In principle, personal data of applicants must be deleted as soon as the purpose of their collection has been achieved. If an applicant is rejected, this is immediate. This results from § 26 para. 1 BDSG (German Federal Data Protection Act).

However, it is possible that applicants file claims for discrimination under the German General Equal Treatment Act (AGG), for which the application data is required. The supervisory authorities therefore accept it if the data is only deleted or returned six months after the application has been rejected.

If the application is successful, the application may be stored for the purposes of the employment relationship.

If the company rejects the applicant but would like to include the applicant data in an applicant pool, the applicant’s voluntary consent is required. This is only effective if the company provides information about the applicant’s identity, the types of data and the purpose of the processing. In addition, information must be provided that consent can be withdrawn at any time. Consent must be actively given and acceptance of the application must not be linked to it.

If you use non-European software to process applicant data, use AI or use non-European video conferencing systems, remember to check this under data protection law before using it.

^********

Disclaimer:

This article should not be construed as legal, financial, or business advice. The information does not represent the views of smarti. Neither smarti nor its guest contributors assume liability for the accuracy, comprehensiveness, or timeliness of the information provided. We strongly recommend seeking professional advice before making business decisions.