When a candidate asks for their data to be deleted during recruitment
Occasionally a candidate may ask for their application data to be deleted before or shortly after your recruitment process has concluded.
This can feel awkward as there is a difficult balance between delivering on GDPR obligations whilst needing to protect your organisation's records so that in the event a candidate were to make a claim (eg that they felt they were not treated fairly) then the organisation would be able to defend its hiring decision.
Naturally one wants to be sympathetic to any candidate request for deletion but on the other hand one doesn't want to leave the organisation exposed - this can be a real tightrope to have to walk!
Privacy Policy Background
When registering and/or applying for jobs on an All Jobs Pro powered careers portal, candidates are asked to read and agree to our privacy policy (click to view this in a new window).
In the "How long will this data be retained?" heading it says :
“If your job application is not successful your job application information will continue to be available to our Customer for 6 months so that in the event that you were to make a claim regarding your job application then our Customer can make reference to your application in any resultant tribunal.
After 6 months your job application data will be deleted (unless you have requested we continue to process your data in relation to another of the recruitment Services we offer - for example if you want us to continue to notify you about further job vacancies that arise or you have opted in to be included in our Customer's Talent Pool).”
According to the Information Commissioner's Office (ICO) organisations are permitted to retain data "When keeping your data is necessary for establishing, exercising or defending legal claims". See the "When can the organisation say no?" section here.
This is important so that the organisation is able to:
- Respond to questions or complaints about a hiring decision
- Defend a potential discrimination or unfair treatment claim
- Evidence that decisions were based on role-related criteria
- Demonstrate that recruitment decisions were fair, objective, and non-discriminatory
Because Employment Tribunal claims (and internal grievances) can arise weeks or months after a decision, immediate deletion could place employers at an unreasonable legal risk.
Why All Jobs Pro uses a 6 month retention period
In accordance with our privacy policy that candidates are asked to read and agree to when they register / apply for a job on our platform, All Jobs Pro retains job application data for six months following a job application.
After this period, data is automatically deleted or anonymised unless there is a lawful reason to retain it for longer (for example if you notify us of an unresolved complaint or claim) or if the candidate has opted in to one of our ongoing services (such as Job Alerts or Talent Pool).
What to say to a candidate who requests deletion
This isn't an easy answer and you may want to seek advice from your company's legal advisor.
“We understand your request. You can manage your data by signing into to All Jobs Pro (the hiring platform that you applied for the job at our organisation on) and click on My Details > My Data where there are various options relating to data.
If you follow the "Delete all data" procedure your application data will no longer be available to anyone in our organisation (except in very specific circumstances, please see below) and in due course your data will be permanently deleted.
Please understand that the recruitment privacy policy (that all candidates are asked to read and agree to at the point of applying for a job through our hiring platform and which you can review here) does explain that all application data is stored for 6 months so that we can demonstrate fair and lawful decision-making if required.
Once that 6 month period has passed, our hiring platform automatically deletes your data. In the meantime the application data is stored securely and would only be accessed in the circumstances explained above"
What All Jobs Pro does when a candidate follows the delete procedure before the 6 months retention period has expired?
The candidate's application information in the ATS is immediately hidden from view and put into "do not contact" mode, their data is not deleted initially so that in the event a need for you to defend a legal claim were to arise, it would then be available to you (by contacting All Jobs Pro). Once the six month period has passed their data is of course deleted per their request.
Key takeaways for employers
- You are not breaching GDPR by retaining recruitment data for a reasonable, stated period
- Immediate deletion is not required where legitimate interests apply
- Clear record keeping of objective decision-making are recommended
- Candidates gave their consent for their data to be stored for six months at the point they applied for the job
- Candidates can control their data via the My Details > My Data menu (inside your All Jobs Pro powered careers portal where they applied for the job)
All Jobs Pro is designed to support fair data processing, to inform candidates fairly and protect our clients from legal unnecessary risk. If you have any feedback on our approach please do let us know - we're always listening.