Data can be stored for the period of three years after the completed recruitment.

This was confirmed in February 2024 by the Supreme Administrative Court. The President of the Personal Data Protection Office has disagreed with this assessment and in one of administrative decisions he stated that personal data should be deleted immediately after the completed recruitment and then filed a last resort appeal against the judgement favourable for the data controller. This position was presented by the previous President of the Personal Data Protection Office, Jan Nowak. In the Office of Personal Data Protection work is in progress on a new handbook for employers in which the question of applicant data retention will probably also be addressed. In the opinion of the courts of both instances, the President of the Office wrongly interpreted the legally justified purpose of the controller (i.e. the employer) and failed to take into consideration the interests of other persons taking part in the recruitment. 

According to article 183d of the Labour Code a person against whom an employer violated the principle of equal treatment in employment – including an applicant – is entitled to compensation. It is the employer who has to prove that the principle of equal treatment has not been violated, that is in the selection of a new employee in the recruitment process the employer was guided by objective criteria. In order to prove this (whether in a specific case discrimination occurred) it is necessary to compare the qualifications and characteristics of the applicants who have progressed to the next stage of the recruitment process with those for whom the decision to terminate the process has been made. The employer must have the data of both the person who alleges discrimination and other candidates with whom the employer compared him or her.

The legal basis for the processing of data after the recruitment has been completed
 
Article 6.1(f) of the GDPR introduces a general clause according to which processing of the data without the consent of a person they relate to is allowed if two conditions are met. Firstly, the processing must be necessary for the purposes of the legitimate interest pursued by the controller or by a third party, and secondly, there are no situations in which such interests are overridden by the well-being or the fundamental rights and freedoms of the data subject.

The interest of the controller, i.e. the employer, is the protection against possible claims of unequal treatment in the establishment of the employment relationship. It does not stop when an applicant requests that his or her data should be deleted. Other applicants may claim that they are the ones who have been discriminated against in the recruitment process, e.g. on the basis of gender or age. For these reasons the employer must have all data of all applicants in order to be able to demonstrate that it was guided by objective criteria both when in selecting those qualified for subsequent stages, and in employing the successful applicant.

Counteracting discrimination is the fundamental obligation of an employer under the Labour Code. Employers should undertake preventive action (the same is true for workplace bullying), which will include supervision of recruitment processes by random checks of objectivity in the selection of applicants to specific stages of recruitment. Deleting the applicants’ data immediately after the completion of the recruitment would make it impossible to fulfill the anti-discrimination obligation, as the employer would not be able to supervise the transparency of the recruitment processes.

Storing the data is also justified due to third party interest. For example, in case of an allegation of age discrimination, an applicant will want to prove that older applicants were not allowed to subsequent stages of recruitment despite having relevant qualifications, education, and experience. If the employer had deleted all data after the completion of the recruitment, it would be impossible to establish the criteria on the basis of which the employer decided to reject older persons. The applicants would be deprived of evidence in the proceedings they initiated.
 

Find more in the PRO HR Year Book 2024.