Code of Conduct on the Processing of Personal Data
This Code has been developed pursuant to Article 27 of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 (“Directive”) with the objective of achieving consistent compliance with the Directive and with applicable national laws, which implement the Directive, in the light of the special nature of the executive search process. All the Firm’s staff worldwide operates to the standards laid down in this Code and maintains levels of protection for data subjects at least as high as those provided in this Code, subject always to their obligation to comply with their relevant national laws. By complying worldwide with this Code, the Firm provides in all countries in which it operates an adequate level of protection as determined by the EU.
1 Definitions
Whether capitalized or not, for the purpose of this Code of Conduct, the following defined terms have the meanings set forth below:
1.1
Automated Decision Making: a decision which produces legal effects concerning an Executive or a Candidate or which significantly affects an Executive or a Candidate, and which is based solely on automated processing of Personal Data intended to evaluate certain personal aspects relating to the Executive or Candidate such as his performance at work, reliability, decision-making skills and processes, conduct, etc.
1.2
Candidate: an Executive who is being seriously considered by a Client for a specific job opportunity, who has received information about that position, and who is qualified for and interested in the position; or in the context of a management appraisal or talent review, an employee of a client.
1.3
Client: an organization seeking to recruit or evaluate an Executive via Consulting Activities.
1.4
Consent: There are three types of Consent referred to in this Code:
- General Consent to collect and process Personal Data (“General Consent”)
- Consent which relates to the processing of Sensitive Data (“Sensitive Data Consent”)
- Consent which allows for transfer of Personal Data to non-EEA countries which do not offer an adequate level of data protection (“Transfer Consent”)
General Consent, Sensitive Data Consent and Transfer Consent do not necessarily imply or require written or affirmative consent, unless required by applicable national laws.
The terms “Consents” means collectively General Consent, Sensitive Data Consent and Transfer Consent.
All Consents must be freely given, unambiguous, informed and with such specificity as is necessary given the purposes of the Consent. Consents may be obtained verbally, in writing with electronic signatures or via email.
1.5
Consulting Activities: management consulting activities, which consist of:
- Conducting search assignments under an exclusive contractual (retained) consulting agreement with a Client that involves assistance with the identification, evaluation and selection of qualified Executives/Candidates to fill specific positions for that Client and/or;
- Identifying Executives in the market and possibly retaining their Personal Data to use them against future retained search assignments, and/or;
- Evaluating Candidates as part of a management appraisal or talent review.
1.6
Data Subject: The individual whose data are being processed. Data Subjects for purposes of this Code are either an Executive or a Candidate.
1.7
Directive: Directive 95/46 of the European Parliament and of the Council of 24th October 1995.
1.8
European Economic Area (EEA): composed of EU countries, plus Iceland, Norway and Liechtenstein. The EU Directive 95/46/EC is addressed to the member states of the EEA.
1.9
Executive: a natural person who has submitted Personal Data or a natural person who has been included in the Firm’s database following research or market networking, and who in each instance is qualified to be considered by the Firm for an executive position with a Client, and who has not yet been determined to be a Candidate.
1.10
Essential Information includes the following:
- The identity of the Firm;
- The purpose of the processing i.e. that the Personal Data are being processed with regard to Consulting Activities [1];
- The type of Personal Data required to evaluate the Executive’s match with the job specification [2];
- The categories of recipients of Executives’/Candidates’ Personal Data, for instance the Client or the categories of employees (e.g. researchers/associates and executive search consultants) or subcontractors of the Firm authorized to access the Personal Data [3] as well as the purpose for which the data will be disclosed;
- The fact that Executive’s/Candidate’s personal data may be transferred to countries outside the EEA [4];
- The right to request access, rectification, suppression or deletion of incomplete or inaccurate Personal Data related to Executives/Candidates [5];
- The right to object at any time to the initial or continued processing of his Personal Data for Consulting Activities on the understanding that the Firm will retain some personal information in order to ensure that the Executive/Candidate are not contacted in the future and for historical purposes [6];
- That given the typical long term nature of the relationship between an Executive and the Firm, the Firm reserves the right to keep the Executive’s/Candidate’s data as long as necessary and relevant for the purposes for which the data were collected or for meeting professional obligations or complying with applicable law [7];
- That the Firm reserves the right at any time to delete the Executive’s/Candidate’s data if the data no longer serve the purpose for which data was collected with the exception that data will be retained for historical data management reasons [8].
