Global Recruitment Data Protection Notice

1. Scope

This Global Recruitment Data Protection Notice (“Notice”) explains how Sidley Austin LLP, including its affiliated partnerships (collectively the ”firm”) collects, uses, discloses, and processes Personal Information pertaining to individuals who apply for a position or role at the Firm (“Applicants”, “you”, “your”), including as an employee, self-employed lawyer or consultant, and all Applicants who are applying for an internship, vacation scheme, summer associate programs, work placement, or similar programs. It also applies to the Personal Information collected from Applicants who interact with the firm online, including through our websites, including job application websites or platforms (collectively the “Websites”) and our social media pages, or communicate with us via email, video conferencing platforms (collectively the “Internet Services”). A separate Privacy Statement [https://www.sidley.com/en/sidley-pages/full-online-privacy-statement] applies to processing of Personal Information by the firm submitted or collected elsewhere on firm Websites or Internet Services. A separate notice applies to our processing of Personal Information through cookies [https://www.sidley.com/en/sidley-pages/cookie-list].This Notice does not apply to our partners, employees, independent contractors, and others whose Personal Information we may collect when they provide work for the firm or interact with the firm in an employment capacity. Where an applicant accepts an offer, relevant recruitment data may be used for initial onboarding. Processing during the subsequent employment, engagement or internship is described in the applicable separate privacy notice, which will be provided before that processing takes place.

By accessing our Websites or making use of our Internet Services as an Applicant, you agree to our Terms and Conditions, including the collection and use of your Personal Information as described in this Privacy Policy. This Notice is provided for information purposes and does not constitute a request for consent. Where consent is required for a specific processing activity, it will be requested separately.

For purposes of this Notice, “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. This term also includes “personal data” to the extent that term is used by specific privacy and data protection regulatory schemes. The term does not include aggregated information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

This Notice is issued by Sidley Austin LLP as data controller (i.e., a person or organization who alone or jointly determines the purposes for which, and the way, any personal data is, or is likely to be, processed). For California residents, this Notice and separate Statement serve as our notice at collection as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act. As applicable, we will provide notice for any additional collection of Personal Information.

For information on our processing activities and your rights related to those activities as a resident of certain states within the United States please consult Section 16 below.

2. Collecting Your Personal Information

We may collect certain Personal Information directly from you, as an Applicant (when you apply or visit our offices), but we may also collect it from external recruitment agencies, background check vendors and other non-publicly accessible sources. If you do not provide us with the necessary Personal Information, or if we are unable to obtain it elsewhere, we may not be able to proceed with the application, consider you for a position or offer you an internship, vacation scheme, summer associate programs, work placement, or similar program.

If you participate in our internship, vacation scheme, summer associate programs, work placement, or similar programs. we will also collect information about your performance during job-related activities and assessments through the course of your placement with us.

3. Types of Personal Information We Collect

During the recruitment process, or if you participate in one of our internship, vacation scheme, summer associate programs, work placement, or similar programs, we may, where allowed by applicable legislation, collect and process the following types of personal data:

i) Personal identifiers: name, email address, home or billing address, telephone numbers , IP address, governmental ID, Social Security number and similar identifiers used for tax or billing purposes, and signature.

ii) Employment and educational history: CV/resume, academic transcripts, references and organizational data such as department, work location, job title and seniority, professional qualifications, language skills); information about placements including the location of your placements, start and end date of your placement, information and opinions regarding your performance during your interviews and/or placement; information about your legal entitlement to work (e.g., visas, permits, immigration status); and the location of your placements.

iii) Reference and next of kin information: information from references or other individuals who know you and may speak to your professional qualifications and experience.

iv) Protected class and other sensitive or special category information: information in relation to sex/gender, race, nationality, ethnicity, religion, sexual orientation, disability-related information (e.g., information in relation to any medical condition, health and sickness records to the extent that you require adjustments to be made to our assessment and interview processes); information about criminal convictions and offenses committed by you.

v) Audio, electronic, and visual information: CCTV footage and other information obtained through electronic means; social media or other online activity; information about your use of our information and communication systems; and photographs of you.

vi) Internet or other electronic activity information: your device and browser type, your browsing and search history on our Websites, information regarding your interaction with our Websites and our social media posts or Internet Services, and similar data collected automatically or through cookies.

vii) Other information: any other information which you may voluntarily disclose to us during the application process.

