Processing Your Personal Data
What categories of personal data does Baker & McKenzie LLP (the "Firm") collect about me and why?
"Personal data" means any information relating to you. During the application process, the Firm will collect, process and use your personal data, for a range of different purposes. For example:
| What personal data? | Why? |
| Identification - your name, nationality, national insurance number, bank details | To process your application |
| Contact details | To determine your eligibility for the role you have applied for |
| Education and work experience | To conduct background checks as part of your application |
| Organisational data | To communicate with you about future job opportunities |
| Information collected as part of your interview process | To comply with the law and our obligations |
| Background check information | To communicate with you and with the Firm's employees and third parties |
| Other application data (e.g. information contained in your CV and obtained from recruiters) | To comply with our financial and regulatory obligations |
| CCTV images |
It's important to know that the Firm may also need to process sensitive personal data about you such as health and medical data, criminal records data, and equal opportunities data.
Find out more about what data the Firm processes and why by reading the detailed Applicant Privacy Notice.
Who might the Firm share my personal data with, and what happens if it's transferred out of the UK?
As you know, we are a global firm - and entities across the Baker McKenzie Group network are involved in processing data. We might also need to transfer your data to other third parties - e.g., acquiring entities, third party processors, suppliers or government bodies. Our policy is to limit who has access to that data as much as we can. If we need to transfer data out of the UK, the Firm will take all necessary measures to ensure your data is adequately protected. Find out more about who your data is shared with, and what steps we take to protect it here.
How long will the Firm keep my personal data for?
We won't keep it for any longer than we need to, either to comply with the law or to ensure that we are complying with our obligations to you and other third parties. Find out more here.
What rights do I have in respect of my personal data?
You have a number of rights in relation to your data. These include a right to access, correct and erase your data as well as more technical rights to restrict the way we process it, and to transfer your data. Your rights are important, and we've set them out in detail here.
Who can I contact if I have questions?
If you have concerns or questions regarding your personal data, please contact: DataProtection.London@bakermckenzie.com
Baker & McKenzie LLP Applicant Privacy Notice
Baker & McKenzie LLP, of 100 New Bridge Street, London, EC4V 6JA ("us", "we" or the "Firm") has prepared this Applicant Privacy Notice ("Notice") for applicants ("you") to roles with the Firm. In connection with your application we have to process your personal data. We think that it is very important that you understand how we use your personal data, and we take our obligations in this regard very seriously. The purpose of this Notice is therefore to give you information about how the Firm collects, processes, stores and otherwise uses information about you, and your rights in relation to that information.
The Firm needs to process your personal data in order to process your application for employment. There are also statutory requirements we have to comply with in relation to your application. If we are not able to carry out the processing activities we describe in this Notice we may not be able to continue with your application. Of course, we hope it would never come to that, and this is simply information we are obliged to provide to you as part of this Notice.
We need to ask for your specific consent to process your personal data in a particular way in certain circumstances, such as for the purpose of conducting background checks prior to you commencing employment with us, to enable relevant third parties to release information about you as part of those checks. This will be obtained by our data processors ("Data Processors") who conduct background screening on our behalf.
When we say "Firm", "we" or "us" in this document, we mean the Baker & McKenzie LLP entity that you're applying to work for. In addition, you will see a number of references to the "Baker McKenzie Group", which includes all other Baker McKenzie entities globally.
In this Notice you will see reference to "GDPR" - that refers to the European Union General Data Protection Regulation which is a European law governing your rights in relation to your personal data, and how organisations should protect it.
We may update this document from time to time, for example if we implement new systems or processes that involve the use of personal data.
- What categories of personal data does the Firm collect about me?
- Got it - but who might the Firm share my personal data with?
- How long will the Firm keep my personal data for?
- What rights do I have in respect of my personal data?
- Who can I contact?
What categories of personal data does the Firm collect about me?
