Should HR agency delete records about candidate after certain period of time after applying?
Yes. Personal data should not be retained longer than is required. Note that there may be valid reasons to retain data for years after application.
Is HR agency obligated to ask for confirmation / sign agreement how candidate data will be used?
No, or more accurately not necessarily. If the agency is using legitimate interest or contract - for example - as their basis for processing they're not obligated to ask for your permission. In the case of a hiring agency you are providing your personal data with the expectation that they will use it to help you find a job so they might easily be using a basis other than consent.
The agency does need to explain in clear language what your data will be used for under the right to be informed. They only need you to explicitly agree if they're using consent as the basis for the data processing.
Can candidate request HR agency to delete records (right to be forgotten) about him according to GDPR?
Yes. The right of erasure can always be requested, but depending on the basis for data processing the agency can refuse.
From the Information Commissioner's Office website in the UK (less relevant points removed).
Individuals have the right to have their personal data erased if:
- the personal data is no longer necessary for the purpose which you originally collected or processed it for;
- you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent;
- you are relying on legitimate interests as your basis for processing, * the individual objects to the processing of their data,
and there is no overriding legitimate interest to continue this
- you are processing the personal data for direct marketing purposes and the individual objects to that processing;