With effect from 25th of May, the new European regulation on the personal data protection introduces new obligations for companies which have impact on their administrative burden and IT security. You can find tens of Slovak articles advising entrepreneurs on what they should pay attention to in connection with GDPR. But it is hard to find any information about its impact on every-day life. How will it influence searching for a new job in practice and what will be your rights as a candidate?
GDPR (General Data Protection Regulation) has many common features with our Slovak Act on Personal Data Protection. However, it introduces several changes which directly relate to the method of obtaining consent to the processing of personal data.
The consent has to be given voluntarily and of a person’s own free will. This means, for instance, that if a resume is to be sent through a website or jobs portal, the field containing the consent to personal data processing cannot be ticked automatically.
The text of the consent has to be clear and contain particular information about the purpose and method of processing of your personal data (i.e. no small print in a footnote).
You always give your consent for one specific purpose only. If, for instance, you are responding to a position and, in addition to that, the company wishes to send you a newsletter containing information about products, these consents have to be given separately.
When ordering goods or services, the grant of consent to personal data processing cannot be mandatory. In practice, you can order goods without giving your consent – on the other hand, the company has the right to record the data needed, for instance, for the purposes of invoice issuance and invoice archiving required by law. So, if you are looking for a job, you don’t have to give your consent to personal data processing, but in that case, the employer/personnel agency has the right to record your personal data only for the purposes of the particular recruitment process s and for the time strictly necessary.
GDPR also introduces several new rights for individuals to protect their personal data:
The right to be forgotten – you have the right to request erasure of personal data in the same way as you have given your consent to their processing. If you have given your consent by means of a form provided on a website when, for instance, you were ordering goods or services, you should have the possibility to withdraw your consent in the same way.
However, the right to be forgotten ceases to exist if the personal data is needed to comply with other statutory obligation (for instance, an employer is obliged to archive records of employees and their payslips for the period of ten years).
The right to data portability – if the processing of your personal data is carried out by automated means, you have the right to request from any company to transmit your personal data in electronic form to another administrator of your choice.
The right to rectification – as soon as you find out that the personal data the company has about you are inaccurate, you have the right to have them rectified or completed without undue delay and free of charge.
Notification obligation – any company that has your personal data at its disposal is obliged to provide, upon your request and free of charge, information on what data it is processing and to which other companies they were provided.
In practise, that also means that since May this year you, as a job-seeker, will be often asked to give your consent to the processing of your personal data. If, for instance, you send your resume by means of a jobs portal, you only tick one consent – for the purpose of the particular recruitment process . And if that company wants to comply with the GDPR obligations and, for instance, address you in the future with another job offer, it should ask you for another consent, because the first consent is no longer valid for the purpose of addressing you with new offers.
Author of the article: Barbara Ostrochovská