"Blind" and "hidden" recruitments

Are "hidden" recruitments compliant with GDPR?

Employers often opt for conducting "hidden" recruitments, also frequently referred to as "blind" recruitments. Sometimes the decision to conceal the process arises from the need to replace an employee whose contract has not yet been terminated; often, it is also driven by employers' desire to expand their candidate pools and collect their data "in advance".

In the advertisements published as part of this type of recruitment, the entity seeking an employee is concealed, and only the job title and requirements for the employee who would take up the position are disclosed, as well as often the industry/area of activity of the hiring company and a description of what is offered to the future employee, particularly the scope of potential benefits. An applicant for a position in a "hidden" recruitment does not know to which entity they are providing their personal data, and therefore lacks information about the data controller. Such a situation leads to a conflict with personal data protection regulations, particularly with the principle of transparency mentioned in Article 5(1)(a) of the GDPR.

According to the principle of transparency, the data subject, at the moment their personal data is collected by the data controller, should receive information about both the identity of the controller and a number of other details referred to in Article 13 of the GDPR. Therefore, the controller should fulfill the so-called information obligation towards the candidate who provides their personal data as part of the submitted application documents. For this purpose, at the stage of publishing the job advertisement, transparency in the relationship between the party providing the personal data and the party to whom it is being provided should be maintained. If the applicant does not possess this basic knowledge, the transparency of the process is disrupted.

The direct consequence of recruiting "hidden" candidates is the lack of opportunity for the candidate to exercise their rights under the GDPR, as the candidate does not have information on whom to direct the relevant requests in this regard. Blind recruitment is therefore contrary to the principles of data processing and is thus non-compliant with the GDPR. The Polish DPA emphasizes in its Guide that a secondary fulfillment of the information obligation, i.e., providing the candidate with a privacy notice in response to a received application, does not meet the requirements of the GDPR, as the data controller is obliged to inform the data subject, among other things, of their identity at the stage of collecting personal data, not at the stage of recording it. The Polish DPA also indicates that providing this information at the very beginning of the data collection process is crucial for ensuring a sense of security for the candidate and eliminating situations in which personal data is obtained through job advertisements by dishonest entities for their own purposes unrelated to employee recruitment.

Entities specializing in recruitment are trying to organize the "hidden" recruitment process in such a way that it meets the current requirements set by the regulations. A solution that allows the employer to maintain anonymity at the stage of posting a job advertisement is to use the services of a professional external entity, such as a recruitment agency, which is obliged to process candidates' personal data in accordance with the applicable legal provisions in this area.

By utilizing the services of an employment agency, the employer has the opportunity to maintain anonymity at the stage of publishing a job advertisement, as the agency publishes the relevant advertisement in its own name, remaining the data controller of the personal data of candidates obtained in this manner. The agency typically only discloses the industry/area of activity of the future employer for whom it is seeking suitable candidates in the market. Subsequently, - provided there is an appropriate legal basis for processing, such as the candidate's consent - the agency shares the personal data of candidates with its client (the hiring employer). At the moment the employer receives the relevant data, the employer becomes a separate data controller, and at that point, the obligation to provide the candidate, whose data was received from the agency, with the content of the privacy notice referred to in Article 14 of the GDPR is updated on their part.

In this situation, the candidate learns the identity of the potential employer only when the agency - after verifying the candidate's skills and comparing them with the requirements of its client - decides to share the candidate's data with its client. Nevertheless, the candidate is aware from the beginning that the recruitment is conducted with the involvement of an employment agency, which remains the data controller of the personal data provided in the application documents at the stage of submission by the candidates. This model of obtaining candidate data constitutes a legally compliant alternative to "hidden" recruitment and is currently frequently used by employers.

"Hidden" Recruitment vs. "Blind" Recruitment

Frequently, the terms "blind" recruitment and "hidden" recruitment are used interchangeably. However, it is worth noting that they are not identical, and to be precise, they should not be treated as synonyms. The so-called "hidden" recruitment refers to recruitment in which the candidate, at the application stage for a job advertisement, does not know the identity of the potential employer; thus, it is the recruitment model mentioned above. The candidate's application for such an advertisement is therefore based on knowledge of the industry and area of activity of the seeking company, and the compliance of this type of recruitment with personal data protection regulations is questioned by the President of the Polish DPA.

In the case of so-called "blind" recruitment, the mechanism is reversed, meaning that the employer deliberately refrains from obtaining certain information about the employee, such as information about gender or completed schools, and even the candidate's name. Recruitment conducted in this manner is intended to contribute to ensuring a higher degree of diversity among employed workers and to exclude discrimination at the stage of obtaining and selecting submitted applications. This strategy is often adopted by employers when recruiting for key positions within the company, where it is essential to hire employees representing various backgrounds.

In the case of "blind" recruitment, there is no question of non-compliance with personal data protection regulations, as the identity of the data controller is disclosed in the content of the job advertisement, and thus there are no obstacles for the data controller to fulfill the information obligation already at the stage of publishing the job announcement. Consequently, candidates who decide to apply for such an advertisement will receive all the information required under Article 13 of the GDPR at the moment their data is collected by the data controller.

Finally, it is worth noting that the position of the President of the Polish DPA regarding the non-compliance of "hidden" recruitment with personal data protection regulations is often commented on by employers as being too restrictive, as it prevents employers from completely posting anonymous job offers on dedicated websites. Utilizing such solutions is undoubtedly a cheaper and faster option that does not require the employer to engage with an external entity providing professional support services in the recruitment process (as is the case when using the services of employment agencies). Nevertheless, from the candidates' perspective, the obligation to ensure transparency from the very beginning, i.e., already at the stage of collecting their personal data, is a very beneficial solution and contributes to increasing the sense of security when sharing personal data.