Key Features of the Code

Recruitment

• An employer should not solicit personal data from job applicants, e.g. their personal resumes, in a recruitment advertisement that provides no identification of either the employer or the employment agency acting on its behalf.
  
  
• If an employer finds it necessary to conceal its identity in recruitment advertisements, it may provide job applicants, upon request, with application forms that bear the employer's identity. Alternatively, it may use a recruitment agency, which should be identified in the advertisement, to receive the personal data solicited from job applicants.
  
  
• Recruitment advertisements that directly ask job applicants to provide their personal data should include a statement, as an integral part of the advertisement, informing applicants about the purposes for which their personal data are to be used, e.g. "Personal data collected will be used for recruitment purposes only." Alternatively, a statement to the following effect may be included - "Personal data provided by job applicants will be used strictly in accordance with the employer's personal data policies, a copy of which will be provided immediately upon request." In this case, contact information of the employer should be stated in the advertisement.
  
  
• Personal data collected from job applicants should be adequate but not excessive, and they should be relevant to the purpose of identifying suitable candidates for the job. O An employer should not collect a copy of the identity card of a job applicant during the recruitment process unless and until the individual has accepted an offer of employment.
  
  
• Information may be compiled about a job applicant, e.g. by means of security vetting or integrity checking, to supplement other data collected at the time of the original application. Such supplementary information should be collected for the purpose of assessing the suitability of potential candidates for the job, and the data collected should be relevant to the nature of the job.
  
  
• Personal data concerning the health condition of a selected candidate may be collected by means of a pre-employment medical examination if the data directly relate to the inherent requirements of the job, and employment is conditional upon the fulfillment of the medical examination. However, such data should only be collected after the employer has made a conditional offer of employment to the selected candidate.
  
  
• Personal data of unsuccessful applicants may be retained for a period of up to two years from the date of rejecting applicants and should then be destroyed. The data may be retained for a longer period if there is a subsisting reason that obliges the employer to do so, or applicants have given their consent for the data to be retained beyond two years.

Back to top