Two retention periods set for personal data of job applicants
Just a few months following the promulgation of the long-awaited amendments to the Bulgarian Personal Data Protection Act (the “PDPA”) some of its provisions that deviate from the rules of the General Data Protection Regulation begun to cause problems in implementation.
The latest example appears to be the provisions that mandate employers to delete or destroy personal data of unsuccessful candidates upon expiration of six months following the termination of the recruitment process. This retention period however does cover the three-year limitation period under the Protection against Discrimination Act during which an unsatisfied job applicant may raise claims for discrimination during his recruitment.
The logical question of the business then came to be: how does an employer prove that a candidate was not discriminated and that the employer has chosen an employee in a fair manner if all personal data of the unsuccessful candidate have been deleted in due terms as required by the PDPA?
In one of its latest statements (available in the Bulgarian language here), the Bulgarian Commission for Personal Data Protection provided employers with an interpretation that balances between the requirements of the two legal acts. The position of the regulator is that:
- The documents initially provided by the job applicant, when containing personal data, have to be destroyed within six months following the end of the recruitment as set by the PDPA. This means that the short retention period will apply for the keeping of CVs, cover letters, recommendations, documents that certify educational background and work experience when provided by the applicants;
- The documents created by employers on the basis of the initially provided documents will be retained for a period of three years. Such documents include minutes of interviews during the recruitment process, internal communication on the employment of a candidate, tests and evaluations. Those documents will be potentially used by the employer to prove that it has not breached the antidiscrimination rules during the recruitment process.
The suggested approach may be acceptable to employers, but it indicates the lack of consistency in the approach of the Bulgarian legislator when applying the rules on personal data protection. Applicants’ data to be retained in the documents created by the employer will in their essence mirror the data in the initially provided documents. This will therefore lead to a situation where employers in their capacity of data controllers will have to invest resources in destroying data which they will practically and lawfully continue to process in another form.
Yet, employers will be satisfied to know that the protection of their legitimate interests in potential discrimination claims by unsuccessful job applicants will be safeguarded and this will not lead to breaches of the personal data protection rules.
For further information contact:
This article has an informative purpose and is not representative of detailed legal advice. If you are interested in receiving advice in the context of a certain situation, we can happily assist you. The law firm is not responsible for any harm caused by acts or omissions undertaken due to this text.