Legal FAQs – Candidate Data

Can a client ask you to pass on candidate information as part of their annual audit?

In order to pass the data of any individuals over to the client, you would first need to identify and understand the reasons behind why the client was requesting this data and the purpose for which they were going to use it. This is important as you would need to have the fully informed consent of the candidates to pass their data over to the client. Under the General Data Protection Regulation (GDPR), in order for consent to be valid it needs to be freely given; specific; informed and unambiguous. This means the candidate needs to be fully aware as to how and why their data is being used for in this case to be able to give consent for this specific usage.

Further to this, regulation 28 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 states that an employment agency or employment business may not “disclose information relating to a work-seeker, without the prior consent of that work-seeker” unless the purpose of doing so is to provide a work finding service for the work-seeker; for the purpose of any legal proceedings; or the information is being provided to a professional body of which the candidate is a member. As a request for information for an audit is not covered by these exceptions then the employment business will need to obtain consent before sharing any information.

Where you are aware that one or more of your clients have an audit process of this nature in place then you should also include this information in your privacy policy on your website. You should also make any candidates you submit to this client aware of the audit process so they are aware that this may affect them and their data in the future.

This article was posted by Patrick Milnes, Legal Adviser, REC