4 ms·

It's data about you, GDPR gives you the right to access it. It is hardly abuse.

dekhn 5y ago
Hmm, I'm going to have to think about this. A job applicant is a data subject of the company they apply to. The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. However, GDPR permits the job applicant to act as a data subject and request the company's proprietary information (produced by employees who expected to remain semi-anonymous to provide candid feedback). If that's the case, I think I have another in a long list of items to add to my list of "why GDPR is a crazy law and the implications weren't completely thought-through"
- detaro 5y ago
  > The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. To phrase it bluntly, a company needs to consider what laws apply to it before it forms such expectations. I'm sure some company also compiled databases of addresses for advertising purposes to based on the expectation that their internal data is kept proprietary, also doesn't work like that. Also note that an obvious solution to having to disclose data is not having it. Plenty places will have you re-interview if you re-apply anyways, so justifying why they keep detailed interview notes around is an interesting question, assuming this request comes after the process has ended. > (produced by employees who expected to remain semi-anonymous to provide candid feedback). Employees don't just expect that, they have a legal right to it. "my personal data" does not include "who did interview me", and the company has to protect the personal details of its employees. (presumably why the reddit OP mentioned data being redacted)
  - dekhn 5y ago
    I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. Just being able to read interview feedback is enough to recognize who wrote it.
    - detaro 5y ago
      But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around... GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.
    - handoflixue 5y ago
      > Just being able to read interview feedback is enough to recognize who wrote it. While that might be true internally, I think it's pretty unlikely that a candidate had enough of a sense of each person's writing style (especially if the interview was conducted via voice, as is typical) > So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. The GDPR was passed in 2016. I feel like 5+ years is plenty of time to re-adjust expectations.
      - dekhn 5y ago
        At this time, I believe that the law (either GDPR or CCPA) itself does not require companies to disclose confidential interview notes. Certainly when I worked at Google during GDPR they reorganized massive amounts of data storage to comply with that, but I don't recall anybody doing hiring saying GDPR applied. From I can tell a random throwaway made this post on reddit, it may have happened, but it doesn't mean that companies are required to do this. I would like to see more supporting data.
        x0x0 5y ago
        GDPR very explicitly applies; see eg ICO (the UK DPA) guidance, or this: https://www.dickinson-wright.com/news-alerts/the-gdpr-covers-employee-hr-data-and-tricky https://www.dickinson-wright.com/news-alerts/the-gdpr-covers... As I mentioned above, CA privacy laws exclude this information.
  - alisonkisk 5y ago
- PeterisP 5y ago
  The basic legal principle (GDPR article 6) is that processing data about people is allowed only if a specific legal basis applies, and only to the extent that this legal basis allows it. So before we're even talking about expectations of the availability of this data - e.g. detailed interview notes in some company HR system (personal notes of specific interviewing employees would not count if these notes are not used in the company processes) - the company must consider why do they think they are allowed to record and store that data in the first place, since the "default expectation" is that they are not. And if they have a valid reason, they are required to have their Data Protection Officer to know that they are processing this data and it's the duty of the DPO to inform these people about what exactly they are permitted and required to do with this data - so if the people recording this data have a misleading expectation, that's fully the fault of the company. Before "the company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary" it's the duty of the company to ensure that this processing of private data is reviewed, verified whether that processing is lawful in the first place and ensure that the people recording this information are informed about what they can/can't/must do with it, as the law requires the company to either ensure "appropriate organizational measures" for that, or not process this data at all. If the company has their employees "simply" producing data that includes personal data of others without considering the GDPR impact, that by itself is a breach of their legal duty of Article 24 of GDPR. In situations like these, most companies would assert that they have a specific legitimate interest (article 6.1.f) in processing the data for conducting the interview and application decision process, which is a perfectly valid justification - however, that would not necessarily grant them the right to process the data after the interview process ended with a rejection; there's no inherent right for the company to just continue storing the detailed interview notes just because, so it would be interesting to see what legal basis they assert for having that data in the first place, and IMHO in most EU companies the standard HR process now would require to discard the details after the interviews.
  - detaro 5y ago
    At least in Germany it seems storing records for up to 6 months is common, since that's when the deadlines for suing under discrimination law expire and an employer has a legitimate interest in being able to produce detailed documentation about their decision process to defend against such lawsuits. But that's again a very specific thing that justifies it.
- M2Ys4U 5y ago
  This has been the case since long before the GDPR. The ability to make subject access requests was in the Data Protection Directive which was passed in 1995.
icedchai 5y ago
I would just say it has been deleted, so no data is available. Why waste your time with a response?
- atoav 5y ago
  Because sometimes people who send you such a request might actually already know parts of the data you have on them. Telling them there is _no_ data shows them that you are either untrustworthy or utterly incompetent. If they are the wrong type of person they might come with a lawyer next.
  - icedchai 5y ago
    I’m saying I had no data ever, I’m saying I have none now. Unless you have big bucks GDPR is toothless for stuff like this. I firmly believe data about interviews is private, to the company.
    - atoav 5y ago
      Are you sure you have none now? This could be very expensive : )
      - icedchai 5y ago
        How is someone going to figure out if I actually do, if none of the data is externally accessible?
    - multjoy 5y ago
      Why do you need big bucks? You make a complaint to the regulator and then they do the heavy lifting on your behalf.
      - icedchai 5y ago
        I'm sure it's that simple. You'll need big bucks to get a lawyer and prepare a compliant. The regulator will have bigger fish to fry. One or two people whining about "their" interview data is laughable. Your little complaint will land on the bottom of the stack, where it will stay, forever.

