3087323 - Request to be Forgotten - Recruiting Management

This article describes the steps on how to comply with To Be Forgotten Requests from Candidates. This documentation assumes the following:

• You have an urgent To Be Forgotten Requests from a Candidate. 
• You have Data Retention Management enabled on the instance but do not have purging and anonymization settings fully enabled or you are unsure if they are setup. 

The documentation details what settings are necessary and for what purpose, you can pick the options that suit your needs. This documentation covers most of the settings for Data Retention Management except the setup for DRTM Candidate Purge, since DRTM Candidate Purge purges candidate profiles by schedule based on the retention period in Manage Data and not on demand. 

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

SAP SuccessFactors Recruiting Management

(1) When a candidate requests to be forgotten the following should happen:

1. Admin / Recruiting User anonymizes the Candidate Profile or Candidate deletes their candidate profile.
   
2. Admin / Recruiting User anonymizes the Applications linked to the Candidate Profile.

(2) What does it mean to anonymize a Candidate data? 

1. If DRM-2.0 is being adopted, SuccessFactors' anonymization process performs a soft-deletion of candidate and application data. 
2. If DRM-1.0 is being adopted, SuccessFactors' anonymization process performs a hard-deletion of candidate and application data. 

Note: When an application is anonymized, the form can still be seen in the requisition, but the field details will appear as ******.

Please consult with a partner on how to implement the settings and changes required to meet these requirements.

PART 1: Delete the Candidate Profile

There are 2 ways to delete the candidate profile.

1. Candidates: The candidates can delete their own profile using either the trash bin icon or via Settings > Profile > Delete profile. 
2. Recruiting Users: The Recruiting users can delete/anonymize them via the "Anonymize Candidate Profiles" feature in Admin Center. Go to Admin Center > Anonymize Candidate Profiles > Anonymize Candidate Profiles and Applications > Search for the Candidate name to anonymize.

Prerequisites of the Anonymize Candidate Profiles Feature: 

1. Enable DCPS 2.0 in provisioning. When you enabled DPCS 2.0, the following statuses should have been added in your status set as well. 
   • Deleted On Demand By Candidate
   • Deleted On Demand By Admin
   • Declined DPCS
     
     
     
     
                 
2. Manage Permission Roles > [Role Name] > Permissions > Manage Recruiting > Anonymize Candidate Profiles. This permission should give you access to the Anonymize Candidate Profiles option in Admin Center. 

Note: This section is similar to purging candidate profiles using the DRTM Candidate Profile Purge job (in Admin Center > Data Retention Management), the only difference is the timing. DRTM Candidate Purge purges candidate profiles by schedule (based on the retention period in Admin Center > Manage Data > DRTM Candidate Profile) and not on demand. 

PART 2: Anonymize the Applications linked to the Candidate Profile

There are 3 ways to anonymize the applications linked to a candidate profile: (1) Admin Center > Manage Data > DRTM Inactive Job Application, (2) Provisioning > RCM Entity Anonymization Job, and (3) Admin Center > Anonymize Candidate Profiles > Anonymize Disqualified Applications for Anonymized Candidates. 

Note: The each have their own limitations and uses.  

Prerequisites of Application Anonymization:

1. In Admin Center > Manage Template > Application Templates > The fields you want to be anonymized should be set to anonymize="true". 
   
   Note: When the anonymization job runs, the application fields will show as ******. If you do not have this setup and the anonymization job runs against the application, the field data will still be available. 
   
   
2. In Admin Center > Manage Recruiting Settings > Deletion of Correspondence > Check all options you require; it is recommended that you check all of them.

• Delete all the email and print correspondence available for candidate
• Delete all the offer letters available for candidate
• Anonymize all the request/response info of background check available for candidate
• Anonymize all the request/response info of onboarding available for candidate

Note: These options would delete all the other application data like history, email correspondences, etc., when the application is anonymized. If you do not have this checked and the anonymization job runs against the application, the application data will still be available.

