2019/5 For how long may data of a job applicant be stored? (AT)

The Austrian Data Protection Authority (DPA) has confirmed that the personal data of a rejected job applicant may be stored by the (potential) employer for a period of seven months after they have been transferred by the applicant in order to defend the employer against possible discrimination claims by them. However, after this period the applicant data must be erased.

Summary

Legal background

According to the Austrian Equal Treatment Act (Gleichbehandlungsgesetz) a job applicant is entitled to seek compensation for actual loss and compensation for the personal detriment suffered if the employment relationship has not been established because of discrimination on the grounds of sex, ethnic origin, religion or belief, age or sexual orientation (Section 12 and Section 26). However, the discriminated job applicant must file a complaint at the labour court within six months after he/she has been rejected by the employer since otherwise the claim is forfeited (Section 15 and Section 29).

Facts

On 17 May 2018 the complainant applied for a job at the respondent’s business. For the purpose of processing the application the complainant’s data (personal data according to the General Data Protection Regulation (GDPR)) were stored in the candidate database of the respondent.
On 31 May 2018 the applicant requested the erasure of his stored personal data. The respondent replied that the data will no longer be considered for the vacant position, but refused to erase them. Instead they pointed out that the data would be stored for a period of seven months after the date of the application in view of potential litigation in relation to the Equal Treatment Act. The applicant then filed a complaint at the DPA arguing that his right to have his personal data erased had been infringed.

Judgment

After having laid out the relevant statutory provisions of Article 17 of the GDPR and the Equal Treatment Act the DPA examined the lawfulness of the further storage of the applicant data under Article 17(3)(e) of the GDPR. Under this provision the controller may refuse to erase the personal data if their processing is necessary “for the establishment, exercise or defence of legal claims”. The DPA pointed out that in such a case the controller must explain in detail what kind of legal proceedings could follow and why the personal data are relevant in this context.
These requirements have been satisfied in the case at hand. The DPA pointed out that the respondent had designated a specific claim (pursuant to Section 26 of the Equal Treatment Act) that could be asserted against the respondent within a specific period of time (six months). The addition of one month allowing for the notification of a suit seemed appropriate and not unreasonably long. Further, the controller had communicated clearly to the complainant the time when his personal data would be erased (seven months after they have been transferred by the applicant). Finally, the applicant had been informed that his personal data would no longer be used to fill the respective vacancies. As a result the application was dismissed.

Commentary

In Austria, the issue of erasing applicant data has become important for HR departments and some job applicants after the entry into force of the GDPR on 25 May 2018. In this context the key question is the maximum period of storage allowed in order to be compliant with data protection law.
The confirmation by the DPA that employers are entitled to store applicant data for the purpose of defending themselves in a potential discrimination claim is most welcome. Also it is important to point out that the statutory time limit for bringing an appeal may be exceeded by one month to allow for the notification of the suit to the employer by the court.
In practice, however, such litigation is only realistic after a job applicant has been rejected. From the facts being reported in the published decision it seemed that the applicant withdrew his application before a decision was taken by the employer. In such a situation there is no room for a discrimination claim. Consequently, Section 15 and Section 29 of the Equal Treatment Act stipulate that legal claims are to be raised within six months after the applicant´s rejection. Therefore, if the facts are as they seem in our view the employer could not have relied on Article 17(3)(e) of the GDPR in order to refuse the erasure.

Comments from other jurisdictions

Germany (Ines Gutt, Luther Rechtsanwaltgeschellschaft mbH): In Germany, the legal situation is probably similar to that in Austria. The storage of personal data of applicants by the employer may become impermissible after conclusion of the application procedure. In this regard, § 26 BDSG (Bundesdatenschutzgesetz) regulates the use of personal data for the purpose of the employment relationship. That statutory provision implements the requirements of Article 88 DSGVO (Datenschutzgrundverordnung) – which is a regulation of the EU – and is therefore the relevant national provision. § 26 (8) gives applicants equal status to employees.
According to this, the personal data of applicants may only be used in the application procedure until the relevant time of decision on hiring. In general, the data processing is allowed to happen until it is assured that no further litigation is to be expected. In this regard, an appeal on the basis of § 15 AGG (Allgemeines Gleichbehandlungsgesetz) comes into consideration, which is intended to protect against discrimination in the same manner as the Austrian Equal Treatment Act. The Bavarian State Office for Data Protection Supervision therefore deems a period of six months after receipt of the rejection for the storage of the personal data of the applicants to be appropriate.
In this respect, the Bavarian State Office for Data Protection has established a general directive which should be followed. That means: no matter how long the time limit for the assertion of this claim (§ 15 AGG) is, the personal data must be deleted or returned to the applicant in any case after expiry of the time period proposed by the Bavarian State Office for Data Protection. It should be noted that even though § 15 (4) AGG only provides a period of two months for the assertion of a claim, against the background of possible other complaints a period of six months is also appropriate here. A longer storage of the personal data is only allowed with the agreement of the applicant.
However, with regard to the practical reference, the situation in Germany is different from that in Austria. Basically, § 15 (4) AGG also ties in with the rejection of the applicant. However also if the applicant has actually voluntarily withdrawn his application, there can be a lawsuit on the grounds of § 15 AGG. It is conceivable that the applicant has already been discriminated before withdrawing his application. In this case, the storage of personal data for up to six months is also reasonable and appropriate.