4. Purposes for Collection of Personal Information

Set out below is a description of how we use your Personal Information (referred to as “processing purposes” below), and, for Applicants located in the EEA or the UK, we explain which of the legal bases we rely on for each processing activity.

Categories of Personal Information	Processing Purposes	Legal Basis, and Where Appropriate, Condition (where you are located in the EEA or the UK or jurisdictions with similar requirements)
Personal identifiers; Employment and educational history; References and next of kin information	Recruitment and application processing: To receive, review, and evaluate your application and supporting materials (resume/CV, cover letter, portfolio); To assess your qualifications, skills, and suitability for the role applied for; To communicate with you about your application status and next steps; To schedule and conduct interviews, assessments, or other selection activities; To make hiring decisions and extend offers of employment.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you. For the establishment, exercise or defence of legal claims.
Protected class and other sensitive or special category information	Recruitment and application processing: To consider and provide reasonable adjustments or accommodations in accordance with disability laws; to fulfil equal opportunities monitoring under applicable law and separate from hiring decisions; to verify identify and support background screening processes with consent; to verify your right to work in applicable jurisdictions and comply with immigration laws.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you. For the establishment, exercise or defence of legal claims. For Applicants located in the EEA, the UK or Switzerland: because this category includes special category/sensitive personal data, we only process it where an additional condition under Article 9(2) GDPR/UK GDPR (or the equivalent Swiss FADP requirement) is also met – namely your explicit consent, a substantial public interest basis for equal opportunities monitoring under applicable law, compliance with our employment/social security law obligations, or the establishment, exercise or defence of legal claims.
Personal identifiers; Employment and educational history; References and next of kin information	Pre-employment screening and verification: To verify the accuracy of information you have provided, including employment history, education, and professional credentials/licenses; To conduct background checks, where permitted by applicable law and with required notice/consent (e.g., criminal history, credit history); To conduct reference checks with your former employers or other contacts you have provided; To verify your eligibility to work in the applicable jurisdiction (e.g., right-to-work checks, visa/immigration status); To conduct drug or alcohol screening, where required or permitted by law.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you. For the establishment, exercise or defence of legal claims.
Personal identifiers; Employment and educational history	Talent management: To retain your information for consideration for future roles, where you have consented or where permitted by applicable law; To contact you about other open positions that may be a fit for your background.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you. For the establishment, exercise or defence of legal claims.
Personal identifiers; Employment and educational history	Onboarding: To prepare and issue an offer of employment and employment contract; To initiate onboarding processes and set up internal systems (payroll, IT access, benefits enrollment); To transfer relevant application data into your employee record.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you. For the establishment, exercise or defence of legal claims.
Personal identifiers; Audio, electronic and visual information; Internet or other electronic activity information	Health, safety, and security obligations: To protect the safety and security of our employees, facilities, and systems during any on-site interview, Firm events, or assessment process; To verify identity prior to granting access to our premises or systems.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes, and to manage and administer our relationship with you.
Personal identifiers; Employment and educational history; Protected class and sensitive or special category information	Legal and regulatory obligations: To comply with applicable employment, immigration, and equal opportunity laws and regulations; To respond to legal process, government inquiries, or regulatory investigations; To establish, exercise, or defend legal claims; To prevent fraud.	To comply with our legal obligations. In such cases, if you do not provide this Personal Information when requested, we may not be able to comply with our legal obligations and we may have to terminate our relationship with you. To pursue our legitimate interests to enforce or defend our rights and interests.
Personal identifiers; Audio, visual, and electronic information; Internet or other electronic activity information	Information technology: To monitor your use of our information and communication systems to ensure compliance with our IT policies	To pursue our legitimate interests to ensure our systems / Websites are secure and that individuals are using our systems / Websites correctly and in compliance with our Terms and Conditions.
Personal identifiers; Protected class and other sensitive or special category information; Other information	Inclusion: To carry out equal opportunities monitoring and to support an inclusive workforce.	To pursue our legitimate interests to operate our business and recruitment and onboarding processes or to comply with our legal obligations.