Important: In previous versions, Job Applications that are already picked up by the anonymization job once will not be picked up again, even if you run the job again. However, the current versions of DRTM Inactive Job Applications can now rerun anonymizations on applications. 

Go to Admin Center > Data Retention Management > Create New Purge Request > DRTM Inactive Job Applications > You will see the option Define Purge Criteria > Job Applications to Purge > Selected Job Applications.  

You can re-run the anonymization job for the applications that have been anonymized before.

Anonymizing Applications with Admin Center > Data Retention Management > DRTM Inactive Job Application

This job anonymizes applications by schedule (depending on the timing set for the job) and based on the criteria set in Manage Data.

Setting up of the Anonymization Jobs (Part 1 – Inactivity Criteria)

a. Admin Center > Manage Data > DRTM Inactive Job Application > APPLICATION > Period of Inactivity (column). What does inactivity days mean here and how is it computed?

Inactivity days is literally the number of days the application is inactive or has no updates. To compute the inactivity date for an application, it will be the duration from today’s date to whatever date is configured in Admin Center > Manage Recruiting Settings > DRM and DRTM Purge Settings > Job Application and Candidate Purge:

• Use Application Last Modified date to start the Application aging for purge.
• Use Application Disposition date to start the Application aging for purge.
• Use Job Req Closure date to start the Application aging for purge.
  
  

For example, if the ‘Use Application Last Modified date to start the Application aging for purge’ option is chosen, the inactivity days will be the last modified date in the application history up until today’s date.

b. Admin Center > Manage Data > DRTM Inactive Job Application > APPLICATION > Country / Region column. Note: The Country / Region section is pertaining to the standard derived country field of the Job Requisition. This is not the application or candidate profile country and it is not the job posting country either. 

From this screenshot's settings, the applications that have the (1) country Germany and are (2) inactive for 6 months will be subject for anonymization based on this criteria. Another example, the applications that have the (2) country United States and are (2) inactive for 8 months will be subject for anonymization based on this criteria.

c. Make sure the inactivity days you set in Manage Data is lower than the number of inactivity duration of the target applications. For example, there are 3 applications linked to the candidate who requested to be forgotten and the requisition country is Germany. Application 1 is inactive for 20 days, Application 2 is inactive for 30 days, and Application 3 is inactive for 45 days. The lowest inactivity days for all applications is 20 days. 

If you are going to set the inactivity for Germany, it should be set to DAYS instead of MONTHS and the value should be less than 20, e.g., 15 days.  

This would mean all the applications with (1) requisition country Germany and (2) that are inactive for 15 days and above will be subject for anonymization. This setting would pick up all 3 applications for the candidate. 

Please note that the number of inactivity days is based on the Customer's requirements, the numbers provided above are examples.

Caveats: This job would pick all applications that match the criteria, even those applications that did not request to be forgotten (In Progress applications will not be affected. It will only affect those in disposition and onboard statuses that meet the criteria). 

You must set up the inactivity criteria per country of the requisition where the candidate’s applications are. For example, the candidate to be forgotten has applications in requisitions with the country values: Germany, France, Switzerland. You would need to set the inactivity duration for those countries individually.

Setting up of the Anonymization Job (Part 2 – Anonymization Scheduled Job) 

DRTM Purge Inactive Job Application (in Admin Center > Data Retention Management) – Anonymizes all applications in all Disqualification, Closed, and Onboard statuses except for (1) Deleted on demand by candidate, (2) Deleted on demand by admin, (3) Declined DPCS.
Note: The name DRTM Purge Inactive Job Application can be confusing since it is called an application purge but what it does is anonymize applications. The application form itself is not deleted, you can see it in the requisition but the individual field data is deleted. 

DRTM Purge Inactive Job Application

In Admin Center > Data Retention Management > Create the job DRTM Inactive Application Purge > Set the countries of the requisitions where applications are and the approver name (who will run and approve the job). 

