30.12.2022

What happens to our personal information after recruitment?

Paweł Bukowski

According to the latest research, we are facing a decrease in the number of job offers compared to the record – breaking beginning of 2022 in this regard. Nevertheless, changing jobs is a very common phenomenon on the Polish market. We take part in numerous recruitments and, consequently, send a lot of resumes, portfolios and other documents containing our personal data. What happens to them later? In case we don’t get a job, should they be deleted from the database? Let’s answer these questions for ourselves.

Probably many of us associate a situation in which we are waiting for a response after a recruitment interview. It happens that during the recruitment process we do not think about how much relevant information we are giving to a potential employer. A candidate’s resume (CV) contains a lot of relevant data that may later be stored by the company to which we apply.

Among other things, this is because a recruiter on behalf of a company or business wants to protect itself in the event of a complaint brought by a candidate if his or her application is rejected. The issue of deleting personal data from company databases is a complex and time-consuming process for a Personal Data Administrator (ADO).

Retention – for how long?

Under this term is the storage of personal data. According to the RODO regulation, the retention period for this type of data should not be “longer than necessary.” What does this mean in practice? The period for storing information will vary depending on the purpose for which it is stored. A different term will apply to an online store, for example, regarding the data of its customers, and a different one for workplace surveillance footage.

The retention period will most often be determined by taking into account the stage of recruitment (making a resume available for participation in an open recruitment or for future recruitment) and the statute of limitations on claims in the case for which the data is collected. It can also be dictated by individual regulations – for example, retention periods for personal data are derived from regulations on employee personnel files.

Enforcing the retention period and the deletion of our personal data by, for example, recruiters or the aforementioned ADOs is, despite appearances, not an easy matter. Data must be deleted immediately “when it is no longer needed” (according to the RODO regulation). The term may not be clear and is subject to many interpretations, and simply deleting them from the databases of a company, enterprise or institution can be very time-consuming.

Divergence of opinions

A dispute arose between the President of the Office of Personal Data Protection and the Minister of Digitization over data retention in 2019.  The MD’s statement was that after the recruitment process is completed, the employer has the right to store the recruitment documents of those who were not hired, for the purpose of protection against possible claims […]. However, a different position was held by the President of the DPA, who wrote in his signature guide for employers about the need to “immediately dispose of application documents after the recruitment process is completed.”

August 2022 ruling

Both labor law specialists and the Voivodship Administrative Court in Warsaw agreed with the MC’s view. The WSA’s judgment of August 4, 2022 (II SA/Wa 542/22) overturned the decision of the President of UODO to admonish the employer for “unwarranted processing of the candidate’s data after the recruitment was completed.” The court’s reasoning was to protect the employer’s interest in the event of possible claims. This is because, as candidates, we have the right to compensation of no less than the minimum wage – according to Article 183d of the Labor Code – in case it is proven that the recruiting company violated the principle of equal treatment. In addition, it should be remembered that the statute of limitations for such claims is 3 years. In turn, as employers, we have the right to store data for possible verification of allegations by candidates. According to the WSA, the storage of data is justified by the interests of employers and recruitment participants.

Summary

As we can see – the issue of retention of personal data is not clear-cut. It is a complex and hotly debated topic. We are certainly still waiting for rulings of administrative courts and decisions of the President of the Office of Personal Data Protection (OPAP), and eventually – perhaps – changes in the Registers of Processing Activities maintained by companies.

The ambiguity of the positions of the WSA and the President of UODO does not resolve the dilemma of whether to delete personal data right away or to hold it against possible complaints. On the plus side, it may be that regardless of which path we choose, we can appeal to one of these opinions.

This issue certainly needs further analysis and clarification. We are left waiting for the Supreme Administrative Court’s decision.

Legal basis

Opinions

  • https://mc.bip.gov.pl/objasnienia-prawne/objasnienia-prawne.html
  • https://uodo.gov.pl/pl/138/672

Do you want to be up to date? Sign up for our newsletter

By subscribing to our newsletter, you consent to the sending of information by e-mail on important events in the field of law, legislative changes and the activities of the Law Firm.

read more

The administrator of your personal data is KWKR Konieczny Wierzbicki i Partnerzy S.K.A. with headquarters in Krakow, ul. Kącik 4, 30-549 Krakow. Your data will be processed for the purpose of sending our newsletter. You have the right to request access to your personal data, their copies, rectification, deletion or limitation of processing, as well as the right to object to the processing and to lodge a complaint with the supervisory authority. More details can be found in our Privacy Policy.

Contact

KWKR Konieczny Wierzbicki and Partners Law Firm
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Administratorem Twoich danych osobowych jest KWKR Konieczny Wierzbicki i Partnerzy S.K.A. z siedzibą w Krakowie, ul. Kącik 4, 30-549 Kraków.
Przetwarzamy Twoje dane wyłącznie w celu udzielenia odpowiedzi na wiadomość przesłaną przez formularz kontaktowy i dalszej komunikacji (co stanowi nasz prawnie uzasadniony interes) – przez czas nie dłuższy niż konieczny do udzielenia Ci odpowiedzi, a potem przez okres przedawnienia ewentualnych roszczeń. Masz prawo do żądania dostępu do swoich danych osobowych, ich kopii, sprostowania, usunięcia lub ograniczenia przetwarzania, a także prawo wniesienia sprzeciwu wobec przetwarzania oraz wniesienia skargi do organu nadzorczego. Więcej szczegółów znajdziesz w naszej Polityce Prywatności.
Warszawa

Rondo ONZ 1,

00-124 Warszawa

+48 12 3957161

kontakt@kwkr.pl

Chcesz być na bieżąco? Zapisz się do naszego newslettera

Zapisując się do naszego newslettera wyrażasz zgodę na przesyłanie drogą e-mail informacji na temat istotnych wydarzeń z dziedziny prawa, zmian legislacyjnych oraz działalności Kancelarii.

czytaj więcej

Administratorem Twoich danych osobowych jest KWKR Konieczny Wierzbicki i Partnerzy S.K.A. z siedzibą w Krakowie, ul. Kącik 4, 30-549 Kraków. Twoje dane będą przetwarzane w celu wysyłki naszego newslettera. Masz prawo do żądania dostępu do swoich danych osobowych, ich kopii, sprostowania, usunięcia lub ograniczenia przetwarzania, a także prawo wniesienia sprzeciwu wobec przetwarzania oraz wniesienia skargi do organu nadzorczego. Więcej szczegółów znajdziesz w naszej Polityce Prywatności.

 

Do you want to be up to date? Sign up for our newsletter

By subscribing to our newsletter, you consent to the sending of information by e-mail on important events in the field of law, legislative changes and the activities of the Law Firm.

read more

The administrator of your personal data is KWKR Konieczny Wierzbicki i Partnerzy S.K.A. with headquarters in Krakow, ul. Kącik 4, 30-549 Krakow. Your data will be processed for the purpose of sending our newsletter. You have the right to request access to your personal data, their copies, rectification, deletion or limitation of processing, as well as the right to object to the processing and to lodge a complaint with the supervisory authority. More details can be found in our Privacy Policy.