What about special category data provided by a candidate in their CV, e.g. degree of disability? Can the employer process such data without additional consent, i.e. through the act of the candidate sending their CV?
ANSWER
Data concerning disability constitute special category data. Under Article 9(2)(a) GDPR, the employer may process such data if the data subject has given explicit consent to the processing of those personal data. Given the requirement of explicit consent, which does not appear in Article 6 GDPR (legal bases for processing "ordinary" data), a less risky solution in such a situation would be to obtain additional consent from the candidate (beyond implied consent arising from the candidate's action), for example by email confirmation that they consent to the processing of special category data they provide in their CV.
However, there are also views that if a candidate includes in their CV a general consent to the processing of the data contained in it, that consent also constitutes the explicit consent referred to in Article 9 GDPR.
