Hidden (Blind) Recruitment
For various reasons, employers choose to conduct hidden recruitment, also known as blind recruitment. Sometimes the decision to conceal the process arises from the need to replace an employee whose contract has not yet been terminated. In announcements for such recruitment, the entity seeking an employee is concealed, and only the position and requirements are disclosed. The applicant does not know to which entity they are providing their personal data, and therefore lacks information about the data controller. This contradicts the essence of data protection regulations, which are built on the transparency of the relationship between the data provider and the recipient. If the applicant does not possess this basic knowledge, the transparency of the process is disrupted.
Receive a package of free GDPR guides and micro-trainings
As a result, the candidate cannot exercise their rights, as they do not know to whom they should direct the relevant requests in this regard. Blind recruitment thus contradicts the principles of data processing and is therefore non-compliant with the GDPR. Entities specializing in conducting recruitment strive to organize the hidden recruitment process in such a way that it meets the current requirements set by the regulations. Nevertheless, a noticeable decline in the popularity of such recruitment practices can be observed.
Recruitment Tools and Recruitment Agency Services
Most often, data controllers publish job offers on portals that provide tools for conducting recruitment processes. These portals act as data processors, operating on behalf of and for the employer by providing managed tools for publishing job offers. Such entities are therefore not data controllers in relation to the data of individuals who have submitted application documents in response to a specific announcement.
In this regard, the future employer is obliged to include a privacy notice in the job advertisement – in such a way that the candidate can familiarize themselves with its content before submitting their recruitment documents in response to the advertisement. The future employer must also not forget the necessity of entering into a data processing agreement with the entity that has the platform through which the candidates' application documents are transmitted.
A separate discussion is required regarding the cooperation between the employer and recruitment agencies that undertake to find candidates for employment. In this case, the model of cooperation can take two forms depending on how the relationship between the future employer and the agency in the role of service provider is structured.
The first possible form of cooperation (less commonly encountered) is based on delegation – the agency searches for an employee on behalf of and for the future employer, and in the content of the privacy notice, it indicates the future employer as the data controller.
The second model of cooperation (definitely more commonly encountered) involves the agency searching for candidates for its own databases. In this case, it indicates itself as the data controller, and at the moment of matching a candidate to the client's needs, it obtains the consent of that candidate to transfer their personal data to the client.
Provide employees
with valuable e-training - for free
It's simple - copy and send them the appropriate links.
In this way, not only agencies that professionally deal with employee recruitment operate, but also companies that seek employees for their clients or other companies within the group, although this is not their primary activity. A significant mistake that arises during cooperation between agencies and clients commissioning the search for employees is the negligence in regulating mutual relations. This leads to situations where the clients lack basic knowledge about the model of cooperation between the parties.
The indicated issue is fundamental, as the obligations related to the protection of personal data will differ depending on which of the two models the cooperation is based on. If the process is based on a relationship between the data controller and the future data controller, the employer should make efforts to ensure that the transfer of data occurs based on a properly constructed consent for data transfer, and furthermore, must comply with the information obligation required when obtaining personal data from a source other than the data subject.
On the other hand, in the case of a model based on data processing delegation, the future employer should properly conclude a data processing agreement with the agency and ensure that it fulfills the information obligation in the content of the announcement on behalf of and for the data controller.
Data that can be legally requested from a job candidate
As part of the recruitment process, a prospective employer may request from the candidate data limited by legal provisions. While there is no longer any doubt that an employer cannot ask a potential employee about their marital status, addictions, or plans for the near future related to family life, there are still many controversies surrounding the issues of what and how one is allowed to ask during recruitment. An employer may require a job applicant to provide their first and last name, date of birth, and any contact information they choose to provide, whereas information about education, professional qualifications, and the history of previous employment may only be requested if it is necessary for performing work of a specific kind or in a specific position. Other data – exceeding the specified scope – may be requested by the employer only when it is necessary to exercise a right or fulfill an obligation arising from a legal provision, for example, when there is a statutory obligation to verify the criminal record of a future employee or when they are required to verify them in a restricted access register or in the register of persons against whom the State Commission for the Investigation of Cases of Activities Directed Against Sexual Freedom and Morality of Minors Under 15 Years of Age has issued a decision for entry.
