ICO opens consultation on draft recruitment and employee records guidance

The ICO has recently published two sets of draft guidance on data protection compliance for employers and recruiters. These drafts focus on two key areas: recruitment and data retention practices.

Draft Guidance on Recruitment Practices

The first draft guidance focuses on recruitment and selection processes. The guidance is aimed at employers and businesses which carry out recruitment activities on behalf of employers, such as recruitment agencies, head-hunters or consultancies.  The aim of this guidance is to provide practical advice on how to comply with data protection law when carrying out recruitment exercises. The guidance includes recommendations on how to process candidates' data fairly and lawfully and how to use automated decision making and profiling. It also covers security and data sharing requirements, and compliance with employee's rights as data subjects. The ICO also intends to produce additional practical tools, such as checklists, to support employment practices.

Draft Guidance on Keeping Employment Records

The second draft guidance is about keeping employment records. This guidance aims to provide practical advice on how to comply with data protection law when keeping records about workers.  This guidance includes recommendations in relation to the types of data held by employers, selecting an appropriate lawful basis for retention purposes, working with employee consent, managing data retention periods and keeping all data accurate and up-to-date. The ICO also plans to produce additional practical tools, such as checklists, to support employment practices.

Public Consultation

The ICO has announced that these draft guidelines are subject to public consultation until 5pm on 5 March 2024. This consultation process is an opportunity for organisations to provide feedback on the draft guidance and impact assessment summary. The ICO invites feedback from the public via a series of questions set out in the consultation. 

Our views

The ICO's initiative to open a consultation on these draft guidance pieces is a significant step towards ensuring data protection compliance in the workplace. By focusing on recruitment and data retention practices, the ICO is addressing two critical areas where data protection issues often arise particularly due to the handling of sensitive personal data. The public consultation process provides an opportunity for stakeholders to contribute to the development of these guidelines, ensuring they are practical, relevant, and effective. In our view, clearer guidance can help employers and recruiters understand their responsibilities and adopt best practices to comply with data protection laws. This not only safeguards the rights of individuals but also enhances the reputation of organizations as trustworthy custodians of personal data. Remember, these are draft guidelines and are subject to change based on feedback and further consultation. As the public consultation process continues until 5 March 2024, it will be interesting to see how the feedback received will shape the final versions of these guidelines.

Read the other topical articles from our Winter Data Protection Update:

• AI News: EU reaches landmark agreement on Artificial Intelligence Act
• Information Commissioner’s Office launches consultation on Generative AI
• EDPB Rules Meta’s Advertising Practices Unlawful
• European Commission publishes first review of pre-GDPR EU adequacy decisions