Hmm, I'm going to have to think about this. A job applicant is a data subject of the company they apply to. The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. However, GDPR permits the job applicant to act as a data subject and request the company's proprietary information (produced by employees who expected to remain semi-anonymous to provide candid feedback). If that's the case, I think I have another in a long list of items to add to my list of "why GDPR is a crazy law and the implications weren't completely thought-through"

detaro 5y ago
> The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. To phrase it bluntly, a company needs to consider what laws apply to it before it forms such expectations. I'm sure some company also compiled databases of addresses for advertising purposes to based on the expectation that their internal data is kept proprietary, also doesn't work like that. Also note that an obvious solution to having to disclose data is not having it. Plenty places will have you re-interview if you re-apply anyways, so justifying why they keep detailed interview notes around is an interesting question, assuming this request comes after the process has ended. > (produced by employees who expected to remain semi-anonymous to provide candid feedback). Employees don't just expect that, they have a legal right to it. "my personal data" does not include "who did interview me", and the company has to protect the personal details of its employees. (presumably why the reddit OP mentioned data being redacted)
- dekhn 5y ago
  I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. Just being able to read interview feedback is enough to recognize who wrote it.
  - detaro 5y ago
    But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around... GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.
  - handoflixue 5y ago
    > Just being able to read interview feedback is enough to recognize who wrote it. While that might be true internally, I think it's pretty unlikely that a candidate had enough of a sense of each person's writing style (especially if the interview was conducted via voice, as is typical) > So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. The GDPR was passed in 2016. I feel like 5+ years is plenty of time to re-adjust expectations.
    - dekhn 5y ago
      At this time, I believe that the law (either GDPR or CCPA) itself does not require companies to disclose confidential interview notes. Certainly when I worked at Google during GDPR they reorganized massive amounts of data storage to comply with that, but I don't recall anybody doing hiring saying GDPR applied. From I can tell a random throwaway made this post on reddit, it may have happened, but it doesn't mean that companies are required to do this. I would like to see more supporting data.
      - x0x0 5y ago
        GDPR very explicitly applies; see eg ICO (the UK DPA) guidance, or this: https://www.dickinson-wright.com/news-alerts/the-gdpr-covers-employee-hr-data-and-tricky https://www.dickinson-wright.com/news-alerts/the-gdpr-covers... As I mentioned above, CA privacy laws exclude this information.
- alisonkisk 5y ago
PeterisP 5y ago
The basic legal principle (GDPR article 6) is that processing data about people is allowed only if a specific legal basis applies, and only to the extent that this legal basis allows it. So before we're even talking about expectations of the availability of this data - e.g. detailed interview notes in some company HR system (personal notes of specific interviewing employees would not count if these notes are not used in the company processes) - the company must consider why do they think they are allowed to record and store that data in the first place, since the "default expectation" is that they are not. And if they have a valid reason, they are required to have their Data Protection Officer to know that they are processing this data and it's the duty of the DPO to inform these people about what exactly they are permitted and required to do with this data - so if the people recording this data have a misleading expectation, that's fully the fault of the company. Before "the company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary" it's the duty of the company to ensure that this processing of private data is reviewed, verified whether that processing is lawful in the first place and ensure that the people recording this information are informed about what they can/can't/must do with it, as the law requires the company to either ensure "appropriate organizational measures" for that, or not process this data at all. If the company has their employees "simply" producing data that includes personal data of others without considering the GDPR impact, that by itself is a breach of their legal duty of Article 24 of GDPR. In situations like these, most companies would assert that they have a specific legitimate interest (article 6.1.f) in processing the data for conducting the interview and application decision process, which is a perfectly valid justification - however, that would not necessarily grant them the right to process the data after the interview process ended with a rejection; there's no inherent right for the company to just continue storing the detailed interview notes just because, so it would be interesting to see what legal basis they assert for having that data in the first place, and IMHO in most EU companies the standard HR process now would require to discard the details after the interviews.
- detaro 5y ago
  At least in Germany it seems storing records for up to 6 months is common, since that's when the deadlines for suing under discrimination law expire and an employer has a legitimate interest in being able to produce detailed documentation about their decision process to defend against such lawsuits. But that's again a very specific thing that justifies it.
M2Ys4U 5y ago
This has been the case since long before the GDPR. The ability to make subject access requests was in the Data Protection Directive which was passed in 1995.

icedchai 5y ago

I would just say it has been deleted, so no data is available. Why waste your time with a response?

atoav 5y ago
Because sometimes people who send you such a request might actually already know parts of the data you have on them. Telling them there is _no_ data shows them that you are either untrustworthy or utterly incompetent. If they are the wrong type of person they might come with a lawyer next.
- icedchai 5y ago
  I’m saying I had no data ever, I’m saying I have none now. Unless you have big bucks GDPR is toothless for stuff like this. I firmly believe data about interviews is private, to the company.
  - atoav 5y ago
    Are you sure you have none now? This could be very expensive : )
    - icedchai 5y ago
      How is someone going to figure out if I actually do, if none of the data is externally accessible?
  - multjoy 5y ago
    Why do you need big bucks? You make a complaint to the regulator and then they do the heavy lifting on your behalf.
    - icedchai 5y ago
      I'm sure it's that simple. You'll need big bucks to get a lawyer and prepare a compliant. The regulator will have bigger fish to fry. One or two people whining about "their" interview data is laughable. Your little complaint will land on the bottom of the stack, where it will stay, forever.