1.11
Final Candidate’s Evaluation Report: written report made by the executive search consultant to the Client on the career history of a Candidate and containing the consultant’s evaluation and/or opinion of the Candidate’s qualifications and fit for a specific job position and Reference Checks.
1.12
Firm: Egon Zehnder International.
1.13
Notes: the notes and comments of the executive search consultant(s) regarding an Executive or a Candidate, including, without limitation, summaries of interviews with the Executive or Candidate.
1.14
Personal Data: any information relating to an identified or identifiable natural person (i.e. an Executive or Candidate). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity. For purposes of this Code, Personal Data includes “Non Sensitive Data”
[10] and “Sensitive Data”
[11]
1.15
Proactive Data Collection: the gathering of Personal Data by use of desk research, networking discussions with sources to identify Executives/Candidates.
1.16
Processing of Personal Data: any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
1.17
Reactive Data Collection: the receipt of unsolicited Personal Data from Executives wishing to make contact with the Firm. Such reactive data whether electronic or printed is received via personal delivery, mail, facsimile, email or the Firm’s website.
1.18
Reference Checks: comments and opinions made by former employers, colleagues and other third parties on the Candidate’s experience and strengths and weaknesses against the job specification.
1.19
Source: an individual who may be willing to suggest, refer or comment on an Executive in his field of expertise or industry.
1.20 In this present Code:
- The term “he” is used generically and should be understood as “he/she”;
- The term “his”, which should be understood as “his/her/their”; and
- The term “data”, whether capitalized or not, means “Personal Data”.
2.1 This Code applies to the collection and processing of Personal Data of Executives/Candidates in connection with Consulting Activities.
2.2 This Code only applies to Personal Data processed for the purpose of Consulting Activities.
2.3 The Firm shall process Personal Data fairly and lawfully.
2.4 The Firm will process Personal Data in a manner compatible with the purposes for which such Personal Data were originally collected.
2.5 If the Firm intends to process Personal Data for a purpose different than that for which the Personal Data were originally collected, the Firm should check if the new purpose is compatible with the original purpose. If it is compatible, processing for this new purpose is allowed. If it is not compatible, further processing is only allowed if it is in accordance with applicable data protection laws.
3 Categories of Data Processed
3.1 Unless otherwise precluded by applicable local law, the Firm may collect, the following categories of Personal Data relating to Executives (referred to in this Code as “Non-Sensitive Data”):
- Name, professional and honorific titles;
- Addresses, telephone numbers and e-mail addresses;
- Employment history (company, position, title, responsibilities, reporting relationships, achievements, dates);
- Remuneration details;
- Educational qualifications and professional credentials;
- Languages spoken;
- Any other professional skills, such as software knowledge;
- Countries in which the individual has worked;
- Details on the individual’s preferred geographic location and desired career path;
- Marital status and number of children;
- Gender;
- Age; and
- Nationality.
3.2 The following categories of Personal Data relating to an Executive/Candidate are referred to in this Code as “Sensitive Data”:
- Racial or ethnic origin;
- Political opinions;
- Membership of a trade union;
- Religious or philosophical beliefs;
- Physical or mental condition (health);
- Sexual life; and
- Data relating to criminal offences, or criminal convictions
4.1 The Firm will seek not to collect or store Sensitive Data which are excessive for the purpose for which such Sensitive Data are collected.
4.2 When it does collect Sensitive Data, the Firm will:
4.2.1 Process such data fairly and lawfully.
4.2.2 Only collect Sensitive Data that either are sent by the Executive unsolicited to the Firm, or are necessary and relevant to a specific position for which the Executive is being considered and the Executive has given his Sensitive Data Consent.
