Differentiation must be made between the information that the employer would like to obtain (as much information as possible) and between the information that he/she is legally entitled to obtain (regulated by labour law and data protection regulations). Despite the existence of the employer’s right to choose with whom to contract, this right is not limitless.1128 Section 2 will examine the rules imposing limitations on the employer’s information thirst.
Rules relating to the “traditional” recruitment procedure (e.g. tests, job interviews) were already elaborated especially by the doctrine and the practice of the data protection supervisory authorities. The following paragraphs will limit themselves to the presentation of the data protection rules in general during the recruitment phase, while their application and the specific data protection questions relating to SNSs will be discussed under Chapter 2.
§1: Labour law and applicants’ rights
As it was already referred to in Part I, both the FLC and the HLC contain provisions regulating employment and data protection. They also regulate the recruitment phase as well.
Even though these provisions do not explicitly aim SNSs, they are adequately applicable to them as well.
(A) Provisions of the labour codes
Prior to discussing the issues specific to SNSs, it is necessary to review the data protection provisions of the labour codes. Before addressing (b) the data protection requirements laid down in the labour codes, it must be examined (a) whether these provisions are applicable to job applicants at all.
1126 Del Riego – Sánchez Abril – Levin 2012. pp. 18–21.
1127 Byrnside 2008. p. 475. Although back in 2008 (and in 2006, as the source referred to it) a pre-employment social media vetting might have been considered outrageous by candidates, today it has become a mainstream phenomenon, so it might be judged differently.
1128 Arany-Tóth 2008a. p. 112.
(a) Applicability to job candidates
Naturally, when it comes to the recruitment process, the subjects of the different recruitment methods are prospective employees and not employees. As these individuals are not yet employees, the question of the applicability of the labour law regulations might be raised and therefore should be clarified. The question whether the provisions of the labour code are applicable only to employees or they include prospective employees as well is not raised in French legislation. France was the first country in the European Economic Community to adopt a legislation specifically aiming to regulate recruitment methods:1129 since 1992, due to the act relating to employment, the development of part-time work and unemployment insurance,1130 the FLC contains provisions explicitly regulating the recruitment process (Article L1221-6 – Article L1221-9), making it unquestionable that job applicants are covered by these provisions.1131
In contrast to the FLC, the HLC contains no expressed provision regarding the hiring procedure, leaving room for certain questions. The HLC does not mention the expression “job applicant”, it uses the term of employee. Even when determining the personal scope of the HLC, the word employee is used.1132 With respect to the recruitment phase, only a reference can be found in Subsection 1 of Section 10, which regulates statements and disclosure of information and states that “[an] employee may be requested to make a statement or to disclose certain information only if it does not violate his/[her] rights relating to personality, and if deemed necessary for the conclusion […] of the employment relationship[.]”1133
These provisions raise an important point of law, such as: does the personal scope of the HLC cover the candidate, too? Opinions differ regarding this question.
When examining this section,1134 Tibor Breznay mentions only the employee and not recruitment,1135 while Katalin Berki [et al.] stipulate that this provision only aims employees.1136 According to the Equal Treatment Advisory Board, the HLC’s provisions are only applicable to employees and employers and therefore do not cover the recruitment process.1137 In contrast, according to Csilla Lehoczkyné Kollonay, the provisions aiming to ensure the protection of employees are applicable to the selection process, too.1138 Mariann Arany Tóth, and József Hajdú and Attila Kun are of the same
1129 Ray 1993. p. 109.
1130 Act No. 92-1446 of 31 December 1992 on employment, the development of part-time work and unemployment insurance (“Loi n° 92-1446 du 31 décembre 1992 relative à l’emploi, au développement du travail à temps partiel et à l’assurance chômage”)
1131 Not to mention the general formulation of Article L1121-1 of the FLC, not only aiming to protect employees, but every person.
