This article was published in 2018. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Introduction
Suppose you are looking for a new colleague and post a vacancy online. You receive responses from several candidates. How do you handle the personal data of candidates? Are you simply allowed to screen the candidate’s social media accounts? If you do, are you violating this candidate’s privacy? How should you handle candidates’ personal data? What can the consequences be if you breach the GDPR? These questions are discussed in this article.
Social media and privacy
One of the recurring questions is: how should the personal data of candidates be handled? Am I simply allowed to screen the candidates’ social media accounts? The Dutch Data Protection Authority (AP) warned employers about this in 2017. In principle, employers may not screen the social media accounts of job applicants. This is set out in the WP29 Opinion on data processing at work. WP29 is the umbrella body of the European privacy regulators, which are united in the so-called Article 29 Working Party.
Guideline for online screening
As an employer, you probably think that public data and profiles on social media are ‘simply’ public. This is not correct, however. The Article 29 Working Party takes the view that the social media accounts and profiles of job applicants cannot simply be consulted by (potential) employers. Employers need a legal basis to consult social media accounts and to process this personal data.
Some guidelines in this regard are:
-
Collecting information about candidates online must be necessary and relevant.
-
Employers must give prior notice if they nevertheless wish to check the behaviour of job applicants on social media.
-
The employer cannot rely on the ‘consent’ of the candidate, for example by becoming ‘friends’ on Facebook or LinkedIn during the application process. Although this may look like voluntary consent (as provided for in the GDPR, ed.) from the candidate, it is not.
-
If the candidate is not hired, the employer must delete all data collected during the application process in accordance with the NVP recruitment code.