The HR industry processes a lot of relevant and sometimes sensitive personal data of employees and candidates. These include information on education and work experience, salary and performance appraisals, health status and, not infrequently, data on family members.

A major challenge in the context of RODO can sometimes be reconciling the interests of the employer with the restrictive data processing regulations for candidates and employees, who are the weaker party in this relationship. In addition, HR companies often use external parties such as IT tool providers to store employee data, benefit providers and providers of monitoring tools such as company cars. This increases the risk of a disorderly entrustment of data processing.

As the ODO 24 team, we have implemented RODO in specialised HR companies. We have dealt with both recruitment and employment-related processes (e.g. in employment agencies). We also have experience in supporting clients for whom HR is not a key business area.

What issues have we been dealing with?

We have regulated the reading of attendance based on data from an app on an employee's phone confirming their presence on the premises. We have also increasingly set rules for the use of AI bots in recruitment. In such projects, we analysed whether there could be so-called automated decision-making towards candidates. We evaluated the integration of employer systems with government systems, such as CEPiK. We verified the possibility of supporting foreign candidates in completing formalities, e.g. when applying for an electronic residence card. We examined the admissibility of the processing of criminal record data. We verified the requirements related to the admission of posted workers. We streamlined data flows between group companies that act as temporary work agencies. We regulated the processing of data from GPS devices installed in company cars - not only location data, but also driving style data. We helped implement the so-called outplacement process for departing employees. We reviewed the scope of services provided by recruitment agencies, which often act as processors, but sometimes process data to an unacceptable extent or go beyond their role. We analysed instances of permissible background checks on candidates, including keeping so-called blacklists and retaining recruitment notes. At some of our clients - groups of companies - one of the tasks was to sort out the transfer of candidate data between companies.

Whether we are working for a company specialising in HR services or for an organisation where HR is not a key business area, we regularly face the need to implement effective data deletion procedures. On more than one occasion, we have regulated the sourcing of candidate data from portals such as LinkedIn and the rules for contacting candidates. We have sorted out the provisions of contracts concluded between temporary employment agencies and user employers. We have also dealt with audits of temporary employment agencies conducted by user employers or by their contractors. This issue arises not only in relations with temporary employment agencies, but also in relation to other actors in the supply chain. Our work has led to compliance in a variety of areas - not only those identified above - and to the elimination of the associated risks.

We serve or have served, among others. Verita HR, DSA, Human IT Group, SNW, HRK oraz Trenkwalder.