3087323 - Request to be Forgotten - Recruiting Management

This article describes the steps on how to comply with To Be Forgotten Requests from Candidates. This documentation assumes the following:

• You have an urgent To Be Forgotten Requests from a Candidate. 
• You have Data Retention Management enabled on the instance but do not have purging and anonymization settings fully enabled or you are unsure if they are setup. 

The documentation details what settings are necessary and for what purpose, you can pick the options that suit your needs. This documentation covers most of the settings for Data Retention Management except the setup for DRTM Candidate Purge, since DRTM Candidate Purge purges candidate profiles by schedule and not on demand. 

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

SAP SuccessFactors Recruiting Management

When a candidate requests to be forgotten the following should happen:

1. Admin / Recruiting User deletes the Candidate Profile or Candidate deletes their candidate profile.
   
2. Admin / Recruiting User anonymizes the applications link to the Candidate Profile.

What does it mean to delete a Candidate Profile? This means the candidate will no longer be searchable in the Candidate Search. The Candidate can no longer log in their profile as well.

What does it mean to anonymize an Application? Applications cannot be deleted or purged like the candidate profile; it can only be anonymized. This means the field values will show as ***** when a recruiting user opens the application in the requisition. 

Please consult with a partner on how to implement the settings and changes required to meet these requirements.

PART 1: Deleting the Candidate Profile

1. Candidates: The candidates can delete their own profile using either the trash bin icon or via Settings > Profile > Delete profile. 
2. Recruiting Users: Another way is for Recruiting users to delete them via the Delete Candidate feature under Admin Center. 

Go to Admin Center > Delete Candidate > Search for the Candidate name to delete. 

Pre-requisites of Delete Candidate Feature: 

1. Enable DCPS 2.0 in provisioning. When you enabled DPCS 2.0, the following statuses should have been added in your status set as well.
   • Deleted On Demand By Candidate
   • Deleted On Demand By Admin
   • Declined DPCS
     
     
     
     
2. Manage Permission Roles > [Role Name] > Permissions > Manage Recruiting > Delete Candidate. This permission should give you access to the Delete Candidate option in Admin Center. 

Note: This section is similar to purging candidate profiles using the DRTM Candidate Profile Purge job, the only difference is the timing. DRTM Candidate Purge deletes candidate profiles by schedule and not on demand. 

PART 2: Anonymize the Applications linked to the Candidate Profile

1. In Admin Center > Manage Template > Application Templates > The fields you want to be anonymized should be set to anonymize="true". When the anonymization job runs, the fields will show as ******.
   
   Note: If you do not have this setup and the anonymization job runs against the application, even if you run the anonymization job again, these fields’ data will not be anonymized in the database.
   
   
2. In Admin Center > Manage Recruiting Settings > Deletion of Correspondence > Check all options you require; we suggest you check all of them.

• Delete all the email and print correspondence available for candidate
• Delete all the offer letters available for candidate
• Anonymize all the request/response info of background check available for candidate
• Anonymize all the request/response info of onboarding available for candidate

Note: These options would delete all the other application data like history, email correspondences, etc., when the application is anonymized. If you do not have this checked and the anonymization job runs against the application, even if we run the anonymization job again, these application data will not be anonymized in the database.

Important: In previous versions, Job Applications that are already picked up by the anonymization job once will not be picked up again even if you run the job again. But the DRTM Inactive Job Applications in the current release can now rerun anonymizations on applications. Under DRTM Inactive Job Applications > You will see the option Define Purge Criteria > Job Applications to Purge > Selected Job Applications.  

Setting up of the Anonymization Jobs (Part 1 – Inactivity Criteria)

1. In Admin Center > Manage Data > DRTM Inactive Job Application > APPLICATION > Period of Inactivity (column). What does inactivity days mean here and how is it computed?
   
   Inactivity days is literally the number of days the application is inactive or has no updates. To compute the inactivity date for an application, it will be the duration from today’s date to whatever date is configured in Admin Center > Manage Recruiting Settings > DRM and DRTM Purge Settings > Job Application and Candidate Purge:
   • Use Application Last Modified date to start the Application aging for purge.
   • Use Application Disposition date to start the Application aging for purge.
   • Use Job Req Closure date to start the Application aging for purge.
     
     For example, if the ‘Use Application Last Modified date to start the Application aging for purge’ option is chosen, the inactivity days will be the last modified date in the application history up until today’s date.
     
     
2. In Admin Center > Manage Data > DRTM Inactive Job Application > APPLICATION > Country / Region column. The Country / Region section is pertaining to the standard derived country field of the Job Requisition. This is not the application or candidate profile country and it is not the posting country either. 
   
   
3. From this screenshot's settings, the applications that have the (1) country Germany and are (2) inactive for 6 months will be subject for anonymization based on this criteria. Another example, the applications that have the (2) country United States and are (2) inactive for 8 months will be subject for anonymization based on this criteria.
   
