Internet Searches and Privacy of Job Applicants Under Dutch Law

I Elisabeth P.M. THOLE

What has Google to do with job recruitment? Nowadays many recruiters and future employers use the Internet to obtain background information about a job applicant. Large quantities of information can be found on a person through search engines and social network websites. Some future employers even ask job applicants to mention their user names on social network websites to facilitate their search.

For job applicants, the Internet offers great possibilities to create their own profiles on websites such as Facebook and Linkedin, which helps to enlarge their (business and social) network, and also to find a new job. Whereas Linkedin is specifically aimed for use in a professional network, other social network websites are mostly meant for leisure and fun. Especially younger persons place information about their personal life on such websites, like contact details, holiday pictures, information about their relationship and hobbies.

Perhaps this information may be quite useful for friends and family. At the same time it can also be interesting for future employers and recruiters. Pictures of drinking tequila shots at a beach bar wearing a bikini are fun to share with friends, but may also be interesting information for a future employer to be used for the selection of the job applicants. Background checks can be carried out by external agencies, but such checks are costly and time-consuming, whereas the Internet is free and easy. The facilities are there, but does this imply that it is always allowed to use this public information for the verification of job applicants? In this article I will discuss the data protection related of performing Internet searches of job applicants from a Dutch law perspective. As the Dutch Data Protection Act (DPA) is an implementation of the European Data Protection Directive, the analysis may also be relevant for other EU Member States.

I Personal data of the job applicant

In the Netherlands, the DPA provides the rules for the processing of personal data. Personal data means information that, reasonably without disproportionate efforts, can be traced to a natural person. Here the job applicant. When an Internet search is carried out, different personal data will be processed. This may include data such as the address of the job applicant, his date of birth, employment history, pictures, video's and information about his friends and family.

The DPA applies to the processing of personal data. Processing includes the collecting and viewing of personal data. Thus also when the data will not be put in a file, the DPA may be applicable. An exception can be found in the processing of personal data solely for personal use. As background searches are usually carried out for business purposes, it is not likely that this exception applies. Case law from the European Court of Justice also shows that application of the exception is not easily assumed.

Although the DPA may apply to Internet background searches, there may still be differences in those searches, which may also have an impact on what will be allowed and what not. A difference could for example be made between the scope of the search. The future employer or recruiter could for instance limit the search to Linkedin, a website which is meant for use in a professional network. Another possibility is that the search is viewed on screen only and just and by one HR manager, and not printed and/or placed in a file, which can thereafter also be available to many others.

I Position of future employers and recruiters

In most instances, the future employer must be considered the data controller of the personal data. If a future employer makes use of an external recruitment agency for carrying out the Internet search of a job applicant, the recruitment agency is considered the data processor.

A data controller is the entity authorized to determine the purposes and means of the processing of personal data. Unlike a data controller, a data processor has no control over the data processing; a data processor should follow the instructions given by the data controller and carries out work under the (explicit) responsibility of the data controller. The data controller remains responsible for the processing of the personal data (see also Article 29 Working Party, Opinion 1/2010 adopted on 16 February 2010;WP 169).

A (written) data processing agreement must be concluded between the future employer and the recruitment agency. By means of such a contract, the parties must ensure that the information is processed only for the specific purposes for which it was collected. In particular, the recruitment agency must abide by strict confidentiality and security Obligations. The recruitment agency will also have to comply with the retention periods by which the future employer is bound. The future employer must, in its capacity as a data controller, be required to periodically verify compliance by the recruitment agency with the principles of the applicable law.

I Purposes and justification grounds

The future employer will only be allowed to process or have the personal data

3 0 2 m 2 0 1 0 I Bringing Together the World's Lawyers

processed by the recruitment agency for

well-defined, clearly described and justified

purposes. As to Internet background

searches, the purpose will be judging, on

the basis of personal information, whether

a job applicant will be suitable for a certain

job at the future employer's organization.

In addition, the employer is allowed to

process the personal data only if a ground

of justification is in place. Here the

following two grounds of justification may

be relevant: (a) The processing is necessary

for upholding the legitimate interest of the

employer; or (b) The applicant gives its

unequivocal consent to process his data.

First ground:

leg i t imate in terest of the employer

The employer may process the personal

data without the applicant's consent, if he

can demonstrate that he has a legitimate

interest to process the personal data,

which prevails above the privacy interest of

the job applicant. A t first sight an employer

may have a legitimate interest to perform

an Internet search with respect to a job

applicant in light of the job application

procedure. It will be up to the employer to

determine in each particular case whether

it fully meets all the criteria. Against the

above background, it will be necessary for

the employer to verify whether the goal of

processing may not also be obtained by less

far-stretching measures. He should not

process more data than necessary. The

employer should also limit the access to

the data to a certain group of people (e.g.

the recruitment agency and members of

the HR organization only), and the

employer should not save the data longer

than necessary.

In this respect, different arguments can be

made whether it should be allowed to

perform Internet background searches,

without the consent of the job applicant.

Arguments in favor of allowing Internet

searches of job applicants, can be found in

the fact that the applicant made this

information publicly available about himself.

The information is freely available. It would

be the job applicant's own responsibility to

prevent the availability of such information,

e.g. by making its profiles only available to a

limited number of people, or by not

disclosing such information on the Internet

at all. The job applicant could perform an

Internet background search by himself, and

make sure there are no unwanted data

available.

Arguments against the searches, without

the prior consent of the job applicant, are

the following. In most instances the job

applicant did not provide the personal data

for the purpose of background searches.

