The Act respecting the protection of personal information in the private sector establishes the rules and obligations governing the collection, use, disclosure, retention and destruction of personal information. But how does this translate into the recruitment process? The Commission d'accès à l'information (CAI) recently published its recommendations1 on the matter.
Recruitment: ensuring the necessity of personal information
When recruiting, before collecting any personal information, a question must be asked: is the requested personal information necessary at this stage of the application assessment? The information must not simply be convenient to have; it must be essential. It is therefore likely that the personal information required when submitting an application will differ from that required for the additional checks carried out after the interview with the candidate.
Employers should also keep in mind that even if a candidate provides personal information, it does not mean that they have the right to collect it.
What personal information to request when making job offers, receiving applications and conducting interviews?
In order to determine a candidate's eligibility and to communicate with them, the following information may be required:
- first and last name;
- telephone number
- email address
- mailing address;
- information on academic and professional background, skills and interests.
Only the necessary personal information should be requested. Therefore, the use of a general application form should be avoided. Since job requirements can vary from one position to another, the personal information required may differ depending on the position to be filled. Employers should therefore use an application form that is specific and tailored to the position being advertised.
At the interview stage, the applicant may be asked to provide proof of identity. However, no photocopies should be kept, and no unique identifiers should be noted by the employer.
Additional checks in the recruitment process: what information to request?
The Commission d'accès à l'information recommends that employers wishing to conduct additional checks on a candidate should first make a conditional offer of employment and obtain the candidate's consent, particularly before contacting former employers.
Employer: can we check candidates' social media?
CAI recommends that employers do not check a candidate's social media. Indeed, while users can generally configure the privacy of their accounts, these profiles often contain information that is not necessary for the recruitment process. Consulting a candidate's profiles could constitute an invasion of privacy.
However, if such verification is necessary due to the specific context of the position to be filled, the employer should prioritize professional social mediaover personal ones, and obtain the candidate's prior consent.
What about the applicant's medical and legal information?
If medical information is requested, it must be necessary and limited to the requirements of the position to be filled. The candidate's consent must also be obtained in advance.
Considering that medical information is sensitive information, the employer must assess whether additional security measures are required for its storage.
In the case of criminal record checks, the candidate's consent must be obtained, even if the criminal record is publicly available. If the employer conducts such a check, they must be able to justify its necessity.
It should be noted that at the hiring stage, additional personal information may be required, such as :
- social insurance number
- bank account details;
- date of birth, which may be required, for example, for the pension plan.
What becomes of the personal information of unsuccessful candidates?
At the end of the recruitment process, the personal information of unsuccessful candidates must be securely destroyed, subject to a statutory retention period. Personal information may also be anonymized for serious and legitimate purposes.
Failure to comply with personal information protection obligations exposes the employer to the risk of a complaint being filed with the CAI.
Footnote
1. Commission d'accès à l'information, Recrutement de personnel et respect de la vie privée (page viewed March 28, 2025).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
