A social media profile is public so what is the issue here?
Many argue that a social media profile is publicly available so employers are free to check this information and use it accordingly. It is important to remember that on the point of publicly available information, it is important to remember the following comment made in Article 29 Working Party Opinion 2/2017on data processing at work:
“employers should not assume that merely because an individual’s social media profile is publicly available they are then allowed to process those data for their own purposes. A legal ground is required for this processing, such as legitimate interest. In this context the employer should—prior to the inspection of a social media profile—take into account whether the social media profile of the applicant is related to business or private purposes, as this can be an important indication for the legal admissibility of the data inspection. In addition, employers are only allowed to collect and process personal data relating to job applicants to the extent that the collection of those data is necessary and relevant to the performance of the job which is being applied for.”
From the above, it is well-defined, that employers must have a legal ground such as legitimate interest and adhere to fair processing, but fair processing is a separate issue and not in itself a lawful basis for processing. Remember that the legitimate interest balancing test must be conducted and documented if this is the ground being relied upon.
The fair notice requirement under GDPR would be satisfied by providing a privacy notice to the prospective applicant before they engage with the recruitment process. Therefore you need to check if you have this privacy notice in place and if not it should be added on your to-do list.
The Article 29 Working Party also state that:
“Data collected during the recruitment process should generally be deleted as soon as it becomes clear that an offer of employment will not be made or is not accepted by the individual concerned. The individual must also be correctly informed of any such processing before they engage with the recruitment process.
There is no legal ground for an employer to require potential employees to “friend” the potential employer, or in other ways provide access to the contents of their profiles.”
However it is also important to keep in mind the time-frame within which a candidate may make a claim post the company’s decision of not choosing him/her but choosing another candidate.
The following example is given in the Opinion:
“During the recruitment of new staff, an employer checks the profiles of the candidates on various social networks and includes information from these networks (and any other information available on the internet) in the screening process.”
Only if it is necessary for the job to review information about a candidate on social media, for example in order to be able to assess specific risks regarding candidates for a specific function, and the candidates are correctly informed (for example, in the text of the job advert) the employer may have a legal basis under Article 6(1)(f) to review publicly-available information about candidates. Erring on the side of caution would be advisable and common sense should prevail!