5. Retention Periods

We will only keep your data for as long as necessary for the purposes for which it was collected, for us to fulfil our statutory obligations and where we have a legitimate interest to do so. The criteria used to determine our retention periods are: (i) the duration of the application process ; (ii) the period of time that we have an ongoing relationship with you; (iii) as required by a legal obligation to which we are subject; and (iv) as advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

In the event we make an offer and you accept, your personal data will be held and processed in accordance with our Internal Data Protection Notices and other relevant procedures and policies.

6. Sensitive Personal Information

We do not process sensitive Personal Information to create profiles or infer characteristics about you as an Applicant, unless required or permitted by law for compliance and reporting purposes.

7. No Profiling to Facilitate Recruitment Decisions

We do not engage in the automated processing of Personal Information without meaningful human involvement to make profiles about Applicants that are used in furtherance of recruitment decisions or other similarly significant effects in the recruitment context.

8. Disclosure of Personal Information for Business Purposes

Where allowed by applicable legislation, we may disclose certain personal data for the above purposes to the following recipients:

Category of Personal Information	Categories of Third Parties with Whom Personal Information is Shared
Personal identifiers: name, email address, billing address, telephone numbers, account number, IP address, governmental ID, Social Security number and similar identifiers used for tax or billing purposes, and signature.	Affiliates, service providers providing IT and cloud/hosting services, background checks, HR services, recruitment services, and recruitment agencies, fraud prevention agencies, government and non-governmental regulators, organizations or other certifying bodies for the purposes of equal opportunities monitoring and inclusion initiatives, and other third parties for legal compliance purposes where the Firm believes such disclosure is required by applicable law.
Employment and educational history: CV/resume, academic transcripts, references, organizational data such as department, work location, job title and seniority, professional qualifications, language skills, work history, prior employer, information from reference checks, work experience, qualifications, training and skills, cover letter, professional and other work-related licenses, permits and certifications, information about placements including location, start and end date, information and opinions regarding your performance during interviews and/or placement, information about your legal entitlement to work (e.g., visas, permits, immigration status), publicly accessible information posted on professional social media accounts	Affiliates, service providers providing IT and cloud/hosting services, background checks, HR services, recruitment services, and recruitment agencies, fraud prevention agencies, government and non-governmental regulators, organizations or other certifying bodies for the purposes of equal opportunities monitoring and inclusion initiatives, and other third parties for legal compliance purposes where the Firm believes such disclosure is required by applicable law.
Protected class and other sensitive or special category information: information in relation to sex/gender, race, nationality, ethnicity, religion, health and sexual orientation for equal opportunities monitoring and to support our inclusion initiatives, disability-related information (e.g., information in relation to any medical condition, health and sickness records to the extent that you require adjustments to be made to our assessment and interview processes); information about criminal convictions and offences committed by you.	Affiliates, service providers providing IT and cloud/hosting services, background checks, HR services, recruitment services, and recruitment agencies, fraud prevention agencies, government and non-governmental regulators, organizations or other certifying bodies for the purposes of equal opportunities monitoring and inclusion initiatives, and other third parties for legal compliance purposes where the Firm believes such disclosure is required by applicable law.
Internet or other electronic activity information: your device and browser type, your browsing and search history on our Websites, information regarding your interaction with our Websites and our social media posts or Internet Services, and similar data collected automatically or through cookies.	Affiliates, service providers providing IT and cloud/hosting services, background checks, HR services, recruitment services, and recruitment agencies, fraud prevention agencies, government and non-governmental regulators, organizations or other certifying bodies for the purposes of equal opportunities monitoring and inclusion initiatives, and other third parties for legal compliance purposes where the Firm believes such disclosure is required by applicable law.
Audio, electronic, and visual information: photographs, video and voice recordings of conversations with you as permitted by law, and security camera and CCTV footage recordings of your activity in our offices.	Affiliates, service providers providing IT and cloud/hosting services, background checks, HR services, recruitment services, and recruitment agencies, fraud prevention agencies, government and non-governmental regulators, organizations or other certifying bodies for the purposes of equal opportunities monitoring and inclusion initiatives, and other third parties for legal compliance purposes where the Firm believes such disclosure is required by applicable law.

