According to the latest research, we are facing a decrease in the number of job offers compared to the record – breaking beginning of 2022 in this regard. Nevertheless, changing jobs is a very common phenomenon on the Polish market. We take part in numerous recruitments and, consequently, send a lot of resumes, portfolios and other documents containing our personal data. What happens to them later? In case we don’t get a job, should they be deleted from the database? Let’s answer these questions for ourselves.
Probably many of us associate a situation in which we are waiting for a response after a recruitment interview. It happens that during the recruitment process we do not think about how much relevant information we are giving to a potential employer. A candidate’s resume (CV) contains a lot of relevant data that may later be stored by the company to which we apply.
Among other things, this is because a recruiter on behalf of a company or business wants to protect itself in the event of a complaint brought by a candidate if his or her application is rejected. The issue of deleting personal data from company databases is a complex and time-consuming process for a Personal Data Administrator (ADO).
Retention – for how long?
Under this term is the storage of personal data. According to the RODO regulation, the retention period for this type of data should not be “longer than necessary.” What does this mean in practice? The period for storing information will vary depending on the purpose for which it is stored. A different term will apply to an online store, for example, regarding the data of its customers, and a different one for workplace surveillance footage.
The retention period will most often be determined by taking into account the stage of recruitment (making a resume available for participation in an open recruitment or for future recruitment) and the statute of limitations on claims in the case for which the data is collected. It can also be dictated by individual regulations – for example, retention periods for personal data are derived from regulations on employee personnel files.
Enforcing the retention period and the deletion of our personal data by, for example, recruiters or the aforementioned ADOs is, despite appearances, not an easy matter. Data must be deleted immediately “when it is no longer needed” (according to the RODO regulation). The term may not be clear and is subject to many interpretations, and simply deleting them from the databases of a company, enterprise or institution can be very time-consuming.
Divergence of opinions
A dispute arose between the President of the Office of Personal Data Protection and the Minister of Digitization over data retention in 2019. The MD’s statement was that after the recruitment process is completed, the employer has the right to store the recruitment documents of those who were not hired, for the purpose of protection against possible claims […]. However, a different position was held by the President of the DPA, who wrote in his signature guide for employers about the need to “immediately dispose of application documents after the recruitment process is completed.”
August 2022 ruling
Both labor law specialists and the Voivodship Administrative Court in Warsaw agreed with the MC’s view. The WSA’s judgment of August 4, 2022 (II SA/Wa 542/22) overturned the decision of the President of UODO to admonish the employer for “unwarranted processing of the candidate’s data after the recruitment was completed.” The court’s reasoning was to protect the employer’s interest in the event of possible claims. This is because, as candidates, we have the right to compensation of no less than the minimum wage – according to Article 183d of the Labor Code – in case it is proven that the recruiting company violated the principle of equal treatment. In addition, it should be remembered that the statute of limitations for such claims is 3 years. In turn, as employers, we have the right to store data for possible verification of allegations by candidates. According to the WSA, the storage of data is justified by the interests of employers and recruitment participants.
Summary
As we can see – the issue of retention of personal data is not clear-cut. It is a complex and hotly debated topic. We are certainly still waiting for rulings of administrative courts and decisions of the President of the Office of Personal Data Protection (OPAP), and eventually – perhaps – changes in the Registers of Processing Activities maintained by companies.
The ambiguity of the positions of the WSA and the President of UODO does not resolve the dilemma of whether to delete personal data right away or to hold it against possible complaints. On the plus side, it may be that regardless of which path we choose, we can appeal to one of these opinions.
This issue certainly needs further analysis and clarification. We are left waiting for the Supreme Administrative Court’s decision.
Legal basis
- Rozporządzenie Parlamentu Europejskiego i Rady (UE) 2016/679 z dnia 27 kwietnia 2016 r. w sprawie ochrony osób fizycznych w związku z przetwarzaniem danych osobowych i w sprawie swobodnego przepływu takich danych oraz uchylenia dyrektywy 95/46/WE (ogólne rozporządzenie o ochronie danych)
- wyrok WSA w Warszawie z dnia 4 sierpnia 2022 roku (II SA/Wa 542/22)
Opinions
- https://mc.bip.gov.pl/objasnienia-prawne/objasnienia-prawne.html
- https://uodo.gov.pl/pl/138/672