Legal update: GDPR news

LinkedIn Shutterstock

In this article the REC considers whether recruiters can rely on consent and whether they can still use jobs boards and LinkedIn.

Do recruiters need consent to process personal data?
Consent is one of six legal bases for processing personal data. Whilst it is the legal basis we are all most familiar with, and probably the easiest to demonstrate, it will not always be the most appropriate legal basis to rely on. Other legal bases which recruiters may wish to rely on include ‘necessary for the performance of a contract’, ‘legitimate interests’ or ‘legal obligation’.

However, not all of these can be used to process sensitive personal data (now called ‘special categories of data’) and so it is essential to know what type of data is being collected and therefore what legal basis can be relied upon.

To be valid, consent must be freely given, specific, informed, in plain language and demonstrated by affirmative action (and not inferred by silence or pre-ticked boxes). Of course individuals will have the right to withdraw their consent, following which the recruiter would no longer be able to process the personal data which the individual gave them (it won’t affect any processing done prior to the withdrawal of consent or personal data processed through another legal basis).

Jobs boards and LinkedIn
In short yes, but with care. By uploading their CV to a jobs board, an individual indicates their consent to the jobs board processing their data. However, the jobs board must ensure the individual knows who can access their personal data and on what basis.

Recruiters should be selective about who they contact and why – if you only contact an individual found on a jobs board when you have a relevant vacancy that person might be suitable for, you can demonstrate that you have a legitimate interest in contacting them – you provide work-finding services and they have indicated that are open to opportunities by posting their CV.Their response to you will indicate whether they are happy for you to continue to process their data or not. If not, delete them from your records.

LinkedIn recently introduced ‘career interests’, which allows individuals to select whether they would like to notify recruiters that they are openly looking for job opportunities.

Users can also select what job titles they are looking for and the type of job and industry they would like to work in.

If an individual switches on their ‘career interests’ a recruiter should be able to rely on a legitimate interest to make initial contact with that person. However, the recruiter will have to pay particular attention to the criteria selected by the individual eg. if an individual only selects IT roles then a recruiter who does not offer work-finding services in that particular sector won’t be able to rely on a legitimate interest to make that contact.

In contrast, if a recruiter provides roles that match an individual’s job selection criteria then they will be able to rely on a legitimate interest to make initial contact. Once contact is made, they may continue to rely on legitimate interests or consent (subject to the comments made earlier) to continue to process their data.



The General Data Protection Regulation – better known as the GDPR – comes into effect on

HR 17 April 2018