Do you also prefer prevention over treatment?
A job candidate may provide – in no way coerced – other data about themselves, but they do so voluntarily, to the extent they deem appropriate. Regarding data that is not classified as special categories of data, the employer may request their provision. However, the initiative to provide special categories of data may only come from the person applying for the job. Under no circumstances may the failure to provide additional data by the candidate affect their participation in the recruitment process, and thus it cannot be the basis for unfavorable treatment during the job application process.
Authorizations for Processing Special Categories of Data
Many data controllers have not noted the necessity of issuing written authorizations for processing special categories of data. This obligation, established in Article 221b § 3 of the Labour Code, applies to individuals conducting recruitment who, as part of the discussed process, may have access to such personal data.
Including Consent Clause in CV
Consent is a voluntary, specific, informed, and unambiguous indication of will in the form of a statement or a clear affirmative action. A situation in which a job candidate voluntarily includes additional information in their CV, such as a photo or information about their interests, can indeed be interpreted as a clear affirmative action confirming that they wish for the potential employer to process their personal data beyond the scope that the employer may request. The Polish Data Protection Authority, in its employment guide, clearly states: “ordinary personal data that goes beyond the scope regulated by labor law is processed by the employer based on the candidate's consent, which is manifested by an action, such as sending the employer a resume and cover letter.” This means that the potential employer has no grounds to require a consent clause in written form, which has previously been placed at the bottom of application documents.
A slightly different approach should be taken in the case of a candidate's consent to the processing of special categories of data, which should be explicit consent. Although the regulations do not stipulate the necessity of providing written consent, in the case of consent for this type of data, it is indeed common practice to obtain it in such a form for evidential purposes. While we may not necessarily agree with such an interpretation, it should be noted that the Polish DPA supports this emerging practice, stating that “any consent for the processing of special categories of data should be explicit, e.g., in the form of a separate statement.”
GDPR.
Support is useful
Candidate's participation in other recruitment processes
Large companies often conduct several recruitments simultaneously. A potential employee may appear more desirable to an employer for a different position than the one they are applying for. In such cases – to remain compliant with legal regulations – it is not permissible to use an application submitted within a defined recruitment process for the purposes of other recruitment processes, even those taking place concurrently. The candidate must be informed of the situation and it must be established whether they agree to the processing of their personal data for the purposes of another recruitment process.
It is important to emphasize that if the employer wishes to retain recruitment documents for future recruitment processes, they must have consent for such actions. It cannot be assumed that if a candidate submitted recruitment documents for a specific recruitment process, they also want their CV to be included in the employer's database for future recruitment purposes. They should be asked about this in a separate clause and given complete freedom of choice.
Retention period for CVs
The issue of the retention period for documents submitted in recruitment processes by potential employers is also significant. Personal data should not be retained longer than necessary to achieve the purpose of processing. Therefore, if potential employees do not consent to the processing of their data in further recruitment processes, their recruitment documents should be deleted upon the conclusion of the recruitment for the specific position.
The employer who obtains the appropriate consents allowing them to retain CVs for potential use in future recruitment processes should also consider the duration of their storage. These documents cannot be stored indefinitely – the data contained within them simply becomes outdated. A key element influencing the determination of the storage period is primarily the dynamics of the labor market. Currently, the storage period typically ranges from 6 months to 3 years, with the stipulation that the candidate may withdraw their consent at any time, even before the deadlines established by the data controller.
Summary
A comprehensive discussion of the entire recruitment process would require a significantly broader and multi-faceted analysis; therefore, this article only highlights the main threads. Although conducting recruitment in compliance with GDPR requirements may seem as challenging as navigating an obstacle course, it should be noted that this process occurs in every organization and is inextricably linked to the processing of personal data, which is its essence. For this reason, it is worthwhile to ensure its implementation is in accordance with personal data protection regulations.
