Paper application folders are increasingly becoming a thing of the past. Employers have long since turned to digital job postings and allow prospective candidates to apply online. In addition to sending application documents by email, application forms on websites are particularly common. These require applicants to fill out a questionnaire with personal information and upload scanned documents for online applications.
Legal basis for data processing for online applications
With regard to the relevant legal bases, there are no differences between “traditional” applications and online applications. According to Section 26 (1) (1) of the Federal Data. Protection Act (BDSG), belgium business fax list personal data of employees may be processed for the purposes of the employment relationship. Among other things, if this is necessary for the decision on establishing the employment relationship . The term “employee” expressly includes applicants, as stated in Section 26 (8) (2) of the Federal Data Protection Act (BDSG).
The permissible scope of data collection in the online application process
The permissible scope of data collection for online applications is therefore essentially. Determined by the necessity of the information for the specific position advertised . This also follows from the principle of data minimization in Art. 5 (1) (c) GDPR. Furthermore, implement structured data to improve content the general personal rights of applicants and the prohibition of discrimination. Under the General Equal Treatment Act (AGG) must be observed when collecting data.
An online application form may therefore request applicants’ basic data , such as name, address, or email address. Providing a telephone number should be voluntary, as the email address is generally sufficient for contact. Upload fields for a cover letter, resume, and relevant references and certificates are also permitted, as the employer requires these documents to assess the applicant’s skills, knowledge, and experience and thus their suitability for the advertised position.
Fulfillment of information obligations
According to Art. 13 GDPR, the employer, as the controller, is obligated to inform the data subject about the processing of their data at the time of collection. In the context of an online application, it is therefore advisable to provide the necessary information. The job advertisement, e.g., by linking to the privacy policy. When using an online application form, botswana business directory the information should be. Constantly accessible, even while the data is being requested. Unless the job advertisement or application form already contains a. Reference to the privacy policy, it should be made available to applicants immediately after receipt of the application (e.g., in the email confirming receipt).
The scope of the data protection information is determined by Art. 13 (1) and (2) GDPR. Accordingly, applicants must be informed, among other things, about the contact details of the controller or data protection officer, the purposes and duration of the processing, and the recipients or categories of recipients. When using an application tool from an external service provider, care must be taken to ensure that the data subjects are informed of this fact.
Storage and deletion of applicant data
According to Art. 17 (1) (a) GDPR, personal data must generally be deleted if it is no longer necessary for the purposes for which it was collected. For applicant data, this means that processing or retention is initially permitted until the final decision on filling the advertised position has been made.