Employers typically expend a great deal of effort on application processes, in order to make an informed hiring decision and to avoid hiring unsuitable candidates who quit or are fired after a short time.
In addition to the classic job interview, employers often also use more modern tools and options for gathering information, such as e-recruiting and background checks. The employer‘s interest in having as much information as possible about candidates must be balanced against the applicants' right to informational self-determination. This article provides an overview of what information employers are allowed to collect and what limitations they must observe.
Data protection risks in the context of application procedures
Violations of data protection law in the context of application processes can result in heavy fines and liability for damages. For example, in 2022 the Spanish data protection authority imposed a fine of EUR 2 million on a subsidiary of a large online mail order company for excessive background checks. Job applicants could only submit their application via an app if they also uploaded a police clearance certificate with no entries and agreed to the transmission of the data to all of the corporate group companies and to an external service provider based in the USA.
Given the economic and reputational risks of overly extensive screening of applicants, employers should familiarise themselves with the legal limits.
In the job interview: The employer's right to ask questions
Data processing (which includes data collection, in the sense of obtaining information for the first time) is restricted under data protection law and requires permission. This means that the processing of data requires a legal justification. Information that an employer asks for during an interview must have a specific connection to the position to be filled and must therefore be suitable for making a specific judgment about the suitability of the applicant. If this requirement is met, the employer has a legitimate interest in the information and the data collection is considered to be ‘necessary'. Questions that have no factual connection with the advertised position are not covered by the right to ask questions.
The employer's right to ask questions during the application process is also limited by the prohibition of discrimination: there is no right to ask discriminatory questions if different treatment of the applicant or employee is not justified based on a particular circumstance. For example, questions about pregnancy are not permitted.
If an employer exceeds the limits of its right to ask questions, applicants are free not to answer the question or even to tell an untruth (the so-called ‘right to lie').
Applicants must, however, answer permissible questions truthfully. If an applicant has fraudulently deceived the future employer, or if the employer is mistaken about the applicant's characteristics as a result of the answer (e.g. about the existence of a certain scholastic degree, training qualification, or language skills), the employment contract can be challenged and possibly rescinded.
Background checks: use of search engines and social networks
Many applicants disclose a great deal of information about themselves online without considering that a potential employer can also see it. Nevertheless, online checks by employers should be limited to the necessary job-relevant information.
Data that is generally accessible (e.g. data from search engines) may only be processed by employers if this does not impinge on the applicant's legitimate interests and the employer has a legitimate interest in collecting the data. Employers may therefore only process data from search engines that are related to the position to be filled and are suitable for making a specific judgment about the applicant. This is generally not the case for data relating to political views or hobbies (though exceptions are possible).
These principles also apply to data from social networks: as long as the information is job-related, it may be processed. Contrary to a previously widely advocated differentiation, the permissibility of data collection no longer depends solely on whether the data is stored in professional or private networks, because these boundaries are becoming increasingly blurred. However, the decisive factor for the permissibility of data processing is still whether the applicant has voluntarily made data publicly available or has only made it available to certain users. In particular, employers are not allowed to gain access to or process applicant information that has only been shared on a limited basis.
Takeaway for Employers
Employers should collect data directly from applicants during the application process whenever possible. Further, only information that has a specific connection to the advertised position may be collected, including through online research. If employers use other sources to obtain information in addition to the application documents and the interview, the applicant must be informed of this.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.