Retention of data after completion of recruitment is justified by the interests of the candidates themselves as well as employers. The employer may keep the data collected in the course of recruitment from candidates for 3 years. During this period, candidates may raise the claim that their application was rejected due to discrimination or unequal treatment. 

Existing position of the Polish regulator
 

The President of the Personal Data Protection Office has made several strong statements on the issue of possible retention of candidates' data after completion of recruitment. In the guide published in October 2018, “Personal Data Protection in the Workplace. A Guide for Employers” it was pointed out that “it is impermissible to process data for the sole purpose of safeguarding against a possible future and uncertain claim by the data subject,” and such an action, according to the President of the DPO, would constitute processing data “just in case.” In the Authority's view, the data of candidates with whom no employment contract has been concluded should be deleted immediately after completion of recruitment.

The position of the Voivodeship Administrative Court in Warsaw and the employer's arguments
 

The Authority's assessment was challenged by the Voivodeship Administrative Court in Warsaw which, in August 2022, overturned the regulator's decision and pointed out that the President of the DPO incorrectly interpreted the legally justified purpose of the controller (i.e. the employer), and failed to take into account the interests of other persons participating in the recruitment. He subscribed to the position presented by the employer, in which it was emphasized that the employer is even obliged to retain data from recruitment processes.

According to Article 183d of the Labour Code, a person with regard to whom the employer has breached the principle of equal opportunity in employment – and therefore also the candidate – has the right to damages. It is up to the employer to prove that the principle of equal treatment has not been breached, i.e. that it used objective criteria in selecting a new employee as part of the recruitment process. In order to be able to conduct such proof (whether discrimination has occurred in a specific case), it is necessary to compare the qualifications and qualities of the candidates who have advanced to the next stage of the recruitment process with those for whom the decision to terminate the process has been made. The employer must therefore have the data of both the person alleging discrimination and the other candidates with whom the person was compared. 

Legal basis for processing data after completion of recruitment
 

Article 6(1)(f) of GDPR introduces a general clause according to which the processing of data without the consent of the data subject is permissible if two conditions are met. First, the processing must be necessary for the purposes of legitimate interests pursued by the controller or by a third party, and, second, there are no situations in which the interests are overridden by the well-being or fundamental rights and freedoms of the data subject.

The interest of the controller, i.e. the employer, is, of course, to protect against possible claims of unequal treatment in the establishment of the employment relationship. The interest does not disappear when the candidate requests the deletion of his/her data. This is because other candidates can claim that they were the ones who were discriminated against in the recruitment process, for example on the basis of gender or age. For these reasons, the employer must have the data of all candidates in order to be able to demonstrate that it was guided by objective criteria both in selecting those qualified for the next stages and in hiring the selected candidate.

Prevention of discrimination is the employer's primary duty under the Labour Code. Employers should take measures of a preventive nature (the same applies to bullying), which will include supervision of the recruitment processes by random checks of objectivity in the selection of candidates for the various stages of recruitment. Deleting candidates' data immediately after recruitment would make it impossible to fulfil the obligation to prevent discrimination, because the hiring employer would have no way to supervise the transparency of recruitment processes.

Data retention is also justified by the interests of third parties. In the case of an allegation of, for example, age discrimination, the candidate will want to prove that older people were not admitted to subsequent stages of the recruitment process despite having the appropriate qualifications, education and experience. If the employer deleted all the data after the recruitment, it would be impossible to determine the criteria on the basis of which it decided to reject the elderly. Candidates would be deprived of evidence in the proceedings they initiate. 

The verdict of the Voivodeship Court of Administration in Warsaw is not final. The President of the Personal Data Protection Office filed a cassation against it.