   
   
   
4. Make sure the inactivity days you set in Manage Data is lower than the number of inactivity duration of the target applications. For example, there are 3 applications linked to the candidate who requested to be forgotten and the requisition country is Germany. Application 1 is inactive for 20 days, Application 2 is inactive for 30 days, and Application 3 is inactive for 45 days. The lowest inactivity days for all applications is 20 days.
   
   If you are going to set the inactivity for Germany, it should be set to DAYS instead of MONTHS and the value should be less than 20, e.g., 15 days. 
   
   This would mean all the applications with (1) requisition country Germany and (2) that are inactive for 15 days and above will be subject for anonymization. This setting would pick up all 3 applications for the candidate.
   
   Please note that the number of inactivity days is based on the Customer's requirements, the numbers provided above are examples.
   
   
5. Caveats: This job would pick all applications that match the criteria, even those applications that did not request to be forgotten. We cannot anonymize a single application or setup the Manage Data to only target the application we want. This is expected behavior and is a limitation. 
   
   However, In Progress applications will not be affected. It will only affect those in disposition and onboard statuses that meet the criteria. 
   
   
6. You must set up the inactivity criteria per country of the requisition where the candidate’s applications are. For example, the candidate to be forgotten has applications in requisitions with the country values: Germany, France, Switzerland. You would need to set the inactivity duration for those countries individually.

Setting up of the Anonymization Jobs (Part 2 – Anonymization Jobs) 

There are two Anonymization jobs that can be configured in the system and they do the same thing, i.e., they anonymize applications, but their targeted application statuses are different. Examine where your candidate applications are and just setup the anonymization job which targets your applications’ statuses. 

1. DRTM Purge Inactive Job Application (in Admin Center > Data Retention Management) – Anonymizes all applications in all Disqualification, Closed, and Onboard statuses except for (1) Deleted on demand by candidate, (2) Deleted on demand by admin, (3) Declined DPCS.
2. RCM Entity Anonymization Job (in Provisioning) – Anonymizes all applications in (1) Deleted on demand by candidate, (2) Deleted on demand by admin, and (3) Declined DPCS.
   
   Note: The name DRTM Purge Inactive Job Application can be confusing since it is called an application purge but what it does is anonymize applications.
   
   Anonymization Job 1: DRTM Purge Inactive Job Application
   
   In Admin Center > Data Retention Management > Create the job DRTM Inactive Application Purge > Set the countries of the requisitions where applications are and the approver name (who will run and approve the job).
   
   You do not have to schedule it; you can launch it immediately. Just make sure that the settings in Manage data and the DRTM jobs you have configured here do not conflict with your existing DRTM configurations (if you have them). When the job is launched, it will go to your set approver’s Admin Center > Purge Request Monitor for approval. Just approve the job and it will run the anonymization right away.
   
   Important Note: The DRTM Purge Inactive Job Application waits for the criteria (in the Manage Data) to be met before running anonymization on the applications.
   
   
   
   
   Anonymization Job 2: RCM Entity Anonymization Job
   
   There is another anonymization job in provisioning called RCM Entity Anonymization Job. The configuration for RCM Entity Anonymization Job is simpler but it is in Provisioning and would require a partner to configure.
   
   Important Note: The RCM Entity Anonymization Job does not take into consideration the criteria (in the Manage Data). It will run anonymization on the applications as long as the applications land on the status and the job runs.
   
   
   
   
3. Depending on your needs, you may just run it once. 

Note: When you have run the anonymization job and it picked up the application, any fields that were not anonymized on the first run, due to misconfiguration, will never be picked up again even after you fix the misconfiguration.

• Additional Note 1: Provided that you have configured all the necessary configurations, when the candidate or recruiting user deletes the candidate profile, that action should trigger all the candidate's In-Progress applications to be moved to Deleted On Demand By Candidate status (if the profile is deleted from the candidate side) or Deleted On Demand By Admin status (if the profile is deleted from Delete Candidate option).
• Additional Note 2: If the candidate has applications that are in the disqualified status already prior to the deletion of the Candidate Profile, those applications will remain in whatever disqualification status they are currently in. 
• Additional Note 3: Deleting the candidate profile will not automatically anonymize the applications linked to it. However, all applications linked to a deleted candidate profile will be subject for anonymization. But to be anonymized, they would have to meet the criteria in Manage Data. 

2635179 - Data Retention Time Management configuration in Recruiting

Request to be Forgotten, Purge, Purging, Anonymization, Anonymize, Job Application, Candidate Profile, RCM, Recruiting Management, DRTM, Delete , KBA , LOD-SF-RCM-SYS , System Performance, Usability, Errors, Security , How To