9. Business Purposes for Such Disclosure

We may disclose the aforementioned categories of Personal Information to the categories of entities identified above for the following purposes: to assist in the employee identification process, recruitment, and onboarding process; facilitate email communications; manage contacts; work with vendors and suppliers; manage our Websites, operate our IT systems and secure our systems; and host events; billing, payment processing, and security or background checks; for marketing and analytics; and where we believe it necessary to provide a service which you have requested, or as permitted or required by law, or as otherwise authorized or directed by you.

We may also disclose Personal Information as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also disclose your Personal Information to third parties to help detect and protect against fraud or data security vulnerabilities. We may transfer your Personal Information to a third party in the event of an actual or contemplated sale, merger, reorganization of our entity or other restructuring. We may also disclose Personal Information to organizations or other certifying bodies for the purpose of equal opportunities monitoring.

10. Confidentiality and Security

We maintain reasonable and appropriate security measures, including physical, electronic and procedural safeguards intended to maintain the confidentiality of Personal Information and protect Personal Information we maintain from loss, misuse, unauthorized access, or destruction. Please note that we cannot guarantee that our safeguards will always work, as no system is fully secure.

11. International Transfers of Your Personal Information

As an international firm, we operate systems that may make Personal Information included in or related to your application or our recruitment efforts accessible from our various offices around the world and often transfer Applicant data between our offices. We may disclose your Personal Information, for the above listed purposes, to recipients (including affiliated partnerships) in locations that do not have data protection laws equivalent to those in the UK, the EEA, Switzerland or Singapore. In such a case, we will take all necessary steps to ensure the safety of your Personal Information in accordance with all applicable data protection laws at a standard substantially similar to, or that serves the same purposes as those of the relevant legislation (if applicable). For transfers of Personal Information within the Firm to offices outside of the UK and EEA we have in place intra-group Data Transfer Agreements with EU Standard Contractual Clauses and UK Addendum. You can request a copy of these agreements by contacting privacy@sidley.com.

12. Your Rights In Relation to Your Personal Information

Under applicable data protection laws, you may have a right to:

be informed about how your Personal Data is used;
access your personal data;
have inaccurate personal data rectified;
have personal data erased in certain circumstances;
restrict processing of personal data in certain circumstances;
data portability (you can ask for a copy of your personal data to be provided to you, or a third party, in a digital format);
object to processing of personal data in certain circumstances, including where personal data is used for marketing purposes; and
not to be subject to automated decisions where the decision produces a legal effect or a similarly significant effect. (automated decisions are decisions about individuals that are based solely on the automated (i.e., computerized) processing of data and that produce legal effects or that significantly affect the individuals involved.

You may also have the right to lodge a complaint about the processing of your personal data with your local data protection authority, please contact us at privacy@sidley.com if you’re interested to find out the contact details of your local regulator/authority.

13. Non-Discrimination

Sidley Austin does not discriminate, either directly or indirectly, on protected grounds in any area of recruitment. Where allowed by local laws, the firm also supports the rehabilitation of offenders. Former offenders are not prevented from applying for employment on the basis of a historic conviction unrelated to the role applied for.

