18

Some questions about HR agencies or employers from European Union and GDPR:

  • Should HR agency delete records about candidate after certain period of time after applying?
  • Is HR agency obligated to ask for confirmation / sign agreement how candidate data will be used?
  • Can candidate request HR agency to delete records (right to be forgotten) about him according to GDPR?

I know that ideal and real world scenarios may differ but still interested how it should look like according to the laws.

Improve this question
2

1 Answer 1

Reset to default
15

Should HR agency delete records about candidate after certain period of time after applying?

Yes. Personal data should not be retained longer than is required. Note that there may be valid reasons to retain data for years after application.

Is HR agency obligated to ask for confirmation / sign agreement how candidate data will be used?

No, or more accurately not necessarily. If the agency is using legitimate interest or contract - for example - as their basis for processing they're not obligated to ask for your permission. In the case of a hiring agency you are providing your personal data with the expectation that they will use it to help you find a job so they might easily be using a basis other than consent.

The agency does need to explain in clear language what your data will be used for under the right to be informed. They only need you to explicitly agree if they're using consent as the basis for the data processing.

Can candidate request HR agency to delete records (right to be forgotten) about him according to GDPR?

Yes. The right of erasure can always be requested, but depending on the basis for data processing the agency can refuse.

From the Information Commissioner's Office website in the UK (less relevant points removed).

Individuals have the right to have their personal data erased if:

  • the personal data is no longer necessary for the purpose which you originally collected or processed it for;
  • you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent;
  • you are relying on legitimate interests as your basis for processing, * the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
  • you are processing the personal data for direct marketing purposes and the individual objects to that processing;
Improve this answer
3
  • 2
    The second part should be clarified as follows: The HR agency is obligated to ask for confirmation/signed agreement whenever the candidate data is used for purposes that are not to be expected by candidates. If someone sends an application to recruiters, they implicitly consent to have it shared with most company HR, but they usually don't consent to it being shared with their current employer, or used as a sample for the recruiters' powerpoint presentation on how to write an application.
    – Alexander
    Jun 24, 2018 at 13:55
  • 2
    If the company subsequently modifies how they wish to use your data there's still no obligation for them to request explicit consent @Alexander: The company is obliged to inform you prior to changing how your data is processed, but there's still no requirement to use consent as the basis for processing.
    – Ben
    Jun 24, 2018 at 15:02
  • So agency should delete but actually it won't because always will find a reason not to.
    – Justas
    Jun 27, 2018 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .