Privacy related considerations when organising recruitment

​When employers advertise a job opportunity, they want to find the most suitable candidate for the vacancy. In such cases there is usually a selection process involving several candidates, where information on each applicant is required. Compliant personal data processing must be respected as applicants share their personal information when they send their CVs, motivational letters or disclose any other vacancy related data.

Employers should only request from applicants and, if necessary, obtain from other sources, the information that is mandatory and directly necessary to assess whether the applicant for the vacancy in question is suitable. Requests for identification documents should be made after the decision is taken to sign an employment contract with one of the applicants, but during the selection process the information provided by the applicant should be trusted without identification documents. 

​The employer may look at the social media of applicants if there is a legitimate interest in obtaining information from there. The reasonableness, proportionality and necessity of social media research should be also assessed. The job advertisement must clearly state the requirements and job duties of the vacant position in order to avoid unnecessary personal information being obtained from the applicants and to ensure that only those who genuinely want the job apply. 

Employers must ensure that applicants know what personal information is being collected, and it is important to inform them about who will process their personal data, how the processing will be conducted, for what purposes and for how long. Employers, of course, must also provide information about themselves so that applicants know where, if necessary, to turn to in order to exercise the right granted to data subjects to monitor the processing of their personal data.

If the employer uses the services of a recruitment company, the role of this service provider in the processing of applicants’ data should be defined. In case the outsourced company is to be considered as a processor, a GDPR compliant contract on the processing of personal data must be concluded between the employer and such service provider.

The GDPR requires that the applicant’s consent to data processing must always be obtained in a clear and intelligible manner, and if the candidate withdraws his or her consent or asks for his or her data to be deleted, the employer must do so without undue hesitation.

If the candidate with the best suitability for the vacant position is selected and that candidate’s suitability has been verified, it will be necessary to delete the data of the other shortlisted candidates after the time limit for appealing the selection decision has expired. In Latvia, the applicant has the right to bring an action to a court within 3 months from the date of receipt of refusal of the employer to establish the employment relationship with the applicant, and also the employer has the right to provide for trial period not exceeding 3 months for the new employee. However, if the employer decides that it wishes to retain the personal data of the applicant who was not offered the vacant position in order to offer him or her another possible vacancy in the future, it will be necessary to inform the applicant concerned. Furthermore, in this case the employer must explain why it wishes to keep the applicant’s data, how long it intends to keep it, and inform the applicant of its privacy policy, how he or she can request the deletion of his or her data at any time, and then also receive a consent from the applicant concerned.