3 ms·

> The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. To phrase it bluntly, a company need

by detaro 5y ago

> The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. To phrase it bluntly, a company needs to consider what laws apply to it before it forms such expectations. I'm sure some company also compiled databases of addresses for advertising purposes to based on the expectation that their internal data is kept proprietary, also doesn't work like that. Also note that an obvious solution to having to disclose data is not having it. Plenty places will have you re-interview if you re-apply anyways, so justifying why they keep detailed interview notes around is an interesting question, assuming this request comes after the process has ended. > (produced by employees who expected to remain semi-anonymous to provide candid feedback). Employees don't just expect that, they have a legal right to it. "my personal data" does not include "who did interview me", and the company has to protect the personal details of its employees. (presumably why the reddit OP mentioned data being redacted)

dekhn 5y ago
I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. Just being able to read interview feedback is enough to recognize who wrote it.
- detaro 5y ago
  But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around... GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.
- handoflixue 5y ago
  > Just being able to read interview feedback is enough to recognize who wrote it. While that might be true internally, I think it's pretty unlikely that a candidate had enough of a sense of each person's writing style (especially if the interview was conducted via voice, as is typical) > So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. The GDPR was passed in 2016. I feel like 5+ years is plenty of time to re-adjust expectations.
  - dekhn 5y ago
    At this time, I believe that the law (either GDPR or CCPA) itself does not require companies to disclose confidential interview notes. Certainly when I worked at Google during GDPR they reorganized massive amounts of data storage to comply with that, but I don't recall anybody doing hiring saying GDPR applied. From I can tell a random throwaway made this post on reddit, it may have happened, but it doesn't mean that companies are required to do this. I would like to see more supporting data.
    - x0x0 5y ago
      GDPR very explicitly applies; see eg ICO (the UK DPA) guidance, or this: https://www.dickinson-wright.com/news-alerts/the-gdpr-covers-employee-hr-data-and-tricky https://www.dickinson-wright.com/news-alerts/the-gdpr-covers... As I mentioned above, CA privacy laws exclude this information.
      - deleted 5y ago
        [deleted]
      - dekhn 5y ago
        That's for employee, not applicant data, though.
    - detaro 5y ago
      ok, in my comments I glossed over the fact that you specifically argued about the interview notes a bit, which maybe are not as clear as other data points. But that on the other hand that applicant data is personal data that falls under GDPR and that applicants can request their data is quite obvious, and that notes contain "personal data" about a person is also established, so you'd really need a specific argument why they don't fall under the access request requirement. At least in the German case law I've seen, it's by now established that internal notes etc about a person also count specifically for the data access request - a prominent case was someone suing their insurance company for all internal records.
- M2Ys4U 5y ago
  > I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
alisonkisk 5y ago

by detaro 5y ago

dekhn 5y ago

I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. Just being able to read interview feedback is enough to recognize who wrote it.

detaro 5y ago
But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around... GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.
handoflixue 5y ago
> Just being able to read interview feedback is enough to recognize who wrote it. While that might be true internally, I think it's pretty unlikely that a candidate had enough of a sense of each person's writing style (especially if the interview was conducted via voice, as is typical) > So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved. The GDPR was passed in 2016. I feel like 5+ years is plenty of time to re-adjust expectations.
- dekhn 5y ago
  At this time, I believe that the law (either GDPR or CCPA) itself does not require companies to disclose confidential interview notes. Certainly when I worked at Google during GDPR they reorganized massive amounts of data storage to comply with that, but I don't recall anybody doing hiring saying GDPR applied. From I can tell a random throwaway made this post on reddit, it may have happened, but it doesn't mean that companies are required to do this. I would like to see more supporting data.
  - x0x0 5y ago
    GDPR very explicitly applies; see eg ICO (the UK DPA) guidance, or this: https://www.dickinson-wright.com/news-alerts/the-gdpr-covers-employee-hr-data-and-tricky https://www.dickinson-wright.com/news-alerts/the-gdpr-covers... As I mentioned above, CA privacy laws exclude this information.
    - deleted 5y ago
      [deleted]
    - dekhn 5y ago
      That's for employee, not applicant data, though.
  - detaro 5y ago
    ok, in my comments I glossed over the fact that you specifically argued about the interview notes a bit, which maybe are not as clear as other data points. But that on the other hand that applicant data is personal data that falls under GDPR and that applicants can request their data is quite obvious, and that notes contain "personal data" about a person is also established, so you'd really need a specific argument why they don't fall under the access request requirement. At least in the German case law I've seen, it's by now established that internal notes etc about a person also count specifically for the data access request - a prominent case was someone suing their insurance company for all internal records.
M2Ys4U 5y ago
> I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

alisonkisk 5y ago