4.3 The Firm may collect Sensitive Data when necessary for the purposes of carrying out the obligations of the Firm under local employment law
[12] or to implement national or local or community policies, such as:
- Improving the ability of the Firm to place diversity Candidates or ensure equal opportunity based on grounds gender, race or ethnicity;
- Increasing diversity within the Firm’s database; or
- Gathering statistical diversity information about the business, placements and Executives. In such a case, personal data should be made anonymous or at least transformed in such a way as not to allow identification of data subjects, unless the data controller has obtained the data subject's explicit consent.
4.4 Sensitive Data cannot be used by the Firm to unlawfully exclude Executives from job opportunities.
5.1
General Consent. General Consent is required to process Personal Data, unless the data processing is otherwise allowed under applicable national law without such consent or as foreseen under Section 5.2 of this Code.
5.1.1 If General Consent is required, Data Subjects are provided with the Essential Information.
5.1.2 If General Consent is required, such General Consent must be obtained at the latest at the time when the Essential Information is given to the Executive.
5.2
Proactive Data Collection. In so far as allowed under national law, Proactive Data Collection does not require the Executive’s consent.
5.2.1 In any case, the collection of preliminary (basic) research data does not require the Executive’s consent
[13]. Such preliminary research data are collected from publicly available sources (such as the internet or other published sources) or obtained from networking.
5.2.2 Later in the executive search process, when an Executive is contacted for the first time and a dialogue with the Firm begins, the Firm should obtain a General Consent from the Executive at that time as described above under Section 5.1.
5.3.
Reactive Data Collection. The processing of Personal Data resulting from Reactive Data Collection does not require Consent from the Executive, because by providing the Firm with unsolicited data, the Executive is deemed to have implicitly consented to the collection and use of his or her Personal Data and agreed to be considered for executive search assignments.
5.3.1 If the Firm wishes to keep unsolicited Personal Data received from Executives via Reactive Data Collection will acknowledge receipt of the data and provide Executives with the Essential Information.
5.4
Sensitive Data Consent. If Sensitive Data Consent is required, it must be obtained by the Firm prior to the processing of such Sensitive Data.
5.5
Transfer Consent. If Transfer Consent is required, it must be obtained by the Firm prior to the transfer of Personal Data to non-EEA countries that have not been determined to provide an adequate level of data protection by the EU Commission.
5.6
Obtaining All Consents At the Same Time. The Firm may obtain all Consents in a single transaction with the Executive. When doing so, the Firm must avoid misleading the Executive by clearly explaining the scope of the various Consents.
6.1 The Firm must provide Executives with the Essential Information as defined under Section 1.10 and provided in this Section. The Essential Information shall be provided at the earliest reasonable opportunity in the search process,
6.1.1 When Personal Data are collected directly from the Executive or
6.1.2 In the case of Reactive Data Collection via an acknowledgement of receipt statement as set forth in Section 5.3.1.or
6.1.3. In the case of Proactive Data Collection, when the Executive qualifies as a Candidate.
6.2 If disclosure of an Executive’s Personal Data to a Client is envisaged, the Essential Information should be given to the Executive no later than when the Executive becomes a Candidate.
7.1 The transfer of Personal Data to countries not offering an adequate level of protection may take place without a Transfer Consent to the extent the Firm provides appropriate guarantees regarding protection of privacy and fundamental rights and freedom, as well as with regard to the exercise of these rights, in particular by adopting and implementing this Code in all countries in which it operates.
7.2 The transfer of Personal Data to third countries not offering an adequate level of protection may nevertheless take place without a Transfer Consent if in some specific circumstances, the transfer is necessary to comply with a legal obligation imposed on the Firm by an EU or national legal instrument
[14].
7.3 The Firm will, despite the worldwide adoption and implementation of this Code, use its best endeavors to obtain a Transfer Consent from the Executive that his Personal Data may be communicated freely within the Firm.
7.3.1 If such Transfer Consent is obtained at the same time as the General Consent is obtained, Executives must be made clearly aware that in addition to the General Consent, they are also agreeing – or not agreeing to the transfer of their Personal Data outside the EEA.
