How does GDPR Assistant work?
The GDPR Assistant is an optional paid add-on to Traffit that helps monitor the talent base's compliance with GDPR rules.
It helps extending the candidates’ consents that are about to expire and automatically anonymizes those whose consents have already expired.
What features does the GDPR Assistant add-on enable?
Activating the GDPR Assistant add-on results in new features in the system:
auto-anonymization
automated dispatch of consent renewal requests
listing of candidates whose consents are about to expire soon
option for sending the consent extension request forms manually
All features available within this add-on are described in detail below.
How to activate the GDPR Assistant add-on?
To activate the GDPR Assistant add-on, go to Settings > Job posting and GDPR and click "I want to learn more":
Your Traffit account manager will contact you with the pricing details. He will also help you to launch the add-on and set up the rules correctly.
The monthly cost of the GDPR Assistant add-on starts from 50 EUR net and depends on the size of the part of your talent pool that requires regular anonymization.
After launching the GDPR Assistant add-on, you can manage its rules in Settings > Job posting and GDPR > GDPR Assistant tab.
What is auto-anonymization in Traffit?
Anonymization is the permanent and irreversible removal of all the connections between personal data and the person it relates to. Its purpose is to make it impossible to identify a specific person. According to the GDPR (General Data Protection Regulation), candidates for jobs should be anonymized when the consents they gave during the recruitment process expire.
Auto-anonymization in TRAFFIT is a mechanism that automatically anonymizes the candidates' data in the ATS when meeting the indicated rules. Those can be set up in the system. It allows you to:
guarantee processing the personal data in the database of only those candidates who have given and still have valid consents for the processing of personal data (given e.g. when applying to specific jobs or applying spontaneously; adding their CV to the employer's database),
save time spent on monitoring and manual anonymization of candidates whose consents expire,
guarantee GDPR compliance and security of your candidates' personal data processed in the ATS.
This additional service is offered in TRAFFIT, payable according to the pricing.
What data remains in the system and what data is deleted during anonymization?
Anonymization in the Traffit recruitment system - both automatic and manual - involves the deletion of all data that could allow the identification of a specific candidate.
What remains in the system after the candidate is anonymized?
candidate ID - a unique string of digits assigned to a candidate in the system,
activity history - information about the activity performed on a given record - left in the system for statistical and reporting purposes (e.g., date of application, assigning a note, etc.)
connection to jobs and application sources (for statistical and reporting purposes)
What is removed from the system when a candidate is anonymized?
personal data of the candidate (visible in the Personal data tab on the profile)
details of submitted applications for specific positions
reminders and tasks associated with the candidate
calendar events associated with that person
information about the talent groups to which the candidate was assigned
information about assigned tags & rate
content of notes added to the candidate by the users
details of the activities (e.g., notes) associated with this person
files attached to the candidate's profile, including resumes and cover letters
information about GDPR consents (active and expired)
details of sharing the profile with Hiring Managers
How to set the rules by which the GDPR Assistant operates?
To do that go to Settings > Job posting and GDPR > GDPR Assistant.
Here you can decide on the rules - the type of consents on which the processes of automatic anonymization and the sending of requests for renewal of consents by candidates will be based.
You can also decide whether you want the candidates who do not have any active consents at the moment to be anonymized when the automatic anonymization process is triggered.
If you want to exclude them from the process, check the option Exclude candidates whose consents have already expired or were never given:
You can click on Browse the auto-anonymization listing at any time to verify the correctness of the selected rules.
Click on Update Rules to see how this change affects both processes to verify whether you want to save the rules or go back to edit them:
If you save new rules, you can activate the process in the next step.
IMPORTANT!
Candidates who only have legal obligation active on their profile are treated as individuals without any consents.
How to activate the auto-anonymization process?
To do this, go to Settings > Job posting and GDPR > GDPR Assistant and scroll to the GDPR Assistant - Auto-anonymization process section.