Germany (Othmar K. Traber, Ahlers & Vogel Rechtsanwälte PartG mbB): In Germany, the same question occurred without neither the Federal Commissioner for Data Protection nor the several federal state authorities having made a clarifying statement on this subject yet. German Labour law experts, too, consider the possibility of a discrimination claim to be a permissible condition for the storage of personal data after a rejection of the applicant. However, in deviation from the Austrian legal situation, it applies for six rather than seven months only, since in Germany such a claim must already be filed within five rather than six months in a two-stage procedure after the rejection pursuant to Section 15 (4) of the Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz) in connection with Section 61b of the Labour Courts Act (Arbeitsgerichtsgesetz). The addition of one month allowing for the notification of a lawsuit is likewise presumed. This approach is fortunately confirmed by the present decision of the DPA which could serve as a kind of blueprint for other data protection authorities in the member states now.

Latvia (Andis Burkevics, Sorainen): As to the length of storage of data of unsuccessful job applicants, exactly the same rationale for establishing the storage period would apply also in Latvia. The Latvian Association for People Management, which unites HR specialists from different sectors and independent professionals, in April 2018 worked out Guidelines in the field of processing of personnel data (the ‘Guidelines’), which a few months later were reviewed by the Latvian Data Protection Authority (the DPA). In general, the DPA concluded that the content of the guidelines complies with the current understanding regarding achieving compliance with the requirements of the GDPR.
Consequently, according to the Guidelines the data of unsuccessful job applicants can be stored for four months after completion of the personnel selection process. I.e., for three months, which is the limitation period for the job applicant to raise a claim based on violation of the prohibition of differential treatment rule, and for one additional month allowing for the notification of a suit.

Finland (Janne Nurminen, Roschier, Attorneys Ltd): The situation is similar in Finland. However, the period for filing a suit is longer. Under the Non-discrimination Act (1325/2014, as amended) and the Act on Equality between Women and Men (609/1986, as amended), in cases concerning recruitment, the claim for compensation needs to be brought within a year after the discriminated applicant received a notice of the selection decision or the discrimination prohibition was violated. As such, it can be concluded that the employers have the right to store the personal data of the applicant for at least one year, i.e. the period for filing a suit. The employers must have the possibility to defend themselves in potential litigation.

Romania (Andreea Suciu, Suciu I The Employment Law Firm): We welcome the Austrian DPA’s confirmation that the personal data of a rejected job applicant may be stored by the (potential) employer for a period of seven months in order to defend the employer against possible discrimination claims of the applicant. However, taking into consideration that a discrimination claim was – in this case – practically impossible, the DPA’s solution was very brave by giving Art 17 (3) (e) GDPR an extensive interpretation.
On the other hand, a similar interpretation of Art 17 (3) (e) GDPR by the Romanian DPA would have significant consequences on the processing of the job applicant’s personal data, as the statutory period of limitation concerning the period of time in which (rejected) job applicants are entitled to file discrimination claims is three years. Moreover, lawsuits can last up to one and a half years. This would entitle an employer to store the personal data of (rejected) job applicants for a period of up to four and a half years. This interpretation, however, would not come as a surprise in relation to record retention periods for controllers as they mostly rely on a period equal to the applicable statutory period of limitation, due to the lack of express legal provisions related to binding retention periods.

Subject: Privacy, Discrimination, General
Parties: Richard A*** – v – N*** Personaldienstleistungen GmbH
Court: Datenschutzbehörde (Austrian Data Protection Authority)
Date: 27 August 2018
Case Number: DSB-D123.085/003-DSB/2018
Internet Publication: https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20180827_DSB_D123_085_0003_DSB_2018_00/DSBT_20180827_DSB_D123_085_0003_DSB_2018_00.html