Home
|UK GDPR Candidate Privacy Notice

PDF Link

UK GDPR Candidate Privacy Notice

Introduction

Crowell & Moring LLP and Crowell & Moring U.K. LLP, (together known as “Crowell & Moring”, “we”, “us”, or “our”) are committed to protecting the privacy and security of your personal data. This privacy notice describes how we collect and use personal data about you during and after the recruitment process in accordance with the UK General Data Protection Regulation, (the “UK GDPR”) and the Data Protection Act 2018, (the “DPA”).

Crowell & Moring LLP of 1001 Pennsylvania Avenue NW, Washington, DC 20004-2595, USA and Crowell & Moring U.K. LLP of 1209 Orange Street, Corporation Trust Center, Wilmington, Delaware 19801 (New Castle County), USA are each a "controller". We are responsible for deciding how and why we collect, hold and use personal data about you.

You are being sent a copy of this privacy notice because you are a candidate applying for a role with us (whether as a partner, an employee, a worker or a contractor). Please read and retain a copy, together with any other privacy notice we may provide to you on specific occasions when we collect or process personal data about you. This notice does not form part of any contract of employment or other contract to provide services.

Personal Data We Hold About You

Personal data includes any information about an individual from which that person can be identified. It does not include data where the person's identity has been removed (anonymous data).

In connection with your application for work with us, we will collect, store, and use the following categories of personal data about you (further details are included in Appendix 1):

(i)Identity and Contact Data; (ii) Date of Birth Data; (iii) National Insurance Data; (iv) Salary and Benefits Data; (v) Employment Commencement Data; (vi) Workplace Location Data; (vii) Verification Data; (viii) Recruitment Data; (ix) Lateral Partner Questionnaire Data (to the extent relevant); (x) Employment Data; (xi) Compensation Data; (xii) Background Data; and (xiii) Education Data.

Special Category Personal Data and Criminal Offence Data

Certain special categories of personal data are considered to be more sensitive and require more stringent protection, such as information about a person's health or sexual orientation. Information in respect of criminal offences and convictions is also considered to be especially sensitive.

We collect, store and use the following types of more sensitive personal data about you to the extent relevant to the application and recruitment process: (i) information about your health, including any medical condition, to the extent required to make any reasonable adjustments which are necessary during the application and recruitment process, (“Reasonable Adjustment Data”); and (ii) information about civil and criminal offences and convictions to the extent relevant to finance or compliance roles, (“Criminal Offence Data”).

How We Collect Your Personal Data

We collect personal data through the application and recruitment process, either directly from candidates or sometimes from third parties.

Relevant third parties include: (i) employment or recruitment agencies, (Identity and Contact Data, certain Recruitment Data, Compensation Data, Employment Data and Education Data); (ii) background check providers, who may collect certain personal data from other third parties, such as the Disclosure and Barring Service and credit reference agencies, (certain Background Data and certain Criminal Offence Data); (iii) former employers, (certain Recruitment Data and certain Employment Data); (iv) named referees, (certain Recruitment Data); and (v) LinkedIn (Identity and Contact Data, Workplace Location Data, Recruitment Data and Education Data.

Lawful Bases for Processing – Personal Data

Most commonly, we will use your personal data where: (i) we need to take steps at your request prior to entering into a contract with you; (ii) we need to comply with a legal obligation; or (iii) it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests.

Additional Conditions for Processing – Special Category Personal Data and Criminal Offence Data

We need to have further justification for collecting, storing and using more sensitive special categories of personal data about you, namely Reasonable Adjustment Data and also Criminal Offence Data.

We process both Reasonable Adjustment Data and Criminal Offence Data to the extent relevant in limited circumstances with your explicit written consent.

Purposes of Processing

We need all of the categories of personal data detailed above primarily to enable us to take steps at your request prior to entering into a contract with you and to comply with our legal obligations. In some cases, we use your personal data to pursue legitimate interests, provided your interests and fundamental rights do not override these.

We will hold certain Criminal Offence Data to the extent relevant, which we will only collect if it is appropriate given the nature of your role and where we are legally able to do so. We will collect and process Criminal Offence Data if we would like to offer you a role conditional on checks and any other conditions, such as references being satisfactory.

We are entitled to conduct a criminal records check to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role. In particular, roles which involve the discharging of compliance obligations require a high degree of trust and integrity and so we would like to ask you to seek a basic disclosure of your criminal records history.