All you need to do is enable the “Activate the auto-anonymization” switch:
The numbers visible under the switch indicate how many people will be anonymized on the day the process is launched and over the coming 30 days.
How to prevent a candidate’s auto-anonymization?
Auto-anonymization is designed to ensure that only those candidates are present in the database who have assigned valid consent to process personal data.
However, if the list for anonymization includes candidates whose data you still want to process in the system - you have 2 options:
1) Check if you have the process of automatic dispatch of the consent renewal form running. If not, you can send it manually. Candidates who extend consents will disappear from the list.
2) Find their profiles in the system and add consents to their profiles manually - if, for example, they have updated them during email correspondence, in a private message on LinkedIn, on paper, etc
How to activate the automated consent requests process?
To do this, go to Settings > Job posting and GDPR > GDPR Assistant and scroll to the GDPR Assistant - Automated consent requests section.
All you need to do is enable the “Activate the automated consent requests” switch:
Before activating this process, you can edit and preview the content of the email requesting the renewal of consent (details of this e-mail are described in the next paragraphs)
The numbers visible under the switch indicate how many people will receive an automatic email asking them to renew their consent on the day the process is launched.
If there are more than 3,000 eligible candidates for shipment in one day, the dispatch will be carried out in daily batches.
IMPORTANT!
To prevent your candidates from receiving too many requests to renew their consents at once, after the form is manually or automatically sent, the next email will be sent no sooner than 30 days from that day.
How do I determine the content of an automatic email requesting renewal of consents?
To do this, go to Settings > Job posting and GDPR > GDPR Assistant and scroll to the GDPR Assistant - Automated consent requests section.
Check the Consent request email messages list. The checked one is the default email content to be sent by the automated consent request dispatch mechanism:
Every message has a button allowing you to preview the message or edit it.
You can add the Consent update form link to the content of the email by clicking on the “+” icon in the right menu:
In addition to the title and content of the email, you can also provide a reply-to email address to which:
- we will forward any responses from candidates who have received an email request to renew their consent,
- we will inform you if there are any problems with the mailing.
How to recognize candidates that will be automatically anonymized soon?
Go to Candidates > GDPR Assistant tab to see a list of people who have been queued for auto-anonymization.
Candidates appear on the list 30 days before automatic anonymization:
If multiple consent types have been selected, candidates will appear on this list when their consents are about to expire soon.
The list is enriched with information on when an automatic email was sent to these individuals asking them to renew their consents.
In addition to the data of the people to be anonymized, you will also see:
when their profiles will be anonymized,
if and when an email requesting consent renewal was sent,
whether the person is assigned to a job and when they were assigned to the current stage,
a list of most recent activities on a given candidate.
You can filter the list of queued candidates by the time they have left to be anonymized.
From the list you can:
send a manual email requesting new consents,
anonymize candidates:
2. In addition, the profiles of candidates queued for auto-anonymization, will have this information:
3. Information about the upcoming anonymization will also be visible in the candidate's quick preview in a job:
What if I have a lot of candidates for anonymization?
In case the list of people to be anonymized is long and you want to try to extend the candidates' consents - we recommend to run the automatic RODO communication first.
Consider whether:
do you want to try to extend these consents?
do you still have the right to contact these candidates? (What active consents do they have and when do they expire)
If you do not know the answer to the second question - we recommend consulting with your DPO.
If you want to try to renew these consents and you have the right to contact these candidates - activate automated GDPR communications.
Your personal GDPR assistant will then send an email with a consent renewal form to candidates whose consents are ending (or have already ended). A few days after you start this process, you can trigger auto-anonymization so that the system only anonymizes those who have not renewed their consents.
Note that in case there are more than 3,000 eligible candidates in one day, the shipment will be carried out in daily batches.
If you do not have the right to contact these candidates because their consents have expired - activate the auto-anonymization process right away to remove their profiles from the system.