You should tell candidates about the way their personal information will be used and disclosed and seek formal consent for this before including them in a talent pool.
A good way of doing this is to list the data that is collected (e.g. profile information, work and educational experience, assessment report, selection report etc.) and identify who will be authorised to access this information (e.g. HR and hiring managers within the agency or other agencies).
You should only use and disclose personal information for the purpose for which it was collected, unless you have the candidate’s consent, subject to limited exceptions under privacy legislation. You should notify candidates if anything changes in protecting their privacy or storing or handling personal information.
Other things you should consider doing include:
- only collecting personal information directly from the candidate, unless they have authorised collection from someone else
- informing candidates who will be storing their information
- notifying candidates about how they can access, correct and update their personal information, and allowing them to access it without excessive delay or expense
- storing personal information securely, keeping it no longer than necessary and disposing of it appropriately.
You can use a talent pool to target employment to Aboriginal and Torres Strait Islander people and people with disability. To do this, you need to seek permission from candidates to be considered and ensure they consent to their demographic information being used for this purpose.
Refer to the Information and Privacy Commission’s (IPC) summary of the Information Protection Principles or visit the IPC website for more information.