12 Recruitment Mistakes from a GDPR Perspective

Marit Alaväli, founder of the recruitment software Recrur, has made it her mission to improve the overall quality of recruitment in Estonia. This time, the focus is on data protection, as valuing candidates’ data gives employers an advantage in attracting talent. At Recrur’s request, Piia Laks-Järve, founder of DataVie and data protection officer, compiled the main data protection shortcomings in recruitment processes.

1. There is no recruitment process. Let us briefly set aside the bureaucratic term “process” and look at its actual content and purpose. A company that has thoroughly thought through recruitment from start to finish. From defining the job profile and writing the job advertisement to sending a rejection letter, understands that first impressions can only be made once. Unfortunately, it is still far too common for candidates to invest their time only to disappear into a black hole with no feedback at all. Most of us have unfortunately experienced that negative feeling. Agreed processes help ensure high-quality recruitment and, at the same time, create the conditions for better compliance with GDPR requirements.

2. There is no overview of data processing. To have an overview of the personal data collected during recruitment and how those data are processed, it is necessary to map the data processing activities. The law also requires this, and the Estonian Data Protection Inspectorate may request it at any time. Even the personal data requested in a job advertisement for the purpose of applying, for example, a phone number included in a CV, already constitutes the collection of personal data. This may raise several follow-up questions for the candidate: where will the data go, who will have access to them, where will they be stored, how long will they be retained, and so on. Mapped data processing gives precisely these answers and/or reveals where the gaps are. In short, it creates awareness and, based on that, an opportunity to improve the situation. For example, it may become clear that no retention periods have been set for the collected data. That is not reasonable from several perspectives. Leaving legal non-compliance aside, it is hardly sensible to accumulate digital waste indefinitely or to increase data volumes, thereby increasing the risks related to cyberattacks and the scale of potential data leaks.

3. Legitimate interest assessments have not been carried out. The legal basis for collecting data must also be defined in the overview of data processing activities. In recruitment, this is usually “legitimate interest”. However, to process data based on legitimate interest, a legitimate interest assessment must be carried out. This assessment weighs the interests of both parties, the recruiter or company and the candidate as the data subject, and describes the advantages and disadvantages of collecting the data. Ultimately, the assessment answers whether the employer’s interests outweigh the candidate’s fundamental rights and freedoms. For example, when hiring a kindergarten teacher, it may seem justified to request data from the criminal records database. However, a solvency check for a warehouse worker may not be justified. Therefore, all types of background checks should be reasoned and justified based on the position and its specific nature. The employer must be prepared for the possibility that such an assessment may be requested by the candidate or by the Estonian Data Protection Inspectorate.

4. You copy another similar company’s privacy policy. Preparing and publishing privacy policies is also a legal obligation. These notices provide candidates with detailed answers about how their data are processed during recruitment: for what purpose, on what legal basis, what data are collected and processed, to whom they are transferred, how long they are retained, and so on. To ensure clarity and transparency, it is sensible to prepare separate privacy policy for recruitment. Out of a lack of knowledge, copying and cosmetically adapting another similar company’s privacy policy may seem like a good solution. However, this approach is not appropriate, because privacy policies are based precisely on the previously mentioned overview of data processing activities, which is rather unique for each company.

5. The job advertisement does not refer to privacy policy. The correct approach is to include a link or reference to privacy policy already in the job advertisement. This ensures that candidates can review the terms of personal data processing before submitting their data. For example, if the company carries out a background check during recruitment, the relevant information is included in the privacy policy, and the candidate can take it into account. The existence of privacy policy is certainly also a signal to candidates of the potential employer’s data protection maturity and overall work culture.

6. You believe your recruitment partner’s statement “we comply with GDPR” without verifying it. Let us start with a simple example. In the recent Asper Biogene data leak, Asper had 42 partners who were most likely controllers, while Asper itself acted as a processor. The party carrying out genetic test orders. The patient, client or data subject entrusted their data to a medical institution, for whom Asper performed genetic testing as a subcontractor. This raises the question of whether those 42 partners knew how Asper Biogene processed such sensitive data. Similarly, if a company uses a personnel agency or recruitment software in its recruitment process, the controller must make sure that the partner also complies with GDPR requirements.

7. There is no data protection agreement with the recruitment agency or recruitment software provider. Data protection agreements regulate the partnership and provide both parties with legal clarity and awareness of expectations regarding GDPR compliance. If there is no data protection agreement, the controller is responsible for any breach.

8. You forget that you have granted indefinite access to personal data. A company may have an inadequate security policy: processes are not in place, and security measures have not been thought through or documented. For example, access, including access to personal data, may be granted to a partner from a recruitment agency, but this remains unregulated both procedurally and technically. It is not uncommon for the cooperation agreement with a partner to have ended, while access rights have not been removed.

9. You send large volumes of personal data by email. Companies and HR departments that do not use recruitment software may end up with large Excel files containing candidates’ personal data, which are then shared internally by email. Sending one personal identification code or similar piece of information by email may not be highly risky, but it is not sensible to exchange large volumes of personal data in this way. Possible solutions include recruitment software, encryption, or secure drives with restricted access. No one is protected from accidentally sending an email to the wrong person. For example, when a company has several employees with the same first name and the email system automatically suggests possible recipients after only a few letters have been typed.

10. You ask a previous employer for feedback without the candidate’s consent. Understandably, employers may be tempted to ask a previous employer about a candidate’s background. This is a well-known but, due to lack of time, often underused practice. However, it is important to know that such activity requires the consent of both the candidate and the contact person at the previous employer. It should also be noted that if referees are listed in a CV, the candidate should also have obtained the relevant consent from those referees.

11. You do not want to, or are unable to, provide the candidate with the data collected about them. Legally, the situation is clear: the candidate has the right to ask for all data collected about them during recruitment, and those data must be provided. This includes everything from contact details required for applying to the results of a background check, as well as notes that the HR specialist makes on their work computer during the interview. The candidate also has the right to know which registers were queried during the background check and what responses were received. After all, it cannot come as a surprise to the candidate that they have, for example, been criminally convicted of theft. Nevertheless, it seems that such information is often still somewhat “hidden” from the person themselves.

12. You retain candidates’ data indefinitely: meaning longer than one year. The law gives the employer justification to retain candidates’ data for up to one year. This is mainly due to the need to deal with potential disputes, allowing the employer to defend themselves if necessary. The interest in keeping data for more than one year usually comes from employers’ wish to retain the data of strong candidates, so they can contact them again when a suitable new position opens. Less commonly, the reason may be to mark serial applicants, but creating a so-called blacklist is not allowed without an appropriate legitimate interest assessment. In summary, candidates’ data may be retained for longer than one year, but this requires the person’s consent, preferably in a reproducible form. The person must also be allowed to withdraw their consent at any time, after which the data must be deleted.

Marit Alaväli is convinced that recruitment shapes the first impression of a company and is, in reality, the first and inseparable part of the employee life cycle and employer reputation.

Even though there is usually only one available position in a recruitment competition, a smart recruiter and employer understands that candidates who are not selected can become a powerful asset in the future.

According to DataVie founder and data protection officer Piia Laks-Järve, recruitment should be conducted in such a way that even candidates who are not selected remember the process positively and see the professionalism of the recruitment process. Including from a data protection perspective, as an example to others.

The article was originally published in Äripäev