We set out below a brief description of the purposes for which we use your personal data, Reasonable Adjustment Data and Criminal Offence Data:

Appendix 2 includes further details of: (i) the purposes for which we plan to use your data; (ii) which types of personal data are used for which purpose: (iii) the lawful bases for processing and additional conditions which we rely upon to process your personal data; and (iv) a description of our legitimate interests, where appropriate:

We will use the personal data we collect about you to:

Assess your application, including your skills, qualifications, and suitability for the role, including through the conduct of interviews.
Make decisions about your selection, recruitment or appointment.
Conduct criminal records checks and other background and reference checks, in each case where applicable, if you are offered a role.
Check that you are legally entitled to work in the UK.
Decide the terms on which you work for us.
Decide whether your engagement is deemed employment for certain purposes.
Communicate with you about the recruitment process, including through offer letters or rejection letters.
Create and maintain records related to the application and recruitment process.
Consider whether any appropriate adjustments in respect of any health condition are required during the recruitment process, for example whether adjustments need to be made during an interview , and put in place any appropriate adjustments.
Generate a summary of background information about you using our in-house generative artificial intelligence tool, (“Crowell AI”) for internal administrative purposes only, such information to be used by interviewers as part of the recruitment process (this information will be subject to human review prior to being shared with interviewers).
If you are a partner candidate, generate a first draft of a sponsorship memorandum about you using Crowell AI for internal administrative purposes only, such memorandum to be used to present you as a candidate to our Management Board and/or Executive Committee and (in a slightly modified form) to all partners (this information will be subject to human review prior to being shared with any of these bodies or individuals).

Special Category Personal Data and Criminal Offence Data

We use: (i) Reasonable Adjustment Data for purpose 9; and (ii) Criminal Offence Data for purposes 3 and 4, in each case as set out above.

Failure to Provide Personal Data

If you fail to provide certain personal data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for the role you apply for and you fail to provide us with relevant details, we will not be able to take your application further.

Automated Decision-Making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. Automated decision-making is permitted in certain limited circumstances and subject to certain conditions.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Internal Personal Data Sharing

We share your personal data internally on a “need-to-know” basis. Based on this principle, your personal data will be processed, as appropriate, by the following internal teams and individuals:

Management individuals and teams, such as office managing partners, practice group leadership and the Legal Development Committee.
Other partners.
Professional Support Teams, such as personal assistants, and the Records Team.
Compliance Functions, such as the Office of the General Counsel, the Compliance Team and the Conflicts Team.
Global HR Teams.
Global IT Teams.
Global Finance Teams and Payroll Teams.

Personal Data Sharing with Third Parties

We will also share your personal data with certain third parties, including third-party service providers, contractors, designated agents and other group entities, where required by law, where necessary for the purposes of processing your application, or where we have another legitimate interest in doing so. Access to personal data is limited to those third parties who have a business need to know. They will only process personal data on our instructions and are subject to appropriate confidentiality obligations.

Third Party Service Providers

We will share your personal data with the following categories of third-party service providers and their sub-processors for the purposes set out above:

IT services providers.
Communications platform providers.
HR services and workforce management solutions providers
Payroll and benefits services providers.
Background check services providers.

All third-party service providers and other group entities are required to take appropriate security measures to protect personal data in line with our policies and to process it in accordance with applicable law. Third-party service providers are not permitted to use your personal data for their own purposes and may only process such data for specified purposes in accordance with our instructions.

Other Crowell & Moring Entities

We will share your personal data with other Crowell & Moring entities: (i) as part of our regular reporting activities on company performance; (ii) for business reorganisation or restructuring exercises; (iii) for system maintenance support and hosting of data; and (iv) where required, as part of our regular communications with other Crowell & Moring entities, (e.g., by email).

Other Third Parties

We may share your personal data with other relevant third parties, for example in the context of the possible sale or restructuring of the business but will share anonymised data prior to completion to the extent possible. Post completion, we will share your personal data with the other parties to the extent required under the terms of the transaction. We may also need to share your personal data with a regulator or to otherwise comply with the law.

International Transfers of Personal Data

We will transfer certain of your personal data to the following countries outside the UK in order to perform our contract with you: Belgium, the Netherlands, the USA and Qatar.

Other than in respect of Belgium and the Netherlands, there are no applicable adequacy regulations in respect of relevant restricted transfers of personal data to those countries, meaning that such countries are not deemed to provide adequate protection for your personal data.

To ensure that your personal data receives adequate protection, we have put in place approved international data transfer agreements or standard contractual clauses with relevant data importers located in the USA and Qatar. Further information about these protective measures is available from our Data Protection Compliance Manager whose contact details are set out at the “How to Contact Us” section of this Privacy Notice below.

