August 1st, 2017 | Sterling

Article 29 Working Party Recommends Restrictions on Social Media Screening

As the applicable date of the GDPR is drawing near, there has been a steady stream of recommendations and opinions from The Article 29 Working Party (“WP29”). The WP29 consists of representatives from the data protection authority of each EU Member State, the European Data Protection Supervisor and the European Commission. The main mission of the group is to provide expert advice to the EU states regarding data protection, promote the consistent application of the Data Protection Directive to all EEA member states, and make recommendations to the public on matters relating to the processing of personal data and privacy in the European Community.

Article 29 Working Party Opinion on Data Collecting Via Social Media

The WP29 has issued Opinion 2/2017 on 8 June 2017 on data processing at work which restricts employers viewing a candidate’s social media profile during the recruiting and hiring process. The new opinion directly concerns the background screening process and although applies under the current data protection regime under the Data Protection Directive (Directive 95/46/EC), it will also apply under the GDPR. The opinion assesses the balance between legitimate interests of employers and reasonable privacy expectations of employees. It states: “Employers should not assume that merely because an individual’s social media profile is publicly available, they are then allowed to process those data for their own purposes. A legal ground is required for this processing, such as legitimate interest. In this context the employer should—prior to the inspection of a social media profile—take into account whether the social media profile of the applicant is related to business or private purposes, as this can be an important indication for the legal admissibility of the data inspection. In addition, employers are only allowed to collect and process personal data relating to job applicants to the extent that the collection of those data is necessary and relevant to the performance of the job which is being applied for.”

The Opinion also states that an employer can check social media networks and profiles “only if it is necessary for the job to review information about a candidate on social media, for example in order to be able to assess specific risks regarding candidates for a specific function and the candidates are correctly informed then the employer may have a legal basis under Article 7(f) [of the Data Protection Directive] to review publicly-available information about candidates.” Also, the opinion recommends that there is no legal ground for an employer to require potential employees to “friend” the potential employer, or in other ways provide access to the contents of their profiles.

Social Media Screening Checks

Social media screening is very valuable to recruiters, hiring managers and employers. It is a way for them to see a picture of the person to go along with their CV. It humanizes the candidate and makes them more than just the words on their CV. Social media profiles can be very revealing with both positive and negative content being shared in what is a very public domain. In the UK, a survey by Monster.co.uk and YouGov revealed that 36% of UK employers had rejected a candidate based on their Facebook, Instagram, Twitter or LinkedIn profiles, while more than half of UK HR professionals admit that a candidate’s online reputation can influence their decision to hire them.

Best Practices for Social Media Screening

When searching social media profiles of potential employees, employers often discover information that is helpful in making employment decisions but may also become aware of information that should not be used to make such decisions. Although using social media to make employment decisions might carry some risks, it can also be a valuable tool in hiring good employees and avoiding poor ones. By following a few simple tips, employers can prevent putting their business at risk and be compliant with changes still to come with the GDPR:

• Relevant Information: Hiring decisions should be targeted on finding information relevant to the decision to offer employment and not used for general trawling or “fishing” exercises. Whether social media searches are conducted in the first place must depend on the candidate’s role and the relevance to the position.
• Timing of Social Media Searches: Wait until after the interview to do a social media search. By doing the social media search at this time, a company is less likely to be accused of relying on protected characteristics evident in social media profiles when they are making the hiring decision.
• Leaving the Screening to Professionals: It is a good idea to have someone other than the hiring manager search the candidate’s profiles. HR professionals are more likely to know what information is appropriate for consideration and can inform the decision maker appropriately.
• Social Profile Information: Sensitive personal information, unless absolutely necessary, should not be used as part of the recruitment process. Hiring managers should never use information related to a candidate’s disability, gender reassignment, marital status, race, religious beliefs, sex or sexual orientations when making a hiring decision.
• Compliance with Data Protection and Privacy Laws: Employers must be compliant with the UK Data Protection Act (and eventually the General Data Protection Regulation) as well as the Employment Practices Code. Social media searches will exclude non-user generated content, sensitive personal data and protected characteristics.
• Be Transparent: Transparency is a major component of the GDPR. Candidates must be informed if a social media or other online search is being used to research information that could affect their application. They should be given a chance to respond to and explain the material should it influence the hiring manager’s decision. Hiring decisions should be targeted on finding information relevant to the decision to offer employment.
• Record Retention: Personal data collected during the recruitment process should not be kept for longer than necessary where the individual was not hired. In the UK, the Information Commissioner’s Office recommends that record retention should be six months.

Include Social Media Screening in your Background Screening Policy

Social media screening is becoming more valuable to recruiters, recruitment managers and employers. Steve Smith will be discussing the risks and rewards of social media screening 7 September 2017 at In-House Recruitment LIVE! As social media screening becomes more prevalent in the recruitment process, employers need to develop a clear policy towards the use of social media for recruitment purposes, in consultation with employees or their representatives where this is required under the law. Companies should have a background screening policy in place to help document compliance and the recruitment process. Find out more about the many components of background screening in our infographic, Social Media Screening.

This publication is for informational purposes only and nothing contained in it should be construed as legal advice. We expressly disclaim any warranty or responsibility for damages arising out this information. We encourage you to consult with legal counsel regarding your specific needs. We do not undertake any duty to update previously posted materials.