1132 Subsection (1) of Section 2 of the HLC
1133 Subsection (1) of Section 10 of the HLC. Emphasis added by the author.
1134 It should be mentioned that the sources below concern the previous HLC (Act XXII of 1992), which contained a similar provision. (Section 77)
1135 Breznay 2002. p. 115.
1136 Berki et al. 2008. p. 278.
1137 Az Egyenlő Bánásmód Tanácsadó Testület 1/2007. TT. sz. állásfoglalása az állásinterjún feltehető munkáltatói kérdésekről
1138 Lehoczkyné Kollonay 1997. p. 91.
opinion, namely that the personal scope of the provisions mentioned covers the candidate, too.1139, 1140
The latter viewpoint is supported by the fact that the general reasoning of the HLC emphasizes that according to the general principle, unless contrary to labour law regulation, civil law rules constitute the underlying rules of the HLC.1141 When declaring the protection of personality rights in the employment context (Section 9), the HLC refers to the Civil Code – which states that every person is entitled to the protection of the personality rights.1142 Also, in the employment relationship a hierarchal relation can be found between the parties, the employee is in a position of existential vulnerability.1143 One of the aims of labour law is to counterweigh this vulnerability; in order to achieve this, labour law contains several provisions for the protection of the employee.1144 However, this existential vulnerability is not unique to the employee-employer relationship: it is (even more intensely)1145 present before the conclusion of the employment contract, as – under the not always favourable labour market conditions – the candidate is typically not in the position to balance between concluding a contract and the violation of his/her fundamental rights.1146
Based on the above-mentioned arguments, it seems logical that the provisions protecting employees must be adequately applicable to candidates. The phrasing of Section 10 itself also suggests the applicability of these provisions to candidates as it regulates the case of concluding the employment contract – for which one needs to be a candidate and not an employee.1147 With regard to the above, it would be recommended to clarify in Hungarian law – similarly to French law – that the relevant data protection provisions of the HLC are also applicable to job applicants. Such a clarification might include the insertion of a subsection stating that these provisions are to be applied to job applicants as well.1148 (b) Applicants’ right to data protection in the labour codes
While the FLC explicitly aims recruitment, the HLC does it in a more abstract way, through regulating employee statements and disclosure of personal information in order to conclude an employment relationship. These provisions echo data protection requirements such as purpose limitation, necessity, relevancy and transparency.
Besides the general clause of Article L1121-1 stipulating the protection of individual and collective rights and freedoms, from Article L1221-6 to Article L1221-9 the FLC contains provisions explicitly regulating the recruitment process. In these provisions it expressly
1139 Arany-Tóth 2008a. p. 114.; Hajdú – Kun 2014. p. 94.
1140 According to Jóri et al., the material scope of the act covers the hiring phase, too. Source: Jóri – Hegedűs – Kerekes 2010. p. 278.
1141 T/4786. számú törvényjavaslat a Munka Törvénykönyvéről, 2011. p. 86.
1142 Similarly, the basic principles of the Privacy Act are applied to every data processing, not only to the processing of personal data relating to employees.
1143 However, it also has to be seen that this defencelessness does not characterize all employees. Bankó –Szőke 2016. pp. 43–44.
1144 Gyulavári 2013. p. 19.
1145 The Commissioner’s Recommendation on job advertisements and on the activity of private recruitment agencies
1146 Hajdú 2005. p. 170.
1147 Arany-Tóth 2008a. p. 114.
1148 Such a subsection might be formulated as follows: “Subsection (6) of Section 10: Subsections (1)–(5) are also adequately applicable to job applicants.”
refers to the most important data protection principles, leaving no question regarding whether these principles are applied to the recruitment phase or not.
Article L1221-6 asserts the principle of finality, which requires that information asked from a job applicant in any form must only be processed for the aim of assessing the applicant’s capacities to occupy the given employment or to evaluate his/her professional abilities. Therefore it aims to protect the applicant’s extra-professional life through limiting the processing of personal data to the professional capacities of the applicant.1149 Moreover, it emphasizes the principle of necessity by stipulating that the information obtained must have a direct link and must be necessary for the proposed job or for the evaluation of professional aptitudes. The Article also prescribes that the applicant must reply in good faith to the information requests.
Article L1221-8 requires the employer to inform the applicants regarding the methods and techniques used for recruitment, prior to their application. It also declares that the results obtained with such methods and techniques are confidential. These methods and techniques must be relevant in the light of the objectives sought. Article L1221-9 further emphasizes the principle of transparency and the employer’s obligation to inform applicants prior to the collection of personal data.
The HLC contains provisions relating to employee statements and disclosure of personal information – which covers the case of processing the job applicants’ personal data through obtaining different kinds of information. The HLC also prescribes the purpose limitation principle; it defines the purpose of such processing, which is the conclusion of the employment relationship,1150 and in relation to this identifying the best candidate. 1151 It further refers to the principle of necessity and adds that statements and disclosure must be necessary in order to conclude the employment relationship1152 – imposing limitations on the scope of information that can be processed.1153 Also, similarly to the FLC, the HLC also contains provisions with respect to informing candidates: it requires employers to inform candidates in writing prior to the data processing.1154 It means that information must be provided to applicants, thereby ensuring the transparency of the processing.