Data Retention

We only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements.

If your application is unsuccessful, this comprises a period of twelve (12) months after we have communicated to you our decision about whether to appoint you to the role. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal data in accordance with all applicable laws and regulations.

If your application is successful, details of the relevant retention periods in respect of your personal data are set out in our London Partner, Employee, Worker and Contractor UK GDPR Privacy Notice, which is available here [insert link to London Partner and Employee Privacy Notice].

If we would like to retain your personal data on file, on the basis that we might be able to consider you for an opportunity that may arise in future, we will write to you separately, seeking your explicit consent to retain your personal data for a fixed period for that purpose.

In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case we may use that data without further notice to you.

Rights In Your Personal Data

Under certain circumstances, by law you have the right to:

Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another party.

If you want to exercise any of these rights in respect of your personal data, please contact us as set out in the “ How to Contact Us” section of this notice below.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights).

Right to Withdraw Consent

If you have provided consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To do so, please contact us as set out in the “How to Contact Us” section below. Once we receive notification that you have withdrawn consent, we will no longer process your data for the purpose originally agreed to, unless we have another lawful basis for doing so and, subject to our Personal Data Retention Policy, we will dispose of your personal data securely.

How to Contact Us

If you have any questions or complaints about this privacy notice or how we handle your personal data, please contact our Data Protection Compliance Manager at dataprivacy@crowell.com. You can also contact us by sending a letter to the following address: Crowell & Moring U.K. LLP, 199 Bishopsgate, London EC2M 3TY.

Complaints

You also have the right to make a complaint at any time to the UK Information Commissioner's Office (the “ ICO”) with respect to data protection issues by contacting the ICO as set out below or through the Live Chat service available through the “Make a complaint” section of the ICO’s website located at www.ico.org.uk:

Information Commissioner's
Office Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF

Telephone: 0303 123 1113;
Fax: 01625 524510

Changes to This Privacy Notice

We reserve the right to update this privacy notice at any time. The current notice will be available on our website at www.crowell.com/en/UK-GDPR-Candidate-Privacy-Notice.

Appendix 1

We will collect, store, and use the following categories of personal data about you:

Personal identification and contact details such as name, salutation or title, role, home address, work address, telephone numbers (including personal, work and mobile) and email addresses (including personal and work), (“Identity and Contact Data”).
Date of birth, (“Date of Birth Data”).
National Insurance number, (“National Insurance Data”).
Salary, annual leave, pension and benefits information and details of professional expenses, (“ Salary and Benefits Data”).
Start date and, if different, the date of your continuous employment, (“Employment Commencement Data”).
Location of employment or workplace, (“Workplace Location Data”).
Copies of passport and/or driving licence, (“Verification Data”).
Recruitment information (including copies of right to work documentation, references, information and submissions from recruitment consultants and head-hunters, areas of expertise and practice profiles, evaluation data, offer letters, sponsorship memoranda, information included in website biographies, professional information included on LinkedIn, information included in business plans, information included in feedback from interviewers, details of the names and relationships of candidates’ relatives who have a relationship with Crowell and other information included in a CV or cover letter, or obtained as part of the application or interview process (including information included in feedback from interviewers)), (“Recruitment Data”).
Data collected in connection with the Lateral Partner Questionnaire, (“Lateral Partner Questionnaire Data”).
Employment records (including job titles, work history, working hours, holidays, training records, professional memberships), (“Employment Data”).

Compensation history, (“Compensation Data”).
Results of HMRC employment status checks, other background checks and details of your interest in and connection with the intermediary through which your services are supplied, (“Background Data”).

Education-related data (including details of academic institutions attended and qualifications, professional qualifications and grades obtained), (“Education Data”).

Appendix 2

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your persona l data, Reasonable Adjustment Data and Criminal Offence Data and which of the lawful bases for processing and additional conditions we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