7.3.2 If an Executive does not wish to have his Personal Data transferred outside the EEA, the Firm will seek to offer either the option for the Executive’s Personal Data to be accessible only within the EEA or will seek to remove the Executive’s Personal Data from the Firm’s active database at the election of the Firm.
7.3.3 Transfer Consent is deemed given by the Executive with respect to Personal Data collected through Reactive Data Collection if the Firm makes the Executive clearly aware in the acknowledgement of the receipt of such Personal Data provided to the Executive as set forth in Section 5.3.1 that their Personal Data may be transferred to non-EEA countries and that the Executives are given the option to opt out of such Transfer Consent.
8.1 The Firm will retain Personal Data only as long as necessary to fulfill the purposes for which the Personal Data were originally collected, such as:
- To fulfill its obligations to Executives and Candidates; or
- For the purpose of meeting their professional obligations towards Clients and pursuant to applicable law.
8.2 By way of example, data retention is necessary:
a. After the Candidate’s placement to avoid further recruitment by the Firm of that Candidate.
b. For post-assignment liability and corporate history reasons. For instance, it is necessary to retain Personal Data in order to be able to retrieve it as a defense against possible Client dissatisfaction should the successful Candidate not fit into his new position, or should he leave the Client company for any reason, or should an Executive challenge the fact that he has not been selected as a Candidate or placed with the Client.
c. If the Executive has given General Consent to such data retention for consideration for current and future search assignments. Such General Consent to the data retention shall be deemed given with respect to Personal Data collected through Reactive Data Collection.
8.3 a. The Firm will exercise commercially reasonable efforts to maintain its databases as current and accurate. They will update an Executive’s file by checking Personal Data whenever the Executive is contacted and by encouraging Executives to rectify and correct their Personal Data whenever possible.
b. The Firm will regularly purge, update or clean its data based on the purposes for which such information is being retained. The Firm will remove any Personal Data that has become obsolete or that is no longer relevant to the Firm’s business focus.
c. The Firm reserves the right to remove an individual’s Personal Data at any time. There are many legitimate reasons why the Firm must retain the right to manage its own databases by deleting or deactivating unqualified individuals. Individuals may not be qualified and therefore need to be removed from the databases for several reasons, including, among others, the following:
- An individual may be unqualified because the Firm does not accept search assignments in the individual’s area of experience or expertise;
- An individual may be unqualified because he is not an Executive or qualified to be an Executive; or
- Sometimes an individual becomes unqualified because the Firm discovers that the individual has supplied false or inaccurate Personal Data and the Firm needs to take steps to make certain the individual is not presented as a Candidate to Clients of the Firm.
9.1 An Executive/Candidate may:
a. Object to the processing of his Personal Data;
b. Revoke his General Consent and
c. Request deletion or suppression of his file.
9.2 In all the above cases, the Firm will act on any opt-out request from an Executive/Candidate by removing or suppressing all Personal Data except identification information to ensure that he will not be further contacted. This identification information will not be used for any other purpose than to avoid further contact.
10.1 The Firm ensures Executives’/Candidates’ rights to obtain, upon request and within 30 days unless otherwise stipulated in national laws , the following information:
a. Confirmation whether or not Personal Data relating to them is being processed;
b. The types of Personal Data collected ;
c. The categories of recipients to whom the Personal Data may be disclosed; and
d. Information about the purposes for which Personal Data are being processed.
10.2 The Executive’s right of access covers all the categories of Personal Data listed under Section 3 of this Code as well as the Final Candidate Evaluation Report - if and to the extent such a report exists. It does not include Notes taken during the interview and evaluation process as defined under Section 1.13.
10.3 By exception based upon confidentiality obligations and other individuals’ privacy rights, to be assessed on an ad hoc and individual basis, and provided it is lawful under local law, the Firm may prohibit or limit the right of access to Reference Checks and Sources comments if the Firm believes in good faith that:
(i) The disclosure of such information may adversely affect the interests of the Source, the Client or the person giving the Reference Check, or
(ii) The person who provided the Personal Data has a legitimate interest or reasonable expectation that his identity is or should be kept confidential and not disclosed to the Executive/Candidate .
