The principle of transparency in Article 5 of the GDPR is cardinal to personnel management, even before an employment contract is signed. However, Article 111-bis of the Privacy Code states that the employer is not required to provide a privacy policy to an applicant who voluntarily sends the information for a particular position. This requirement is postponed until the interview stage. Therefore, if the application is selected, it is mandatory to provide the appropriate information in accordance with Article 13 of the GDPR.

The legal basis for processing is found in the adoption of pre-contractual measures taken at the request of the data subject, under Article 6(1)(b) of the GDPR and not of the data subject consent. The collection of consent by the data controller involves several additional requirements that weigh on the compliance process.

The employer, who receives an unsolicited application, is required to hand over the notice at the first useful meeting (i.e. first call for interview), while they are not obliged to collect the consent if the data in the resume are only the ones necessary to access the selection process.

With regards to applications containing sensitive employee data, Article 111a, with reference only to the conditions necessary for the selection stage, also relieves the employer of the obligation to collect consent.

However, it is alway...