Recruitment and privacy obligations

The principle of transparency in Article 5 of the GDPR is cardinal to personnel management, even before an employment contract is signed. However, Article 111-bis of the Privacy Code states that the employer is not required to provide a privacy policy to an applicant who voluntarily sends the information for a particular position. This requirement is postponed until the interview stage. Therefore, if the application is selected, it is mandatory to provide the appropriate information in accordance with Article 13 of the GDPR.

The legal basis for processing is found in the adoption of pre-contractual measures taken at the request of the data subject, under Article 6(1)(b) of the GDPR and not of the data subject consent. The collection of consent by the data controller involves several additional requirements that weigh on the compliance process.

The employer, who receives an unsolicited application, is required to hand over the notice at the first useful meeting (i.e. first call for interview), while they are not obliged to collect the consent if the data in the resume are only the ones necessary to access the selection process.

With regards to applications containing sensitive employee data, Article 111a, with reference only to the conditions necessary for the selection stage, also relieves the employer of the obligation to collect consent.

However, it is always necessary to comply with the principle of minimization and the main purposes of in Article 5 of the GDPR. The data controller always collects only the data strictly necessary for the purpose of recruitment. Any additional, unnecessary, and inconsistent data collection could result in illegitimate collection, especially in the context of personnel selection, where no investigation by the employer is allowed in specific areas of the employee’s personality profile.

Hence, it is always good practice to apply extra measures in collecting CVs online, for example through the company’s website. In this case, in addition to all the security measures established by Article 32 of the GDPR and Information Security Regulation, it is useful to clearly advise the candidate to enter, in their application, only the strictly necessary data, or to provide a form with fields that help the candidate in entering the data that is strictly necessary for selection purposes.

During recruitment, the data governance stage is very important. The correct mapping of those involved in processing is key to the fulfillment of the accountability required by the GDPR. This mapping will have to be directed both internally and externally. It will, therefore, be necessary to prepare individual designations for internal staff under Article 29 of the GDPR as well as outsiders such as, for example, recruitment agencies, temp agencies and consultants: the analysis must point to identify the data controller. It might be appropriate, according to some situations, single data controller, joint controllers under Article 26 of the GDPR or a relationship between the data controller and the data processor might occur.

In the latter case, it should be noted that it is always the responsibility of the data controller to identify a suitable data processor. In addition to the contractual burdens, it will therefore be necessary to prove that the choice of the data controller guarantees the security of the processing. As for the retention period of CVs, this should be limited to the time strictly necessary for recruitment purpose.

If the employer wishes to retain such data in anticipation of further employment opportunities, the data subject should be informed.

Article 5 states that the limitation of data retention requires the adoption of a data retention policy. The data retention period must be indicated in the privacy policy submitted to the applicant and in the records of processing activities referred to in Article 30 of the GDPR. For some processing operations the law directly identifies the retention period, for others, such as recruitment purposes, the responsibility to identify the retention period falls on the data controller. This choice can be made on a balancing-of-the-interests basis: on one hand, ensuring the satisfaction of the employer’s interests, on the other, the expectation of the data subject along with compliance with privacy requirements. Finally, about the personnel selection phase, the employer must be careful in the case of aptitude tests submitted to candidates for selection purposes. Such tests are used for the purpose of measuring the candidate’s aptitude to best integrate the candidate into the organization. However, specific care should be paid to the nature of these tests.

The personnel selection phase is subject not only to privacy requirements, but also to those contained in the Italian Workers’ Statute. As mentioned above, Article 8 of the Italian Workers’ Statute prohibits, for the purposes of recruitment, as well as during the employment relationship, investigations, including through third parties, into the employee’s political, religious or trade union choices, as well as facts not relevant to the assessment of the employee’s professional aptitude.

The result is the illegitimacy of activities aimed at investigating the employee’s private life or acquiring information about the candidate that is not pertinent to the job position.

The issue has been addressed by the Italian Data Protection Authority since as early as the 1990s. July 21, 2011, Provision deemed it unlawful for the submission of questions that inquired about candidates’ sex lives.

The scope of the prohibition contained in Article 8 of the Workers’ Statute is also referred to in Article 10 of Legislative Decree 276/2003, which prohibits Employment Agencies or parties that collaborate with employers for personnel selection purposes from making inquiries regarding personal beliefs, religious beliefs, sexual orientation, pregnancy status and health status.