Data collection in a job application
An anonymous complaint was made to the Office of the Commissioner for Personal Data Protection ("DPC") through the Department of Labour Relations, regarding the collection of excessive data in a job application from a company and specifically the information text included in the application. The company had the same job application form for all job applications, requesting salaries of previous work experiences.
During the examination of the complaint, the DPC had instructed the company to amend its job application, however, it did not remove the field regarding the salaries of previous work experiences.
The DPC ruled that there was a breach of article 5(1)(c) of the GDPR since the company as a controller did not adhere to the data minimisation principle and issued an order to the company on 21 February 2024 to:
- amend and/or format the job application form so as to collect data on the salary that applicants had in previous jobs, only in cases of recruitment for managerial and/or senior positions, not at the initial stage or stages of the recruitment process, proceeding for each such procedure, to balance the necessity of processing the data in question; and
- inform the DPC of its actions within two months of the adoption of the DPC's decision.
Rights of the data subject
The DPC found a prima facie violation of article 12(4) of the GDPR by a company that did not inform the complainant and former employee of the company, of the reasons for not acting and not fully satisfying his request from the outset, as well as of the possibility of submitting a complaint to a Supervisory Authority and of the right to judicial remedy.
The former employee alleged that he was unjustly dismissed from the company and requested some documentation from the company which was related to the reason for his dismissal. Although, the company satisfied the former employee's complaint to the extent it could, it didn't proceed to satisfy the request to the extent requested, since the rights of others could have been affected.
On 19 July 2023, the DPC imposed the administrative sanction of reprimand to the company in relation to the violation of article 12(4).
To view the full article, click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
