Lawyer Monthly Magazine - July 2019 Edition

candidate (such as data contained in CVs, referred to in interviews, self-declarations), by certifications of the Public Administration, but also by third parties (think of a request made to the previous employer) and, finally, as it is increasingly happening, through the Internet and Social Media. The main issues - in the collection and in the use of these reports - are given by the fact that all the information regarding the candidate, as such, are personal data: consequently, they shall be processed in accordance with and within the limits of the discipline of Regulation (EU) 679/2016, the GDPR. Moreover, as far as Italy is concerned, the use of this information is further limited by labour law rules, which, since the 1970s, have reduced the possibility of investigating about an employee for the sake of privacy and to avoid discriminatory behaviour by the employer. So, in essence, is it legitimate to process this personal data? To what extent? In general, the answer is yes: you can do background checks on a candidate. However, limits are imposed by both data protection and labour law rules. First of all, the processing shall comply with the provisions EMPLOYMENT LAW Is using social media a lawful way to check your employee’s history? of the GDPR and, most importantly, with its principles, especially the principles of minimization, accuracy and purpose limitation. Except as explained below, background checks are “simple” personal data which, following adequate information, may be lawfully processed on the basis of one of the legal bases set out in Article 6, paragraph 1 of the GDPR. This means that once the candidate has been informed of the scope of thebackground check (and, therefore, of what personal data will be processed and from which source they will be obtained), the processing of this data will be lawful to the extent that the employer is able to justify - in accordance with the principle of accountability - what makes the data processing necessary (whether the conclusion of the contract or a legitimate interest). It is not advisable to process such personal data on the basis of the candidate’s sheer consent, since on the one hand, the consent can be revoked, and, on the other hand, opinion # 2/2017 of WP29 expressed serious concerns about the genuineness of the consent given in the context of the employment relationship (given that the possibility of suffering repercussions would hardly allow the worker to What are the background checks? What issues can arise, relative to the use of this information? Background checks are usually made at the pre- recruitment stage and are aimed at identifying elements of the candidate’s personal history that may indicate a risk in relation to the future employment relationship. The checks that HR usually require to be carried out relate to the candidate’s previous work experience, former employers’ references, school or academic certificates, credit exposure, residences and transfers, pending loads, and court records. Data of this kind can be acquired directly by the Ever more often companies ask us what actions can be lawfully taken to check the personal history of candidates and whether they can draw on information on the Internet or on social networks. In Italy, the issue is very complex: in fact, we need to find a link between European regulations, national ones, and the provisions that the social partners have included in collective agreements. A possible solution roots back in the 1970s, i.e., in Article 8 of Law 300/1970: the processing of personal data prior to recruitment is legitimate, in so far as it is relevant for assessing the candidate’s professional aptitude. 62 Professional Excellence www. lawyer-monthly .com JUL 2019