As provided in this Notice, we may ask you information in relation to sex/gender, race, nationality, ethnicity, religion, health, and sexual orientation. We use this data for equal opportunities monitoring. If you exercise any of the rights explained in this Notice, we will continue to treat you fairly.

14. Updates

We evaluate our privacy notices, policies and procedures to implement improvements and refinements from time to time. If we make material changes to this Notice that affect you, we will notify you by regular communication channels.

15. Enquiries, Requests or Concerns

All enquiries, requests or concerns regarding this Notice, your rights, or relating to the processing of your personal data (including our legal basis for processing in each case), should be sent to privacy@sidley.com.

16. Jurisdiction-specific Notices and Exceptions

16.1 Your Privacy Rights under U.S. State Privacy Laws

This section provides additional information to individuals in certain states in the United States of America with privacy laws that provide residents with rights over their personal information and data. Under U.S. state privacy laws, you may be able to exercise the following rights with respect to the Personal Information we collect, use, disclose, or otherwise process.

This Privacy Statement describes the types of Personal Information we may collect from you, including the categories outlined under California law (Cal. Civ. Code 1798.140) during the 12 months preceding the effective date of this Statement, how we use it, and the parties to whom we disclose the information.

Right to Know - You may request to know whether we are processing your personal information and to access that information, including categories and specific data collected, sources, purposes, and third parties with whom it has been shared. The right to request the following information collected since January 1, 2022: (a) categories of Personal Information we have collected about you; (b) categories of sources from which such Personal Information was collected; (c) categories of Personal Information that the business sold or disclosed for a business purpose about the consumer; (d) categories of third parties to whom the Personal Information was sold or disclosed; (e) the business or commercial purpose for collecting or selling your Personal Information.

Right to Access / Copy - The right to access or request a copy of the Personal Information we have collected about you, subject to certain exceptions.

Right to Delete - The right to request deletion of Personal Information that we have collected about you, and to have such information deleted, subject to certain exceptions.

Right to Correct - The right to request that we correct inaccuracies in your Personal Information, taking into account the nature of personal data and purposes of processing such information.

Right to Know Categories of Third Parties and Third Party Recipients of Personal Information - The right to know the categories of third parties and the identities of third parties to which we have disclosed personal information.

Right to Data Portability - You may request a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.

16.2 No Sale or Sharing of Personal Information

We do not sell Personal Information and we do not share Personal Information for cross-context behavioral advertising.

16.3 Exercising Your Rights and How We Will Respond

To exercise rights to know, access/copy, delete, correct, or know third parties to whom Personal Information is disclosed, or to ask a question, contact us at privacy@sidley.com, or by mail at:

Sidley Austin LLP
ATTN: Chief Privacy Officer
1501 K Street NW
Washington, D.C. 20005

California residents or their authorized agents may also make such a request by calling 1-800-901-8505.

You are entitled to make such requests free of charge once (or in Texas, twice) in a 12-month period; excessive or unfounded requests may incur a reasonable administrative fee.

16.4 Exercising Your Rights Using Authorized Agents

You may designate an agent to submit data subject requests on their behalf. If you use an agent to submit data subject requests (e.g., to access, delete, correct, or obtain a copy of Personal Information), the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. You will also be required to verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. Agents can submit requests on behalf of residents by emailing privacy@sidley.com.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with state law pertaining to powers of attorney.

16.5 Verification of Identity – Access, Deletion or Correction Requests

We will ask you for identifying information and attempt to match it to information that we maintain about you. If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to your request. We will notify you to explain the basis of the denial.

