Certainly on more than one occasion we have applied for a job, offered our resume, even attended a personal interview without hearing more about it. Have we ever asked ourselves: What happens to the personal and professional information that we transfer? Do we have any control over this? Can companies freely dispose of them?
On this occasion we intend to respond to those basic questions that arise around labor hiring. There are multiple circumstances and legal situations that arise within the framework of an employment relationship. Some especially arouse the interest of Law, due to the exposition and confrontation they imply even in a preliminary phase. Contrary to what it may seem, candidates for a job offer do have legal protection from the moment they apply for a job. This legal protection consists of ensuring that the hiring process is inspired by essential values such as meritocracy, impartiality, equity and non-discrimination. There is an enormous circulation of personal data from phases prior to the beginning of the employment relationship, data that is usually assigned to files called “Candidates” or “Curriculum Vitae”, with special implications, especially in businesses with a high circulation of personnel. We make special mention of personal, professional, academic and data of special interest to the company.
Prior to hiring an employee, there is a transfer of data between the parties. In some cases, the company will carry out a verification of the data provided or the experience of the candidate. The company, in this case, has the obligation that the hiring process is impartial, safe and does not violate the right of the candidate, in this sense, the right to maintain the integrity of their sphere of privacy.
Regarding the GDPR, its regulation provides for the application of pre-contractual measures that guarantee the privacy of the applicants. Thus, the simple receipt of a resume without preserving the data contained therein would not be a full-fledged data processing, but the extraction of information and its use to carry out a personnel selection would be, since that resume would be included in a structured file and, as such, will be subject to the provisions of current regulations on data protection.
Personal data collected by employers for employment purposes will be relevant and comply with the minimization principle, given the type of employment and the employer's evolving information needs. Throughout this process, only personal data will be obtained from the interested party (Council of Europe Recommendation 2015, section 5.2).
Consequently, the data received by companies in the selection processes will be treated in accordance with the purpose for which they were collected, and will not be further processed in a manner incompatible with said purposes. In accordance with what is stated, these data cannot be used or integrated into the customer database since their use for this purpose requires the consent of the interested party..
Finally, the GDPR provides for the application of pre-contractual measures and establishes that their application will not require consent when they are adopted at the request of the interested party. That is, if a person provides their resume to a company or business, we do not require their express consent since it is clear from the act itself that we are under legitimate and lawful treatment; However, it will be unavoidable that you have information from the data controller to guarantee fair and transparent data processing. By virtue of this fact, the candidate may exercise their rights of access, rectification, opposition, deletion (“right to be forgotten”), limitation of treatment and portability as they deem appropriate.