"Personal data" means any information relating to you. We will collect, process and use the following categories and types of personal data about you:
- identification data, such as your first and last name, photo (if voluntarily provided by you), CCTV images (if you visit us) and your proof of right to working,
- personal information, such as your date and place of birth, emergency contact details, and gender;
- contact details, such as your home address, telephone number and email address;
- education and work experience, such as contact details for your current/former employer, information about your educational background, your work experience and other experience/interests, previous employment details including current salary and benefits package;
- other application data, such as the information included in your application form/CV/cover letter and details on any previous relationship with us;
- information collected as part of the interview process, such as notes taken from your interview and/or assessment day, information provided from recruitment agencies, psychometric online test results and video interview recordings, where applicable;
- background check information, such as information obtained through reference checks, confirmation about your work/educational background, and any other checks intended to verify the personal data which you have provided to us in respect of your application; and
- profiling data, such as personality profile analysis test results surrounding work preferences and styles of working,
together "Applicant Data".
As well as the above, we will also collect, process and use the following categories and types of personal data about applicants for our trainee graduate recruitment programme:
- social mobility data, such as entitlement to free school meals, the category of secondary school you attended, whether you are/have been a parent or registered carer, whether you have spent time in a local authority care, the regularity of your working pattern during certain periods, whether you received a maintenance grant or loan at university, and whether you were the first generation to attend university in your family;
- extenuating circumstances, such as those that may have impacted your studies; and
- refugee/asylum seeker status,
together "Contextual Data".
In addition to the collection, processing and use of the Applicant Data, we collect, process and use the following special categories of personal data about you which we describe as "Sensitive Applicant Data":
- medical data, such as information on disability or medical conditions;
- criminal records data;
- equal opportunities data, such as racial or ethnic origin, religious or philosophical beliefs, and data concerning health or sexual orientation.
Why does the Firm need to collect, process and use my personal data and what is the legal basis for doing so?
We collect and use Applicant Data, Contextual Data and Sensitive Applicant Data for a variety of reasons linked to processing your application for a role with us (the "Processing Purposes"). However, we can only collect and use this data if we have a valid legal basis for doing so, and we are required to explain the various legal bases that we rely on to you.
To give you the full picture, we have set out each of the reasons why we collect and use Applicant Data, i.e., the Processing Purposes, and mapped these against the different legal bases that allow us to do so. We appreciate that this is quite a lot of information to take in, so please bear with us:
| Processing Purposes | Legal Bases |
|
1. Administering and processing your application (including processing a job offer should you be successful) including identification data, contact details, information about your qualifications and employment history, and information obtained during your interview and information contained in your CV. 2. To determine your eligibility for the role you applied for, including identification data, contact details, information about your work and education experience, information obtained during your interview and information contained in your CV. 3. Conducting background checks as part of your application, including identification data, contact details, information about your qualification and employment history. |
Processing Purposes 1 to 3:
|
|
4. Complying with applicable laws and employment-related requirements along with the administration of those requirements, such as income tax, national insurance deductions, and employment and immigration laws which involves the processing of identification data and contact details. 5. Monitoring and ensuring compliance with applicable policies and procedures and laws, which involves the processing of your identification data and contact details. |
Processing Purposes 4 to 5:
|
| 6. Communicating with you, the Firm's employees and third parties (such as recruitment agencies), including informing you of future opportunities with the Firm which involves the processing of identification data and your contact details. |
Processing Purpose 6:
|
| 7. Responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country which involves the processing of identification data and contact details. |
Processing Purpose 7:
|
| 8. Complying with corporate financial responsibilities, including audit requirements (both internal and external) and cost/budgeting analysis and control which involves the processing of identification data, contact details, information about the role you have applied for, including the role's salary and benefits. |
Processing Purpose 8:
|
Below are the Processing Purposes and corresponding Legal Bases for Sensitive Applicant Data and Contextual Data:
| Processing Purposes | Legal Bases |
|
1. To accommodate your application and interview and for compliance with legal obligations, we may use health and medical data. |
|
|
2. Criminal records background checks in relation to you, where relevant and appropriate to the role you are applying for. |
|
| 3. Equal opportunities data, including Contextual Data. |
|
We appreciate that there is a lot of information to take in, and we want to be as clear with you as possible over what this means. Where we talk about "legitimate interests" of the Firm or third parties, this can include:
- Assessing your suitability for employment/engagement with the Firm;
- Implementation and operation of a group-wide organisational structure and group-wide information sharing;
- Managing the Firm's business operations effectively;
- Prevention of fraud and corruption;
- Statistical analysis to review and benchmark the Firm's practices;
- Compliance with our legal obligations.