10.4 In addition to the Executive’s/Candidate’s right to opt out described in Section 9.1 and Section 9.2, the Firm must act on any request from Executives regarding their right to:
a. Request the rectification of incorrect or incomplete Personal Data within 30 days; and
b. Request the suppression or erasure of any incorrect Personal Data collected from them provided that they prove to the satisfaction of the Firm that such data are inaccurate or incomplete.
10.4.1 If the Firm considers that there are compelling grounds for doubting the legitimacy of the request for rectification, the Firm may invite the Executive to produce further evidence on the legitimacy of his request. If the Firm believes in good faith that there is no justification for the rectification, it shall inform the individual on this decision.
11.1 The Firm will take necessary steps to make its Clients aware of the existence of this Code and of the obligations and rights resulting from it.
12. Contractors
12.1 If the Firm would rely on contractors or subcontractors to assist in the performance of Consulting Activities, it shall inform its contractors and subcontractors that they should adhere to this Code of Conduct and comply with national laws.
13. Administration
13.1 The Firm has appointed in each country a person responsible for data administration within the Firm who will:
a. Monitor the compliance of the Firm’s data protection practices with the applicable laws and the provisions of this Code; and
b. Act as a contact point for data protection issues and relevant data protection authorities.
13.2 The Firm’s data administrators ensure that their processing operations are registered and notified with relevant data protection authorities where necessary under applicable national laws.
14.1 The Firm employs appropriate technical and organizational security measures to adequately protect Personal Data against accidental or unlawful destruction, accidental loss, improper alteration, or unauthorized disclosure or access. Account will be taken of specific requirements set out in national laws, if any, in particular with regard to processing of the Personal Data by electronic networks.
14.2 The Firm has taken steps to provide that Personal Data that are held in the Firm’s databases are password-protected and only accessible by individuals such as employees, contractors or subcontractors authorized to access the Personal Data in the field of their competence and/or employment.
14.3 The Firm has taken steps to provide that Sensitive Data, which are processed under the limited restrictions laid down under Section 4, should only be viewed by those individuals who need to know such information in connection with the performance of their duties.
14.4 The Firm has taken appropriate measures so that Personal Data collected online via the Firm’s website are protected in such a way (through login, passwords and other technology) to prevent unauthorized disclosure or access.
15. Automated Decision Making
15.1 Unless otherwise permitted under Section 15.2 below, the Firm shall not base its recommendations or evaluations for specific assignments exclusively on Automated Decision Making.
15.2 The Firm may base their recommendations or evaluations for specific assignments exclusively on automated processing of Personal Data intended to evaluate certain aspects relating to the Executive, such as the Executive’s performance, reliability, conduct, et cetera, if that decision, recommendation or evaluation is either:
a. Part of a contractual obligation with the Client, provided that adequate measures are taken to protect the Executive’s legitimate interests (e.g. foresees the possibility for the Executive to his point of view); or
b. Authorized by applicable local national laws which contain measures to safeguard the Executive’s legitimate interests.
16.1 This Code of Conduct is valid until it is specifically revoked. The Firm will proactively review this Code and update it if needed to stay in line with future legislation and good practices.
___________________________
1 Section 2 of this Code
2 Section 3 of this Code
3 Sections 11 and 12 of this Code
4 Section 7 of this Code
5 Section 10 of this Code
6 Section 9 of this Code
7 Section 8 of this Code
8 Section 8 of this Code
10 As defined in Section 3.1 of this Code
11 As defined in Section 3.2 of this Code
12 As provided in Art. 8 (2) (b) EU Directive 95/46
13 The collection of preliminary research data through Proactive Data Collection not only contributes to conduct the search assignment in question but also to the Firm’s overall understanding of the senior executive market in which it operates. Preliminary research data therefore constitutes significant intellectual capital for the Firm and is necessary for the Firm to fulfill its retained, exclusive and legitimate mandate from the Client. It is typically collected in the early stages of an executive search assignment but also may be collected as part of an ongoing relationship with a Client when consulting on the dynamics of the senior executives market.
14 Article 26 (2) of EU directive: “Without prejudice to paragraph 1, a member state may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses”.