16.6 Appeals and Additional Information

In some cases, we may deny your request if we cannot verify your identity, if the request is unfounded, excessive, or repetitive, if disclosure involves sensitive or legally protected information, or if fulfilling it would conflict with legal obligations or exemptions under applicable laws. If we decline to act on your request, you may appeal by emailing privacy@sidley.com. We will respond to appeals within 60 days with an explanation of the decision. If your appeal is denied, you may contact the appropriate state authority.

16.7 California Shine the Light

With reference to California Civil Code Section 1798.83, also known as the “Shine the Light” law, we do not provide personal information to third parties for their direct marketing purposes.

17. Belgium

The following applies to our data collection and processing activities in Belgium:

The data controller for the processing of the Applicant´s personal data is Sidley Austin (CE) LLP Brussels Branch, located at Rue Montoyer 51, 1000 Brussels, Belgium is the data controller responsible for your personal data.
Section 3(i) (Personal identifiers): bank account/payment details are collected only where the Applicant has requested reimbursement of travel expenses incurred for the interview; no other billing or payment information is otherwise collected.
Governmental ID, Social Security number are collected only if the applicant is successful, as part of the offer process.Section 3(ii) and (iii) (Employment and educational history; References and next of kin information): Reference checks and verification of employment history will only be conducted where relevant and necessary for the position concerned, subject to prior notification and the candidate's authorisation. The Firm will not contact a candidate's current or most recent employer as part of its standard Brussels recruitment screening process.
Section 3(iv) (Protected class and other sensitive or special category information): only data relating to sex/gender and nationality is collected. We do not collect data relating to race, ethnicity, religion, sexual orientation, or information about criminal convictions or offences, as part of our Belgian recruitment process. We do not request medical histories or general disability or health information for recruitment selection in Belgium. Where you request an adjustment to the recruitment process, we may process only the information necessary to assess and organise that adjustment, subject to an applicable legal basis and, where relevant, a condition under Article 9 GDPR. Access to such information is restricted.
Section 3(v) (Audio, electronic, and visual information): The Firm does not routinely collect or use CCTV footage, personal social media activity, private online activity, or audio and video recordings for the purpose of assessing candidates in Belgium. Any processing of such information will be limited to specific, legitimate purposes, where necessary and permitted by applicable law. Photographs will only be collected where necessary for a specified recruitment or onboarding purpose.
Section 4 (Pre-employment screening and verification): Background checks in Belgium are limited to information relevant and necessary for the position concerned and are subject to applicable Belgian data protection and employment legislation. Reference and employment verification checks will be conducted with the candidate's prior authorisation. Criminal record checks, credit history checks, and medical or drug screening will not be undertaken as part of routine recruitment screening and will only be considered where specifically permitted or required by applicable law.
Section 5 (Retention periods): Personal information relating to unsuccessful candidates will be retained only for as long as necessary for legitimate recruitment purposes or to comply with applicable legal obligations. Any extended retention for future recruitment opportunities will be subject to an appropriate legal basis and applicable data protection requirements.
We do not conduct routine credit checks or drug or alcohol screening as part of recruitment in Belgium.
The collection and processing of recruitment data will be limited to what is necessary for the position.

If you are unhappy with the way we have handled your personal data or any privacy query or request that you have raised with us, you have a right to complain to the Data Protection Authority (https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint), in addition to the rights described above.

18. Germany

DATENSCHUTZHINWEISE FÜR BEWERBER

The following applies to our data collection and processing activities in Germany:

The data controller for the processing of the Applicant´s personal data is Sidley Austin (CE) LLP, Maximilianstraße 35, 80539 Munich, Germany, Phone +49 89 24440 9100, E-Mail MU-Reception@sidley.com.
Our Data Protection Officer can be reached via privacy@sidley.com or by writing to Sidley Austin (CE) LLP c/o Willem Lubbe, Maximilianstraße 35, 80539 Munich, Germany.
Section 3(iv) (Protected class and other sensitive or special category information): only data relating to sex/gender and nationality is collected; providing this information is entirely voluntary.
Section 3(i) (Personal identifiers): bank account/payment details are collected only where the Applicant has requested reimbursement of travel expenses incurred for the interview; no other billing or payment information is otherwise collected.
Section 3(v) (Audio, electronic, and visual information): photographs are collected only if the Applicant is successful, as part of the offer process.
Section 3(ii) and (iii) (Employment and educational history; References and next of kin information): placement-specific details (e.g., location, start/end dates, and performance opinions) and next of kin/reference information are collected only where you participate in an internship, vacation scheme, work placement, or similar program.
Right-to-work verification (see the “Pre-employment screening and verification” purpose above) has limited application in Germany and is carried out only to the extent required under German immigration and residence law.