You do not have to schedule it; you can launch it immediately. Just make sure that the settings in Manage data and the DRTM jobs you have configured here do not conflict with your existing DRTM configurations (if you have them). When the job is launched, it will go to your set approver’s Admin Center > Purge Request Monitor for approval. Just approve the job and it will run the anonymization right away. 

Important Note: The DRTM Purge Inactive Job Application Purge > Job Application based on retention period waits for the criteria (in the Manage Data) to be met before running anonymization on the applications. While DRTM Purge Inactive Job Application Purge > Selected Job Applications is used to target previously anonymized applications, but with some fields or application data that were not purged.

Anonymizing Applications with Provisioning > RCM Entity Anonymization Job

There is an anonymization job in provisioning called RCM Entity Anonymization Job. The configuration for RCM Entity Anonymization Job is simpler to use as it does not require a set of criteria like the DRTM Inactive Job Applications, but it is in Provisioning and would require a partner to configure. 

This job anonymizes applications on demand (1) once the Candidate Profile is deleted, (2) the job in provisioning is configured, and (3) the applications fall in the specified disqualified statuses.

RCM Entity Anonymization Job (in Provisioning) – Anonymizes all applications in (1) Deleted on demand by candidate, (2) Deleted on demand by admin, and (3) Declined DPCS.

Note: Any application that fall on other disqualified statuses will not be covered by this job. Also, you cannot manually move candidates to any of the statuses mentioned: (1) Deleted on demand by candidate, (2) Deleted on demand by admin, and (3) Declined DPCS. The candidates are automatically moved to these statuses when the candidate profile is deleted or DPCS is declined. 

Important Note: The RCM Entity Anonymization Job does not take into consideration the criteria in the Manage Data. It will run anonymization on the applications as long as the applications land on any of the following statuses: Deleted on Demand by Admin, Deleted on Demand by Candidate, and Declined DPCS and the aforementioned provisioning job runs.


Depending on your needs, you may just run it once. 

Note: When you have ran the anonymization job and it picked up the application, any fields that were not anonymized on the first run, due to misconfiguration, e.g., fields not set to anonymize="true", will not be picked up again by this job. You will need to use the DRTM Purge Inactive Job Application Purge > Selected Job Applications feature in this case to anonymize those field values.

Additional Note: Provided that you have configured all the necessary configurations, when the candidate or recruiting user anonymizes the candidate profile and includes disqualified applications, that action should trigger all the candidate's applications to be moved to Deleted On Demand By Candidate status (if the profile is deleted from the candidate side) or Deleted On Demand By Admin status (if the profile is deleted from Anonymize Candidate Profiles option).

Anonymizing Applications with Anonymize Candidate Profiles > Anonymize Disqualified Applications for Anonymized Candidates

This anonymization job is used to anonymized applications of previously anonymized candidate profiles. It is used in conjunction with the RCM Entity Anonymization Job (in Provisioning).

You can search the candidate ID of the candidate you want to anonymize and all applications in the disqualification status can be anonymized. There is a section in Anonymize Candidate Profiles Feature - Recruiting Management, that details the process with screenshots.

There is no way to mass anonymize the candidates or applications via Anonymize Candidate Profiles.

2635179 - Data Retention Time Management configuration in Recruiting
2670133 - Anonymize Candidate Profiles Feature - Recruiting Management
Implementation Guide - Applications and Candidate Purge in Recruiting

Request to be Forgotten, purge, purging, anonymization, anonymize, anonymise, Job Application, Candidate Profile, RCM, Recruiting Management, DRTM, delete, deleted, DPCS, Anonymize Candidate Profiles, DRTM Purge Inactive Job Application, RCM Entity Anonymization Job , KBA , LOD-SF-RCM-SYS , System Performance, Usability, Errors, Security , How To