With regard to the grammatical formulation of the labour codes regulating data processing in the recruitment phase, a suggestion might be made. As these provisions were adopted before the vast proliferation of SNSs, their application to these Web 2. 0. services might raise certain concerns, as the grammatical formulation of the relevant provisions of the labour codes does not correspond perfectly with the reality of the information society.
The FLC uses the expression “information requested” (“informations demandées”) in the first subparagraph of Article L1221-6, while the HLC employs the expression “making a statement or disclosing certain information” (“nyilatkozat megtétele vagy adat közlése”) in Subsection 1 of Section 10. Interpreting these provisions from a strict grammatical point of view would result in excluding information obtained by the employer through unilaterally accessing (without requesting) the prospective employee’s SNS profile.
1149 For example, the employer can ask for a school certificate, proof of a degree, driving licence, but cannot ask for academic records or for personal files. Source: Radé 2002. p. 184.
1150 Subsection (1) of Section 10 of the HLC
1151 Arany-Tóth 2016– p. 29.
1152 Subsection (1) of Section 10 of the HLC
1153 Usually information directly connected to the identity of the applicant is not considered to be essential for the conclusion of the employment contract. Source: Bankó – Berke – Kiss 2017. p. 46.
1154 Subsection (5) of Section 10 of the HLC
The aim of these provisions is to protect job candidates’ rights during recruitment, regardless of the method used. Data protection requirements also apply to every processing during recruitment. So, despite this grammatical lack, the data protection requirements apply; still, it would be desirable to clarify the scope of protection. In order that the grammatical formulation of these provisions better correspond with real-life conditions, it would be desirable to complete the regulation with the expression “collected”, reflecting better the reality of the methods of obtaining personal data in the age of the information society.
(B) Practice of the data protection supervisory bodies
Both the CNIL and the NAIH have addressed the question of the job applicant’s right to data protection, emphasizing that the employer must respect data protection requirements during the recruitment as well and clarified how exactly employers should comply with these requirements in this context. They examined the proper use of different recruitment tools (e.g. lie detectors, personality tests, etc.) from a data protection point of view, giving substance to the general provisions of the labour codes. In the following, instead of the exhaustive presentation of the CNIL’s and NAIH’s practice, focus will be put on their conclusions which might be relevant in relation to SNSs.
(a) France: the CNIL
The CNIL issued a deliberation in 2002 on the collection and processing of personal information during recruitment,1155 in which it clarified the application of the data protection principles to the recruitment process. It stated that unless justified by the specific nature of the job, or by the legal regulation of a foreign country concerned by the post, generally – amongst others – information such as date of entry to France, information relating to family members (name, nationality, profession), height, weights, housing conditions or community life shall not be processed. The deliberation also states that it is prohibited to process personal data relating to the candidate’s racial or ethnic origin, political opinion, religious or philosophical convictions, membership in a trade union, data relating to his/
her health or sexual life – without the consent of the applicant. Even in the case of consent, the processing cannot lack a direct and necessary link to the job proposed.1156, 1157
The CNIL reiterated this position in several of its documents. In 2013 it provided a list of information which is, as a main rule, not relevant, unless justified by particular circumstances. These items of information include, for example, date of arrival in France, original citizenship, family background, health status or community life1158 – information which is often shared on SNSs by an average user. In its information sheets relating to employment, the CNIL also dealt with the phase of recruitment, and again it reiterated
1155 CNIL: Délibération n°02-017 du 21 mars 2002
1156 It should not be forgotten that, as demonstrated before, since 2002, the appreciation of the validity of employee consent as a legal ground of processing has considerably changed.
1157 The deliberation also treated the question of transparency and prior information of the individual, the exercise of the rights of the data subject and the prohibition of automated profiles.
1158 https://www.cnil.fr/fr/les-operations-de-recrutement (Accessed: 20 June 2019)
the importance of the principle of relevancy and the importance of being informed on the processing of applicants’ personal data.1159
While previously the employer had to actively look for that information, today it is not uncommon to find this information within reach on SNSs. In addition, drawing conclusions from this information might matter, too. In another deliberation in 2007,1160 the CNIL recognized the lack of relevancy and the very subjective nature of comments contained in files relating to applicants (and former employees).1161 So the conclusions drawn from the consultation of the profile of the applicant shall also present an objective nature.
