On June 6, 2024, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) announced the publication of a position paper regarding the protection of personal data of applicants in recruitment procedures by companies and authorities.

The position paper examines, among other things:

• the current developments in employee data protection, in particular, the significant impact of the Court of Justice of the European Union (CJEU) C-34/21 which gave a new push to efforts in regulating employee data protection;
• the General Data Protection Regulation (GDPR) principles, in particular, the respect of principles of lawfulness, fairness, purpose limitation, and minimization, as well as the necessity criterion under Article 6(1)(b) of the GDPR;
• the definitions of recruiting, headhunters or talent scouts, active sourcing, background checks or pre-employment checks, talent pool, and CV or resume parsing;
• the phases in the recruitment process (from the initial approach to potential candidates to the decision for or against the applicant) and their associated processing operations;
• the inclusion in talent pools, in particular, reliance on consent as a legal basis and retention periods depending on the industry-standard requirements for the position;
• background checks, in particular regarding the use of private and professional social networks and engines, obtaining information from third parties, and a limit to which information can be taken into account; and
• the use of artificial intelligence (AI) from publishing a job advertisement to the automated pre-selection of applicants to the analysis of job interviews and the use of chatbots. In particular, the HmbBfDI highlighted that emotion analysis is generally classified as inadmissible, while resume parsers may be permitted under certain conditions.

Lastly, the HmbBfDI outlined that the use of AI in recruiting will continue to increase, requiring strict data protection measures to minimize legal risks and gain applicants' trust.

You can read the press release here and the position paper here, both only available in German.