He just put it there for friends and fun, and

not to be confronted with the data during

a job interview. Also, it is hard to remove

(unwanted) personal data from the

Internet. Information is copied on the

Internet in a split second, and it is

impossible to trace information

A disadvantage of relying on the consent

may be that the applicant can at any time

revoke its consent to process the data.The

applicant however cannot withdraw its

consent retroactively. And if a job applicant

would withdraw his consent, this fact as

such provides also information to the

future employer on the job applicant,

although an employer should also be

careful not to jump to any conclusions

without verifying such with the job

applicant.

Code of conduct

A solution could also be to create a code

of conduct for Internet searches by future

employers of job applicants. An argument

for introducing such code of conduct is

that in the offline world it is common to

ask the job applicant's consent for the

The future employer must, in its capacity as a data controller, be required to periodically

verily compliance by the recruitment agency with the principles of the applicable law.

throughout the whole Internet. Moreover,

it is quite easy to commit fraud on the

Internet. Information may be presented as

posted by a certain individual, but could

actually be posted by someone else. And

many people have similar names.This could

lead to many mix-up situations.

Second ground:

job applicant's consent

If the processing would be based on the

consent of the data subject, the personal

data may only be processed if the job

applicant has given his unequivocal consent

to the future employer. When asking for

the consent, the job applicant should be

well informed, so that he knows for what

he is consenting for.

If the applicant can make use of a website

for its application, the employer could ask

the applicant for its consent by asking the

applicant to tick a box before completion

of the application form. Relying on the

ground of consent could in that case be a

reliable ground for the processing of

Internet background search data.

checking of references. There should be a

translation of this rule of decency for the

digital world.

Critics claim, that this idea masks the real

problem, being that there should be more

information about the risks of placing

information on the Internet. Young people

should be made more aware of that. If they

are, no such code of conduct would be

needed. Still a code of conduct could

provide more clarity regarding the

applicable (data protection) rules in this

respect.

i Additional formal requirements for the future employer under the DPA

The future employer may have to notify the

processing of the personal data to the

Dutch Data Protection Authority, unless he

may rely upon the exemption which applies

to the processing of the personal data of

job applicants. In order to be able to rely

upon this exemption ail conditions should

be met. The conditions for the exemption

[(assembler les avocats du monde I 2 ■ 2 0 1 0

include, that only data concerning name, contact details, nationality, education, present and former employment of the job applicant are processed. Other data that may be relevant for the position may only be processed when they have been provided by or are known to the job applicant Moreover the future employer may not retain the data for more than 4 weeks, or not more than I year with the consent of the applicant.

If the future employer would take care of these retention periods and if he could prove that the data obtained during the Internet search have been made available by the job applicant himself (for example on Linkedln), then the future employer could probably rely upon the exemption.This could however be different, when the future employer combines data from different websites, or when it turns out that information about the job applicant was not posted on the internet by the job applicant himself, but by a third person.

If the future employer can rely on the exemption, this only means that it does not

internet background search, and that a recruitment agency - if any - will perform this search (if applicable). The future employer could also make clear that the access to the personal data is limited to certain people within the organization. It is also advisable that the recruitment agency uses a privacy statement in line with the employer's statement.

I Conclusion

Internet background searches by future employers, possibly assisted by a recrui t ing agency, can be per formed quite easily. Loads of personal in format ion can be found in the Internet in a simple way. But the fact that i t is publicly available, does not imply that i t is compliant w i th Dutch data protect ion legislation t o do so.

The 'safest' ground for processing personal data of job applicants w i th respect t o Internet background searches is t o obtain the pr io r consent of the job applicant. In that respect i t wou ld be advisable t o provide an (online) application f o r m , and give the job applicants the opt ion t o t ick a

The future employer also will have to inform the job applicant of the processing of its personal data within the context of the internet background search, and that a recruitment agency - if any - will perform this search (if applicable).

have t o notify the processing of this data. This does no t automatically make the processing legal.

The notification, which has t o be made up in the Dutch language, must include the name and address of the employer, the reason for processing the data, the type of employees and the types of data that wi l l be processed, the recipients of the data, whether the data wil l be sent to countries outside the EU, and a general description of the process to determine whether the security measures that have been taken are suitable. Making a notification t o the Dutch Data Protection Author i ty is free of charge.

The future employer also wil l have t o inform the job applicant of the processing of its personal data wi th in the context of the

box, allowing the future employer t o search the job applicant on the Internet. If the application is no t received electronically, i t wou ld be best t o contact the job applicant and ask for its consent, before performing a search.

The downside of consent as the ground for processing, is tha t job applicants can wi thdraw the i r given consent at any t ime. Wi thdraw ing the consent can however no t be done w i th retroact ive effect.

The ground o f having a legitimate interest t o per form an Internet background search w i th respect t o an applicant could also be used by the fu ture employer t o argue that the personal data may be processed w i thou t the applicant's consent.The future employer should, however, be able t o

demonst ra te tha t i t has a legi t imate interest which prevails above the privacy interests o f the applicants.

Dr. Elisabeth P. M .THOLE ' Vice-President of UIA Protection of Personal

Data and Rights of the Digital Person Commission Attorney

Van Doorne Amsterdam.The Netherlands

' Head of the Van Doorne Privacy Team. She recently published the book "50 questions on Privacy". She may be reached at thole@van-doorne.com.

32 2 a 2 0 i 0 1 Reunir a !os abogados del mundo