(b) Hungary: the Data Protection Commissioner and the NAIH
In 2006 the Hungarian Data Protection Commissioner adopted a recommendation on job advertisements and on the activity of private recruitment agencies1162 in order to ensure the uniform protection of job applicants’ rights. In this recommendation the Commissioner drew attention to the informational vulnerability of job applicants and the increased importance that he/she can follow and control the processing of his/her personal data during the hiring process. It is crucial that the applicant is aware to whom he/she is sending the information and knows where he/she can ask for information regarding the status of the decision.
Therefore, job advertisements must contain information about the controller and about the contact information ensuring that the applicants can exercise their rights relating to the processing. In a case1163 on the questions that can be asked during a job interview, the Commissioner noted that if the employer asks a question violating privacy rights, in order to prevent impairment of rights, the applicant can refuse to answer or can give an untruthful answer.1164
The former Hungarian Data Protection Commissioner extensively dealt with the issue of tests and data protection. According to him, a difference must be made between two types of the tests: between tests evaluating the professional suitability and readiness, and between tests relating to psychological and personality traits of the individual.1165 The former case relates to tests aiming to map the professional competences and expertise of employees, and indeed the employer is entitled to obtain that information, before and also during the employment.1166 In contrast, tests aiming to know the psychological or personality traits can enable the employer to draw conclusions relating to the individual’s personal traits that can contribute to organizing work more effectively. Although this is a legitimate interest on the part of the employer, during the enforcement of this interest the employer must respect the employee’s personality rights.1167
1159 CNIL: Le recrutement et la gestion du personnel. Fiches pratiques. Travail & Données personnelles, 2018
1160 CNIL: Délibération n°2007-374 du 11 décembre 2007
1161 These comments included, for example, comments relating to the behaviour of the individual (“catastrophe”,
“liar and unreliable”, “lame”, “not great”, “hygienic problems (smell) !!!!!”, “so annoying”), comments relating to their health status (“disappeared after a depression”, “depressive”, “problems with alcoholism”, “suffers from cancer, cannot work anymore”) or comments relating to the personal or family relations (“girlfriend/
friend of M. – not reliable”, “does not live with her husband anymore”, “wife of G.”).
1162 ABI 167/A/2006-3.
1163 ABI 900/A/2006
1164 ABI 900/A/2006
1165 ABI 814/A/2004-8.
1166 ABI 814/A/2004-8.
1167 ABI 814/A/2004-8.
Relating to this case, the Commissioner also emphasized that depending on the characteristics of the given job, certain personality traits might have increased relevancy, these tests cannot be used on a general basis to a large group of employees: its use should be carefully planned and selected. Also, the tests should be limited to the examination of the personal traits essential for the employment, with the existence of a legitimate purpose.
It was also recommended that an independent third party should analyse the tests.1168 In the same case, the Commissioner also stated that the psychological test should be based on the informed, voluntary consent of the employee. However, this statement has become outdated since, as the case took place in 2004; later it was concluded that the voluntary nature of the consent is highly questionable and that the legitimate ground of balancing rights and interests might be better adapted to the employment context.1169 As on SNSs the employer has an unprecedented possibility to assess the personal traits of job applicants (and employees), these requirements will have high importance in the case of pre-employment SNS screenings – as will be presented in Chapter 2.
In another case1170 the Commissioner dealt with a machine using digital face recognition destined to be applied during interviews. The machine would analyse the features of the applicant and draw consequences regarding his/her personality traits and behaviour. In relation to personality tests, the Commissioner laid down that the employee cannot be subjected to a method which would provide the employer data over which the individual does not have control. First, the result of the test should be transferred to the individual, who can then decide whether he/she consents to transfer it to the employer, providing him/
In another case1170 the Commissioner dealt with a machine using digital face recognition destined to be applied during interviews. The machine would analyse the features of the applicant and draw consequences regarding his/her personality traits and behaviour. In relation to personality tests, the Commissioner laid down that the employee cannot be subjected to a method which would provide the employer data over which the individual does not have control. First, the result of the test should be transferred to the individual, who can then decide whether he/she consents to transfer it to the employer, providing him/