parties for consumer marketing purposes or host mailings on behalf of third parties.
You have the following rights in relation to your personal information:
- To access the personal information held by EY about you
- To have your personal information corrected, for example, if it is incomplete or incorrect (we provide you with the ability to make sure your personal information is accurate and up to date in the System through your Candidate Profile).
- To restrict or object to the processing of personal information or request erasure of your personal information (in certain circumstances and subject to applicable law and regulations)
- To receive a copy of the personal data which you have provided to EY, in a structured, commonly used and machine-readable format (known as “data portability”) (in certain circumstances and subject to applicable law and regulations)
- The right to withdraw your consent for the processing of your personal information for future roles that might be of interest to you
- The right to complain to a data protection authority (see section “Complaints”)
If you have a query or wish to exercise your rights, please contact the EY data protection team.
EY is committed to making sure that your personal information processed in the System is kept secure and has implemented accepted standards of technical measures and security policies that protect the information it has under its control from:
- Unauthorized access.
- Improper use or disclosure.
- Unauthorized modification.
- Unlawful destruction or accidental loss.
All EY personnel and any third parties which EY engages to process your personal information are obliged to respect the confidentiality of your information.
This site is not intended for use by children. We understand the importance of protecting children’s information, especially in an online environment, and we do not knowingly collect or maintain information about children.
EY may change this data privacy statement as needed. If changes to the statement are made, please note that it may take up to 30 business days before new privacy practices are implemented. Check this page periodically if you would like to monitor changes.
If you are concerned about an alleged breach of privacy law or any other regulation by EY, you can contact EY’s General Counsel’s office and/or EY’s Global Privacy Leader, 6 More London Place, London, SE1 2DA, United Kingdom or via EY data protection team. An EY Privacy Leader will be made available to investigate your complaint and give you information about how it will be handled.
If you are not satisfied with the way in which EY has resolved your complaint, you have the right to complain to the data protection authority in your country. You may also refer the matter to a court of competent jurisdiction.
Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.