Candidate CVs and ID copies: what an employer may keep

The CVs of unsuccessful candidates must be deleted once the selection is over and the new employee has been chosen. You may keep them longer for future vacancies only if the candidate has consented, and only for the period stated in the consent. For a short, justified period you may keep only what is needed for a possible dispute about this selection – that is a separate purpose and must be written down. Copies of employees’ and candidates’ identity documents are usually excessive. You may ask to see the document, but you do not need to copy it or keep a copy, unless a legal act or a specific purpose requires it.

Both rules come from the same principle. An employer collects only the data it needs for a purpose, and keeps them only while that purpose lasts. Below: what this means in recruitment, what an employer may learn about a candidate from other sources, and where things can go wrong.

The selection is over: what happens to the other candidates’ CVs

The purpose of a recruitment is achieved on the day you choose the employee. Article 5(1)(e) GDPR allows data to be kept in a form that permits identification for no longer than the purpose requires. So the other candidates’ CVs, cover letters and other documents are deleted from the recruitment system, from mailboxes and from every other storage medium. A candidate can also demand erasure when the data are no longer needed for the purpose for which they were collected (Article 17(1)(a) GDPR).

The candidate’s right to erasure does not apply to data needed to defend legal claims (Article 17(3)(e) GDPR). The principles of gender equality and non-discrimination must be observed even where no employment contract is concluded (Article 41(1) DK). When hiring, an employer must apply the same selection criteria and conditions (Article 26(2)(1) DK). In employment cases about discrimination, where circumstances are shown that allow a presumption of discrimination, the employer bears the burden of proving there was none (Article 26(5) DK). So the selection decision and its reasons may be kept for a short period on the basis of legitimate interest (Article 6(1)(f) GDPR). How long, and which documents, must be justified and recorded. This is not a basis for keeping CVs for future recruitment.

If you want to keep CVs for future recruitments, you need a different basis: the candidate’s consent (Article 6(1)(a) GDPR). We advise stating three things in the consent:

• the purpose, for example “offering other vacancies”;
• a period, which you set yourselves;
• that the CV will not be used for any other purpose.

The candidate may withdraw consent at any time, and withdrawing must be as easy as giving it (Article 7(3) GDPR). When the period ends or consent is withdrawn, the CV is deleted. A good practice: when the period ends, the candidate automatically receives a message with a link. By clicking it, the candidate agrees to keep receiving offers.

How to set and justify the period itself we covered in the article how long to keep personal data. Why the consent of someone already employed rarely works we explained in the article on employee consent.

What you may learn about a candidate

Article 5(1)(c) GDPR allows you to collect only data that are adequate, relevant and necessary for the purpose. In recruitment, the purpose is to assess whether the person fits a specific job. Questions unrelated to that fail this test: family status, a photo when the job does not need one, health in general. For pre-contractual relations the Labour Code provides: it is prohibited to require from an employee information unrelated to their health, qualifications or circumstances not related to the direct performance of the work, as well as information about the pay they received in current or previous employment (Article 41(1) DK). Requiring information about current or previous pay is expressly prohibited.

Article 88(1) GDPR allows Member States to set more specific rules for employees’ data, including recruitment. In Lithuania some of these rules are in Article 5 of the Law on the Legal Protection of Personal Data (ADTAĮ). For criminal-record data it is also the authorisation by law that Article 10 GDPR requires (Article 10 GDPR). Two rules of Article 5 ADTAĮ matter for every recruitment.

First, references. Data about a candidate’s qualifications, professional abilities and professional (work-related) qualities may be collected from a former employer only after informing the candidate. From the current employer, only with the candidate’s consent (Article 5(3) ADTAĮ). A call to the current employer without the candidate’s consent does not meet this rule, even if you only ask about the quality of their work.

Second, criminal records. Data about criminal convictions and offences may be processed in only two cases (Article 5(1) ADTAĮ). The first is where the employer has a legal obligation to check whether the person meets requirements for the post set by laws or implementing acts, and only to the extent that obligation requires. The second is the employer’s legitimate interest, unless the candidate’s interests or rights override it (Article 5(1)(2) ADTAĮ). All of the following conditions must then be met, in addition to the GDPR requirements (Article 5(2) ADTAĮ):

• the employer carries out a written assessment and prepares a report on it, consulting the data protection officer if one is appointed;
• it approves, and publishes on its website if it has one, a list of posts that also names the offences for which the person must have no conviction;
• it checks only candidates for posts on that list;
• the candidate provides the data, to the extent the employer specifies, themselves.

The candidate must be informed

When you collect data from the candidate, the information is given at the time the data are obtained (Article 13(1) GDPR): who the controller is, for what purpose and on what basis the data are processed, and who may receive them. Added to this are the retention period and the candidate’s rights (Article 13(2) GDPR). In practice this is a short notice in the job advert or the application form. What employees must be told, and when, is covered in Informing employees about data processing: what to say and when.

When the data come from someone other than the candidate – a former employer, a recruitment agency, a professional network – the candidate must also be told which source they came from (Article 14(2)(f) GDPR). This is done within a reasonable period, but no later than one month, and if you contact the candidate, no later than at the first contact (Article 14(3) GDPR).

Copies of identity documents

A copy of a document holds much more data than an employer needs: a photo, a signature, the document number, the expiry date. So under Article 5(1)(c) GDPR, collecting and keeping a copy is usually excessive. The exception is where a legal act requires a copy or a specific purpose truly needs one, for example organising a business trip or handling a permit.

What to do instead of a copy:

• ask to see the document and check that the details in the contract are correct;
• put a clause in the contract that the person provides correct details and reports any change;
• if you check identity on a video call, checking the document on screen is enough. A screenshot is a copy, so the same rule applies, and the person must be warned about it in advance.

The personal identification code may be processed only where one of the grounds in Article 6(1) GDPR applies (Article 3(1) ADTAĮ). Where the code must be processed because of a legal obligation (Article 6(1)(c) GDPR), you record the code itself rather than copying the whole document. The personal code may not be made public (Article 3(2) ADTAĮ). When you may ask customers for a personal code or an ID copy is covered in Personal code and ID copies: what you may ask a customer for.

Where things can go wrong

• CVs stay in mailboxes. The CVs are deleted from the recruitment system, but the same files sit in the manager’s, the HR specialist’s and the recruitment agency’s emails. They must be deleted wherever they went.
• “We keep all CVs for a year.” Such a sentence in a privacy notice is not a legal basis without the candidate’s consent. A one-year period for future recruitment has no basis without consent. A shorter period for a possible dispute about a specific selection must be justified separately.
• ID scans in the HR folder. They may have been made “just in case” many years ago, and nobody knows who has access to them.
• The form asks for more than the job needs. Every excessive field is data you had no basis to collect.

Why this matters. An unsuccessful candidate may already be disappointed. They may ask for confirmation of whether their data are processed and for access to them (Article 15(1) GDPR). That is when it becomes clear what is kept and where. They may complain to the State Data Protection Inspectorate (VDAI). For breaches of the basic principles, including the conditions for consent, the GDPR provides for administrative fines of up to 20 million euros or, in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5) GDPR). How and when to answer a subject access request is covered in Subject access requests: the deadline and the answer.

When to call a lawyer

• when you want to build a talent pool and need a consent text and a retention period;
• when a post requires a clean criminal record and you need the assessment and list under Article 5(2) ADTAĮ;
• when a candidate has asked for their data, demands erasure or has filed a complaint;
• when recruitment is run by an agency or a group company and it is unclear who the controller is.