No photos and marital status information – what personal data can potential employers collect from job applicants?


Potential employers may collect personal data of job applicants only to the extent that this data is absolutely necessary for the normal selection procedure. Job applicants may not be required to provide information that is excessive in nature and volume. This rule is confirmed by the Commission for Personal Data Protection (the “Commission”) in its “Job Application Tips” available here.

The approach adopted by the Commission is based on the so-called “data minimization principle” set out in the General Data Protection Regulation. In practice, this principle requires the collection of data that is necessary to achieve the specific goal.

Accordingly, the Commission provides non-exhaustive examples of how potential employers should apply the principle, specifying which data can be collected in the staff selection procedure. These are the job applicant’s identification data (name, surname, date of birth) and his/her contact details (address, telephone number and e-mail).

Information about education, skills, professional experience (acquired qualification degrees, participation in trainings and courses, previous employers, job positions and job descriptions) can be collected as well.

Of course, the potential employer has the right to process all data that have been provided to him voluntarily at the discretion of the job applicant – for example, data on professional social networks or a photo provided at the initiative of the job applicant.

However, the Commission explicitly recalls that the potential employer is not entitled to request photos, personal identification number, bank details of the job applicant. It is also forbidden to collect copies of ID cards, passports and driving licenses. Some of these data can be collected by potential employers at a later stage only if the job applicant successfully passes the selection procedure and enters into an employment contract. For example, at the stage of a concluded contract it will be absolutely necessary for the employee to provide his/her bank account details so that his/her labour remuneration be paid. In certain cases, it may be necessary to collect copies of driving licenses if the position so requires.

In the list with data that a potential employer shall not collect, the Commission recalls that the list also includes data on marital status, children and children’s plans, sexual orientation, current remuneration, religious views, beliefs, political affiliations, and other similar data of the candidate. The purpose of the restriction is the decision for selection of the right job applicant to be based solely on the personal and professional qualities of the employee to perform the job and not on circumstances irrelevant to the job.

The Commission also recalls the main obligations of potential employer in the job applicants’ personal data processing – to ensure transparency regarding the processing of data (by providing information), as well as to delete the data of unsuccessful job applicants after 6 months following the end of the selection procedure. This deadline may not apply if the job applicant agrees to be included in a database of potential job applicants for future vacancies with the employer.

For more information, please refer to:

Ilya Komarevski, Attorney-at-law, Partner

Mileslava Bogdanova-Misheva, Attorney-at-law, Senior Associate