Recruitment

"1. Do applicants have to submit a declaration of consent so that recruiters can process their data for the application process? This is a recruiter who does not hire applicants himself, but rather places what is known as direct placement with an employer.

Yes, collecting the data of applicants is data processing so the recruiter needs to provide a privacy notice and ask consent.

2. Can the recruiter request a driver card and a copy of the driver's license from the applicant if he wants to refer him to a haulage company? The recruiter wants to check the validity of the documents. The recruiting process takes place exclusively online.The recruiter is the person responsible within the meaning of the GDPR. In the first step, he searches for applicants in his own name. This is a job for a professional driver and a direct placement. The applicant will be hired by the shipping company. How do you behave correctly as a recruiter in this case?

The recruiter is responsible for all the selection periods, while the hiring company will become the data controller of data of the selected applicant. Therefore, if there is a need to verify some requirements in order to make the job, the recruiter can ask for evidence of that documents because it is necessary to carry on the selection. The recruiter shall make clear in the privacy notice that a copy of personal documents may be required for certain job positions.

3. Recruiting takes place online only. The applicant would have to send the documents such as ADR license, driver card and driver's license by email. Is the following clause sufficient to process this applicant's data: "With this declaration I consent to the collection, storage and processing of personal data about me as part of my application process and being transmitted to potential employers?" Submit customers? Does this declaration of consent have to explicitly mention that the driver's license will be processed? It is a job advertisement for a professional driver.

The statement is sufficient for all personal data collected through the application process. You don’t have to expressly mention the driver’s license, the reference is to all personal data collected (documents included). Potential employers are the correct definition, better than customers.

4. Can the recruiter request a copy of the applicant's identity card? The recruiter needs the ID number and series in order to conclude an employment contract with the candidate. How should the recruiter behave GDPR-correctly in this case? The intermediary has no personal contact with the applicant. The applicant would have to send the data by email.

Yes, the recruiter can request all documents that are necessary to identify and select the candidate. In some fields, it can be required the criminal conviction statement. As mentioned before, the recruiter shall inform the applicant about what data and documents will be required in order to prepare the job contract or to forward it to the hiring employer.  

5. How should the recruiter behave if the applicant sends him an unsolicited copy of his ID or a copy of his driver's license by email?

It depends. If the driver's license or the ID copy is necessary, the recruiter shall inform that data will be processed for the hiring process, if data are not necessary, the recruiter shall inform the applicant that those documents are not required and will be deleted.

6. Can the recruiter ask for the same candidate data as the employer? The recruiter does not hire the candidates himself.

Yes.

7. The recruiter is looking for suitable candidates for more than 6 months. The application process takes longer than 6 months. When do the applicant data have to be deleted in this case? The job advertisement is z. B. online for 8 months. When does the 6 month deletion period for applicant data start counting?

At the end of the call for the application period, so after the 8 months.

8. How long do you have to keep the recruitment contract between the customer (the potential employer) according to the GDPR?

The GDPR does not fix data retention periods, it depends, the hiring of a candidate for data of not-selected applicants and longer for the hired candidate (if any) in order to have evidence of compliance with the recruiting contract between the recruiter, the agency, and the employer.

9. How long should I keep the employment contract between the candidate and the recruiter? This is not an employment contract. The placement is free of charge for the applicant. The recruiter receives the commission from the agent.

Terms of data retention may be fixed by law or depending on the purpose of processing. If the commission is paid from the agent, the recruiter can store the agreement until the terms of legal proceeding from the agent or the applicant are expired (just to have the evidence that the applicant had been hired). This term varies in each Member State.

10. I observe with various recruiters that you immediately note in the job advertisement that the applicant should send his résumé including a copy of his driver's license and a copy of his driver's card. Is this allowed? The recruiter is not an employer in this case.

Yes, it is allowed. You can process all data that are needed to process the application.

11. Can I ask for a photo of the applicant?"

Yes if it is necessary or useful for the application, i.e., for some position it is required.

Here you can find more information about HR department and GDPR compliance:

• How the GDPR could impact your HR department https://advisera.com/eugdpracademy/blog/2018/02/22/how-the-gdpr-could-impact-your-hr-department/ 
• Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/

If you want to learn how personal data are processed under the EU GDPR you may consider enrolling in our free training EU GDPR Foundations course: https://advisera.com/training/eu-gdpr-foundations-course/