When relying on the legitimate interests basis for processing your personal data, we will balance the legitimate interest pursued by us and any relevant third party with your interest and fundamental rights and freedoms in relation to the protection of your personal data to ensure it is appropriate for us to rely on legitimate interests and to identify any additional steps we need to take to achieve the right balance.
Got it - but who might the Firm share my personal data with?
As you may know, we are part of the Baker McKenzie Group, and several entities in this group are involved in the Processing Purposes. To ensure that the Processing Purposes can be completed, your information may be shared with any of the entities within the Baker McKenzie Group. Where we do share data in this way, however, it is our policy to limit the categories of individual who have access to that personal data.
The Firm may transfer personal data to third parties, including to entities within and outside the Baker McKenzie Group located in any jurisdictions where the Baker McKenzie Group entities are located, for the Processing Purposes as follows:
- Within the Baker McKenzie Group. As the Firm that you are applying to is part of a wider group headquartered in the USA with offices located across the globe, which all partially share management, human resources, legal, compliance, finance and audit responsibility, the Firm may transfer the Applicant Data, Contextual Data and Sensitive Applicant Data to, or otherwise allow access to such data by other entities within the Baker McKenzie Group, which may use, transfer, and process the data for the following purposes: to maintain and improve effective administration of the workforce; to communicate information about the Baker McKenzie Group; to monitor and assure compliance with applicable policies and procedures, and applicable laws; and to respond to requests and legal demands from regulators and other authorities.
- Regulators, authorities, and other third parties. As necessary for the Processing Purposes described above, personal data may be transferred to regulators, courts, and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors), insurance providers, pensions and benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations).
- Data Processors. As necessary for the Processing Purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions. The Data Processors may carry out instructions related to recruitment, psychometric testing, background screening, workforce administration, compliance, and other activities, and will be subject to contractual obligations to implement appropriate technical and organisational security measures to safeguard the personal data, and to process the personal data only as instructed.
For a full list of the Baker McKenzie Group entities and third parties that we may share your data with, please contact us as set out below.
As you may expect, some of the recipients we may share Applicant Data, Contextual Data and Sensitive Applicant Data with may be located in countries outside the UK. In some cases, this may include countries located outside the European Union and/or European Economic Area ("EAA").
Some countries where recipients may be located already provide an adequate level of protection for this data (e.g., Canada), and transfers to other countries such as the USA may be protected under arrangements such as the EU-US Privacy Shield. Nonetheless, for transfers to Baker McKenzie Group entities outside of the EEA, the Firm will be bound by the EU Intra-Group Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR, which the European Commission has assessed as providing an adequate level of protection for personal data, to ensure that your data is protected adequately.
If recipients are located in other countries without adequate protections for personal data, the Firm will take all necessary measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law. This will include using appropriate safeguards such as the EU Standard Contractual Clauses.
How long will the Firm keep my personal data for?
It is our policy not to keep personal data for longer than is necessary. We hold your data for 2 years for experienced hire and 3 years for graduate recruitment, unless there is a legitimate business reason to hold the data for longer or where applicable local law requires us to do so. For further information, please contact us as set out below to request further details.
What rights do I have in respect of my personal data?
You have a number of rights in relation to your Applicant Data, Contextual Data and Sensitive Applicant Data. These can differ by country, but can be summarised in broad terms as follows:
- Right of access
You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy we may charge a fee. - Right to rectification
You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review this information regularly to ensure that it is accurate and up to date. - Right to erasure (right to be forgotten)
You may have the right to ask us to erase personal data concerning you. - Right to restriction of processing
In limited circumstances, you may have the right to request that we restrict processing of your personal data, however where we process Applicant Data, Contextual Data and Sensitive Applicant Data for the Processing Purposes where we think that we have a legitimate interest in processing, these may override a request that you make. - Right to data portability
You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that data to another entity. - Right to object and rights relating to automated decision-making
Under certain circumstances you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.
To exercise any of these rights, please contact us as stated under below.
You also have the right to lodge a complaint with the competent data protection supervisory authority, which in the UK is the Information Commissioner's Office (the 'ICO').
Who can I contact?
If you have concerns or questions regarding this Notice or if you would like to exercise your rights as a data subject, you can email: DataProtection.London@bakermckenzie.com
For questions concerning your application, please contact:
Experienced hire: Recruitment.London@bakermckenzie.com
Graduate recruitment: London.GraduateRecruit@bakermckenzie.com