19. Japan

The following applies to our data collection and processing activities in Japan:

Section 3(ii) (Employment and educational history): information about your legal entitlement to work (e.g., visas, permits, immigration status) is not collected as part of the recruitment process.

20. United Kingdom

The following applies to our data collection and processing activities in the United Kingdom, in addition to the UK GDPR and Data Protection Act 2018 rights and information described elsewhere in this Notice:

Sidley Austin LLP of 70 St Mary Axe, London, EC3A 8BE, is the data controller responsible for your personal data for recruitment in the United Kingdom.
Section 3(iv) (Protected class and other sensitive or special category information): special category data (e.g., health or disability information, sexual orientation, religion, or ethnic origin) is collected only where you choose to provide it for equal opportunities monitoring purposes – which is kept separate from, and does not influence, hiring decisions – or where relevant to a request for reasonable adjustments, consistent with the substantial public interest and employment conditions in Schedule 1 of the Data Protection Act 2018.
Section 3(iv): information about criminal convictions or offences is collected only to the extent necessary for right-to-work checks or role-specific regulatory/fitness-to-practise requirements, in accordance with Schedule 1, Part 3 of the Data Protection Act 2018 and our related policy.
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk, in addition to the rights described above.

21. European Economic Area (Other Member States)

For Applicants located in an EEA Member State not separately addressed in this Section, the following applies in addition to the rest of this Notice:

The relevant Sidley affiliated partnership or branch office in that jurisdiction, as identified on our Websites or as notified to you during the application process, acts as the data controller (or joint controller with Sidley Austin LLP) for your personal data.
Section 3(iv) (Protected class and other sensitive or special category information) and information about criminal convictions or offences are processed only where an additional condition under Article 9 or Article 10 GDPR, as implemented by the relevant Member State's national law, is also satisfied – such as your explicit consent, a substantial public interest basis for equal opportunities monitoring, an employment or social security law obligation, or the establishment, exercise or defence of legal claims.
You have the right to lodge a complaint with the data protection supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

22. Switzerland

Where you are located in Switzerland, or our processing of your Personal Information is otherwise subject to the Swiss Federal Act on Data Protection (“FADP”), the following applies:

Sidley Austin (CHE) LLP, Rue du Pré-de-la-Bichette 1, 1202 Geneva, is the controller responsible for your personal data.
Section 3(iv) (Protected class and other sensitive or special category information), including data concerning health, religious or ethnic origin, or data on administrative or criminal proceedings and sanctions, is processed only with your consent, where necessary to safeguard your or a third party's vital interests, where you have made the data generally available yourself, or as otherwise permitted under Article 31 FADP.
For transfers of your personal data outside Switzerland, we rely on the FDPIC-recognized Swiss Addendum to the EU Standard Contractual Clauses, or on transfers to a country recognized by the Swiss Federal Council as providing an adequate level of data protection.
You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch).

23. Contact Us

For questions about this Global Recruitment Data Protection Notice and other of Sidley Austin’s privacy practices, please contact:

David A. Lindner
Chief Privacy Officer
Sidley Austin LLP
1501 K Street, N.W.
Washington, D.C. 20005
privacy@sidley.com

If you wish to exercise any of your rights under the applicable data protection laws mentioned in this Notice, please contact us using the Webform here.