It is commonly known that the General Data Protection Regulation (GDPR), which came into force on the 25th of May 2018, applies to customer and employee personal data. However, companies may not have considered that the GDPR also has significant implications for the processing of personal data in relation to job applicants.
The nature of the personal data processed regarding job candidates is likely to be different to employees already in position. For instance, potential employers may wish to process data in relation to references, background/criminal record checks, and the right of an individual to work in the UK. Consequently, it is important that companies have a job applicant privacy notice in place, or alternatively a privacy notice that covers both current and potential employees. It is additionally important that companies establish a process for notifying candidates of how their personal data is processed and the lawful basis for doing so. For example, a job applicant privacy notice could be sent out along with the application form, or if the application process is online, it could be accessible as part of this process on the company website.
As is the case with employees, it is not advisable to rely on the lawful basis of consent for processing the data of job applicants if at all possible. The GDPR says that consent must be 'freely given, specific, informed and unambiguous'. In an employment and job applicant context therefore, it may now be difficult to rely on the basis of consent as the GDPR states that consent will be invalid where there is a clear imbalance between the data subject and the controller (e.g. there is an imbalance of power in favour of the employer as a job applicant will wish to be appointed to the role). Furthermore, consent can be withdrawn at any time, which could be difficult in practice if a job candidate was to withdraw their consent. Therefore, we would recommend that companies explore other lawful bases for processing job applicant data such as to comply with a legal obligation.
We are pleased to announce that we can provide a template Job Applicant Privacy Notice to Holistic HR clients. If you would like a copy of this document, please email email@example.com. If you are not currently subscribed to our unlimited HR and Employment Law advice Holistic HR service, and would like to find out more, please contact Hannah Roche by emailing Hannah.firstname.lastname@example.org or calling 0845 345 5004.