Right to see other job applicants' details - Legal Q & A

On 12 January 2009 the Information Commissioner’s Office handed down a decision regarding a complaint by an employee of Leicester City Council.

The individual in question had unsuccessfully applied for two internal vacancies at the council and, following his applications, he requested information regarding the recruitment process the council had undertaken, including being provided with copies of the other applicants’ application forms, with any identifying information removed.

The council refused to comply with the request, relying on Section 40 (2) of the Freedom of Information Act 2000 (FIA), which exempts from disclosure personal data of which the applicant is not the data subject.

The decision of the Information Commissioner’s Office is that while the exemption upon which the council attempted to rely applied regarding certain of the information contained on the form, it was not sufficient to justify withholding the information in its entirety.

While the FIA relates to information held by public authorities, the decision in this case has wider reaching implications for employers because of the subject matter at the heart of the decision. How should employers consider the decision in light of their own recruitment processes?

Q What sort of employers does this ruling affect?

A The ruling will have an impact on all employers. While the FIA only affects public bodies, the judgment, by the same body responsible for decisions and complaints concerning the Data Protection Act 1998 (DPA), acts as a timely reminder to all employers of their obligations to employees and applicants because the findings of the judgment may be considered in light of all employers, particularly with regards to the references throughout to the FIA. These obligations start from the recruitment process with regards to job advertisements through to the handling and storage of application letters, forms and curriculum vitae. Information should only be sought that is relevant to the recruitment process.

Employers should always bear in mind that employees, or potential employees are entitled to request access to any personal data the employer collects, processes or stores about them. This judgment now extends that right, where the employer is a public body, to reviewing certain data about competitors in the recruitment process.

Q How should an employer respond to a request?

A Any request for access should be dealt with in accordance with the DPA or the FIA as appropriate. Employers have a legal duty under the data protection laws to protect the identity of other candidates and the FIA recognises the requirements of the DPA by providing certain exemptions to disclosure. As such, any response to a subject access request must be carefully drafted to ensure that any personal details are removed, and that it is not possible for the requesting applicant to be able to identify the other candidates.

Q What details would employers have to provide?

A Under the FIA, employers would be required to respond to the request by confirming whether they hold the information requested and if so then providing the information desired. Under the DPA, employers are required to provide data they hold about the employee in question. Currently this does not extend to the other applicants a job applicant is competing against or existing employees, so the scope for employees seeking to establish whether a fair recruitment process has been undertaken is more limited for private employers who are not subject to the FIA. Any employer would however be required to provide details of scoring in interviews, interview notes, scoring of criteria on application forms and qualifications, and by so doing would also enable the employee to establish whether their data is properly processed in accordance with the DPA.

Q What details should employers refuse to divulge?

A Employers must refuse to divulge information that will identify other applicants. In the case in question, the council objected to the application on the grounds that to provide the information requested would breach the other applicant’s rights under the DPA, and it is here that this judgment is of great interest. The Information Commissioner established that as long as the information was of a general nature and likely to be similar to a job specification, it would not cause unwarranted prejudice or interference of the applicant’s rights, freedoms and legitimate interests.

Q Do employers have a duty to inform applicants that other applicants have asked to see their details?

A Because the data being requested by employees is likely to be covered by the DPA, even where a request is being made under the FIA, employers need to be careful in their response to requests. This is because of the difference between the initial purpose for processing the applicant’s data (to assess their suitability for the job) and the secondary purpose for which the data would be processed (disclosure to another applicant). The subject of the data will have been notified of the first purpose but not the second. For example, if during the recruitment process an employer accepted applications from internal candidates, they would hold significantly more data on those individuals than on the external applicants. The internal candidate should have had their rights regarding the DPA set out in their employment contract, and may not be aware that such data could – if an application was made under the FIA – be disclosed to an interested, unsuccessful, external applicant.

Employers should, therefore, make all applicants, internal and external, aware that certain anonymised data may be passed to other candidates if the request is made as part of the recruitment process. Employers must also ensure that internal and external candidates are treated exactly the same with regards to the data stored, and potentially disclosed, as part of any such process.

Q How should employers amend their existing policies to ensure they avoid pitfalls this decision creates?

A This decision should have little effect on the existing policies of employers with regards to the way they store, process and collect data with regards to their current employees. Changes are likely to be required, however, when considering the recruitment process, and employers are advised to ensure that any recruitment advertisement clearly states how the employer intends to process personal data which it collects as part of the recruitment process.

Jane Anderson is an assistant solicitor at Matthew, Arnold & Baldwin

Information Commissioner’s ruling could open doors to claims from failed job candidates