Privacy Notice – Digital Interview and CodeVue and HireVue Cognitive Assessment Tool

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to the Digital Interview, CodeVue and HireVue Cognitive Assessment Tool (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the eycom Privacy Statement, and in case of any conflict with the eycom Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e., act as a data controller or in a similar capacity). The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is:

• For the personal data of EY personnel: The data controller is the EY entity which employs you.
• For the personal data of third-party personnel (including EY clients): The data controller is the EY local member firm with which the third party has a relationship.

You can find a list of local EY member firms and affiliates on the eycom Privacy Statement.

The personal data you provide in the Tool is shared by the above data controllers with one or more member firms of EYG (see “Who can access your personal data” section 6 below).

The Tool is hosted externally in the US at Amazon AWS US-East region, with backups being held at alternate Amazon facilities within the United States.

3. How does the Tool process Personal Data?

The Tool is divided into three types of functionalities; (1) Digital Interview, (2) CodeVue and (3) HireVue Cognitive Assessments. All functions are used to help the recruiting process by using video or online interviewing software. It enables EY to interview and assess you by replacing lengthy application forms or pre-screening questions and reduce the need for traditional face-to-face interviews and travelling to venues to conduct tests, whilst retaining person to person interaction and human decisions making. Digital Interview is used to provide online digital interviews, CodeVue is used for coding assessments, which allows recruiters to objectively screen for coding and programming talent, and HireVue Cognitive Assessment is used to assess your cognitive aptitude abilities.

Your personal data processed in the Tool is used as follows:

• assess the candidate suitability for role; and
• will be retained in accordance with data protection retention requirements for future hiring opportunities.

EY relies on the following basis to legitimize the processing of your personal data in the Tool:

For candidates: We process your personal data based on your consent. The provision of your personal data to EY is optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing. You have the right to withdraw your consent at any time.

The provision of your personal data to EY is optional (including, for the avoidance of doubt, your image and video image). However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing.

For EY Staff: Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) pursued is for EY’s Human Resource management, including performance reviews and recruitment. However, recordings made in some jurisdictions will be subject to your consent which will be obtained prior to the recording. 

4. What type of personal data is processed in the Tool?

The Tool may process these personal data categories:

• Your first name;
• your last name;
• your email address;
• your individual RequestID;
• your voice;
• your image;
• your video images;
• test results showing your talents and cognitive abilities for the purposes of the deployment of Codevue and HireVue Cognitive Assessment;
• IP-number of your computer; and,
• other information that can be disclosed during the interview such as your employment history, names of co-workers, your education, hobbies and interests as well as information about your abilities and personality (strengths and weaknesses among others). 

This data is sourced from a feed from other EY systems known as GRMS – Yello and SuccessFactors (SF) Recruitment; or directly from yourselves.

5. Sensitive Personal Data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

The following sensitive personal data is collected and processed in the Tool for the Digital Interview feature of the Tool:

The Tool uses video images which include elements of personal data, for example, recorded video of you, your name, your surname, your previous employment history, your hobbies and interests. You may decide to talk about or address categories of sensitive personal data, however, the interviewer will not ask questions which deal with categories of sensitive personal data.

There is also a free text box where you can write out your answer to a question. Although the purpose of this free text box is not to have such sensitive personal data written out, you may include such type of personal data within your answer.  Please note that none of the questions directly ask you for your racial/ ethnic origin, political opinions, religious beliefs, health related information.

The Tool does not intentionally request or collect sensitive personal data about you, nor will you be asked directly to provide sensitive personal data.  However, in using this Tool to complete any video interviews or otherwise complete any forms or provide written responses through the Tool, you may choose to provide information about yourself which is sensitive personal data.  If you provide any sensitive personal data, whether over video or in writing when completing a free text box, you acknowledge that this data is recorded and collected by the Tool and consent to its collection, processing and storage. Apart from the information requested pursuant to this review assessment (for example, your first name last name, email address and previous employment details), please do not input any other information which may be considered confidential. Please also do not input any sensitive personal data, as is described in the first sentence of this section above.

6. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:

Recruiters, hiring managers and system administrators – permissions will be granted to other EY members based upon their role, for example, if a role is being advertised for the forensics team, a member of the forensics team may be asked to conduct the interview and they will be granted access. External vendors, Tata Consultancy Services (TCS), Caption First and IBM will also have access to the Tool.

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at https://www.ey.com/en_gl/locations). An overview of EY network entities providing services to external clients is accessible here (via ey.com UK site) (See Section 2 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.

We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool to IBM is governed by an agreement between EY and IBM that includes standard data protection clauses adopted by the European Commission.

7. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “How does the Tool process your personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.

The policies and/or procedures for the retention of personal data in the Tool is Three (3) years of absent data user activity. For more information on the retention period applicable to your personal data, please contact your usual EY representative.

User access logs are retained for a period of Three (3) years.

Your personal data will be retained in compliance with privacy laws and regulations. After the end of the data retention period, your personal data will be deleted. To learn more, download our data retention overview (pdf).

8. Security

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our protecting your data 2018 (pdf) brochure.

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.

10. Your rights in relation to your personal data

Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including:

• To request details of the personal data EY processes about you and to access the personal data that EY processes about you
• To have your personal data corrected, for example, if it is incomplete or incorrect
• To restrict or object to the processing of personal data or request the erasure of your personal data
• To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-readable format which you can re-use for your own purposes (known as “data portability”)
• Where you have provided consent to the processing of your personal data, the right to withdraw your consent.
• The right to complain to a data protection authority (see section “Complaints”)
• If you have any questions about how EY processes your personal data or your rights related to your personal data, please send an e-mail to data protection team.

11. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at data protection team or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data protection authority. You may also have the right to refer the matter to a court of competent jurisdiction.

Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further information and the contact details of these representatives are available below:

EU data protection representative

UK Data protection representative

12. Contact us

If you have additional questions or concerns, contact your usual EY representative or email data protection team.

13. Acknowledgement and Consent

By clicking the 'Yes, I agree' button below you are agreeing and consenting to your personal information being processed and used as outlined in this Privacy Notice. You have the right to withdraw your consent or to object to the further processing of your personal information at any time by contacting your usual EY representative or email data protection team.