Data protection in selection processes: what your company should be clear about
Since a company receives a resume or publishes an offer, is already processing personal data, so the GDPR applies from the beginning. In this phase, no need to ask for consent, since the treatment is based on pre-contractual measures (art. 6.1.b RGPD), namely, in evaluating a possible hiring.
Even so, The company must inform the candidate about the processing of their data and be able to demonstrate that it has done so.. Besides, is responsible for safeguarding the resumes and the information received. Its loss may result in an infringement.
What data can be requested?
In a selection process not everything goes. The data must be adequate, relevant and limited to what is necessary.
A clear example is criminal records.. In general, cannot be required, unless there is a rule that allows it in specific cases. Requesting this type of information without legal authorization violates data protection regulations.
Besides, It is not only personal data that is provided by the candidate. So are the internal assessments what the company does during the process (impressions, scores, etc.), Therefore, they must be treated with transparency and respecting the rights of the person..
Information verification: be careful with the limits
It is common to want to verify experience or professional career, but there are clear restrictions.
- The company You cannot directly obtain the work life report.
- The consent of the candidate is not valid in this context.
- There may be a legitimate interest in verifying information, but always respecting the principle of minimization.
This implies that excessive data or data not necessary for the position should not be requested..
Social networks: limited access
The use of social networks in selection is a delicate area.
Access to profiles can only be justified if there is a legal basis and if the information is linked to professional purposes.
Besides, It is relatively common for companies to detect profiles on LinkedIn or other social networks where a person continues to indicate that they work for the company when they are really no longer part of it.. In these cases, the company may contact the person to request updating or deleting that information, especially if it may cause confusion among clients or third parties.
However, This does not legitimize widespread monitoring of personal profiles nor does it allow access to private information.. The review should be limited, in any case, to public information related to the professional field.
In any case:
- You cannot request access to private profiles.
- Indirect means cannot be used to obtain restricted information.
- The candidate cannot be asked for information about third parties..
Interviews: not everything can be asked
During the interviews, The fact that a person responds does not imply that they are consenting to the processing of their data..
Particularly sensitive data should not be processed (as ideology, religion or union affiliation) if there is no adequate legal basis. Besides, Asking questions unrelated to the position can be considered discriminatory.
- Online interview recording
It is increasingly common to carry out interviews by video call and for companies to want to record them, for example, to later review applications or share evaluations within the selection team.
In these cases, recording should not be done covertly. The candidate must be informed in advance that the interview is going to be recorded., as well as the purpose of that recording and the expected conservation time.
Besides, It must be taken into account that this type of recording involves the processing of personal data such as voice and image.. Thus, It is worth analyzing whether the recording is really necessary or if the process can be carried out simply through internal notes or evaluations by the interviewing staff..
In practice, If a candidate states that they do not wish to be recorded, It is advisable to evaluate alternatives, especially when the recording is not essential for the selection process. It is also important to avoid reusing these recordings for purposes other than personnel selection itself.. Thus, in many cases, It is best to inform the candidate in advance and have their agreement before making the recording..
Work life application: a particularly sensitive practice
The request for working life is a practice that raises many doubts from the point of view of data protection. Although there is no absolute prohibition, Nor can it be requested indiscriminately or automatically in any selection process..
The main problem is that working life contains more information than is necessary to evaluate a candidacy., since it allows you to know complete employment data of the person, including previous companies, periods of inactivity or information not related to the position offered.
Thus, GDPR data minimization principle should be applied. This implies that the company must ask itself if it really needs access to all that information or if it can verify professional experience through other less invasive means..
Besides, Applying for work life in an initial phase of the process is not the same as doing so when the candidate has already been selected and is in the incorporation phase.. The more advanced the contract is and the more justified the verification of certain data is, the greater the legitimacy of the company could be.
In any case, what is recommended is:
- Limit the request only to justified cases.
- Inform the candidate in advance.
- Avoid requesting more information than necessary.
- Assess less intrusive alternatives to prove experience or professional career.
In summary
Selection processes require processing personal data from the first moment, but always respecting the principles of the RGPD. Social networks, interviews, recordings or requests for employment information are common practices, although not unlimited.
The key is to request only the necessary data, act with transparency and guarantee the rights of candidates.
Fuente: Vadillo Advisors