Purpose/Use	Type of Data	Lawful Basis and Additional Conditions
Assessing candidates’ applications, including skills, qualifications and suitability for the role they have applied for, including through the conduct of interviews.	Identity and Contact Data; Recruitment Data; Verification Data; Education Data; Background Data; and Lateral Partner Questionnaire Data	Processing is necessary for our legitimate interests in assessing the suitability of applicants for roles.
Making decisions about candidates’ selection, recruitment or appointment (regarding solicited and unsolicited applications), including through the internal approvals process, the partner hire process, if relevant, (including completion of the Lateral Partner Questionnaire, if applicable and sponsorship memoranda) and the issuing of offer and rejection letters.	Identity and Contact Data; Recruitment Data; Verification Data; Education Data; Background Data; and Lateral Partner Questionnaire Data	Processing is necessary for our legitimate interests in making appropriate recruitment decisions to ensure that appropriate individuals are recruited into relevant roles.
Conducting criminal records checks and other background and reference checks, in each case where applicable, if candidates are offered roles.	Personal Data Identity and Contact Data; Date of Birth Data; Recruitment Data; Verification Data; and Background Data	Personal Data Processing is necessary for our legitimate interests in conducting criminal records and other background and reference checks, where applicable, to ensure that appropriate individuals are recruited into relevant roles and that there is nothing in relevant candidates’ backgrounds and criminal convictions’ histories which would render them unsuitable for relevant roles, particularly roles which involve compliance.
	Criminal Offence Data Criminal Offence Data	Criminal Offence Data Candidates have given their explicit consent to the processing of their Criminal Offence Data for the purposes of conducting criminal records checks, where applicable, to ensure that there is nothing in their criminal convictions histories which would render them unsuitable for relevant roles, particularly roles which involve compliance.
Checking that candidates are legally entitled to work in the UK.	Identity and Contact Data; Date of Birth Data; National Insurance Data; Employment Commencement Data; Workplace Location Data; Verification Data; and Background Data	Processing is necessary for compliance with a legal obligation to which we are subject under the Immigration, Asylum and Nationality Act 2006, the Immigration Act 2014 and the Immigration Act 2016. Processing is necessary for our legitimate interests in confirming candidates’ legal entitlement to work in the UK.
Determining the terms on which candidates work for us.	Identity and Contact Data; Employment Commencement Data; Workplace Location Data; Recruitment Data; Lateral Partner Questionnaire Data; Background Data; and Education Data	Processing is necessary for our legitimate interests in entering into appropriate employment and services agreements with successful candidates. Processing is necessary in order to take steps at the request of candidates prior to entering into employment or service contracts.
Determining whether an engagement is deemed employment for the purposes of Chapter 10 of Part 2 of the Income Tax (Earnings and Pensions) Act 2003 (the “ITEPA 2003”) and providing status determination statements in accordance with the applicable provisions of ITEPA 2003.	Identity and Contact Data; Date of Birth Data; National Insurance Data; Financial Data; Salary and Benefits Data; Employment Commencement Data; Workplace Location Data; Employment Data; Compensation Data; and Background Data	Processing is necessary for our legitimate interests in determining whether engagements are deemed employment for the purposes of ITEPA 2003 and providing candidates with status determination statements.
Communicating and corresponding with candidates in respect of the recruitment process.	Identity and Contact Data; Recruitment Data; Verification Data; Education Data; Background Data; and Lateral Partner Questionnaire Data	Processing is necessary for our legitimate interests in communicating with candidates in respect of the application and recruitment process, including the issuing of offer and rejection letters.
Creating and maintaining records in respect of the application and recruitment process.	Personal Data Identity and Contact Data; Date of Birth Data; Employment Commencement Data; Workplace Location Data; Salary and Benefits Data; National Insurance Data; Recruitment Data; Verification Data; Education Data; Background Data; and Lateral Partner Questionnaire Data	Personal Data Processing is necessary for our legitimate interests in creating and maintaining application and recruitment-related records.
	Criminal Offence Data Criminal Offence Data	Criminal Offence Data Candidates have given their explicit consent to the processing of their Criminal Offence Data for the purposes of creating and maintaining records in respect of criminal records checks, where applicable, to ensure that there is nothing in their criminal convictions histories which would render them unsuitable for relevant roles, particularly roles which involve compliance.
Considering whether any appropriate adjustments are required during the recruitment process, (e.g. whether adjustments need to be made during an interview) and implementing any appropriate adjustments.	Personal Data ID and Contact Data and Workplace Location Data	Personal Data Processing is necessary in order to take steps at candidates’ request prior to entering into employment or service contracts.
	Special Category Data Reasonable Adjustment Data	Special Category Data Candidates have given their explicit consent to the processing of their Reasonable Adjustment Data for the purposes of considering whether any appropriate adjustments are required during the recruitment process and implementing any such adjustments.
Generating summaries of background information about candidates using Crowell AI for internal administrative purposes only, such information to be used by interviewers as part of the recruitment process (this information will be subject to human review prior to being shared with interviewers).	Identity and Contact Data; Recruitment Data; Employment Data; and Education Data	Processing is necessary for our legitimate interests in providing appropriate background information to interviewers to maximise the efficiency and relevance of the recruitment process.