Storing data after the recruitment process has ended is justified by the interests of both the candidates and the employers. The employer can store data collected during the recruitment process for up to three years, the period in which candidates can claim that their applications were rejected due to discrimination or unequal treatment.

Previous position of the Polish supervisory authority
The President of the Personal Data Protection Office (UODO) has made several firm statements regarding the potential storage of candidates’ data after the recruitment process ends. In a guide published in October 2018 titled „Data Protection in the Workplace. A Guide for Employers”, it was stated that „it is unacceptable to process data solely to protect against a potential future and uncertain claim by the person to whom the data pertains,” and such actions, according to the President of UODO, would be considered data processing „just in case.” In the office’s opinion, the data of candidates who were not hired should be deleted immediately after the recruitment process ends.

Position of the Provincial Administrative Court in Warsaw and the employer’s argument
The Provincial Administrative Court in Warsaw disagreed with the authority’s assessment, ruling in August 2022 that the President of UODO misinterpreted the legally justified purpose of the administrator (i.e. the employer) and failed to consider the interests of other participants in the recruitment process. The court supported the employer’s position, which emphasised that the employer is actually required to store data from recruitment processes.

According to Article 183d of the Labour Code, if an employer violates the principle of equal treatment in employment – meaning the candidate can also claim this – the victim has the right to compensation. The employer must prove that the principle of equal treatment was not violated, meaning they used objective criteria when selecting the new employee during the recruitment process. In order to provide such evidence (whether discrimination occurred in a specific case), it is necessary to compare the qualifications and characteristics of candidates who moved to further stages of recruitment with those who were rejected. Therefore, the employer must have data on both the person making the discrimination claim and the other candidates with whom they were compared.

Legal bases for processing data after the recruitment process
Article 6(1)(f) of the GDPR introduces a general clause under which data processing without the consent of the person to whom the data pertains is allowed if two conditions are met. First, the processing must be necessary for the legitimate interests pursued by the data controller or by a third party. Second, there must be no situation in which the interests or fundamental rights and freedoms of the person to whom the data pertains override these interests.

The employer’s interest is, of course, to protect against potential claims of unequal treatment in relation to employment. This interest does not disappear when a candidate requests the deletion of their data. Other candidates could claim they were discriminated against during recruitment, for example, due to their gender or age. For these reasons, the employer must have data on all candidates to demonstrate that they used objective criteria both when selecting candidates for subsequent recruitment stages and when hiring the chosen candidate.

Preventing discrimination is a fundamental obligation of the employer under the Labour Code. Employers should take preventive actions (similar to those against mobbing), including monitoring recruitment processes through random checks to ensure objectivity in the selection of candidates for various stages of recruitment. Deleting candidates’ data immediately after the recruitment process would prevent the employer from fulfilling their obligation to prevent discrimination, as they would not be able to monitor the transparency of the recruitment process.

Data retention is also justified by the interest of third parties. In the case of a discrimination claim, for example, due to age, the candidate will want to prove that older individuals were not allowed to progress to later stages of recruitment, despite having the appropriate qualifications, education and experience. If the employer deleted all the data after the recruitment process, it would be impossible to determine the criteria on which the decision to reject older candidates was made. Candidates would be deprived of evidence in proceedings they initiated.

This ruling of the Provincial Administrative Court in Warsaw is not final. The President of the Personal Data Protection Office has filed for cassation.