IF THERE IS SOMEONE INTERESTED IN HIRING WITH ME, DO I NEED HIS CONSENT TO BE ABLE TO TREAT HIS PERSONAL DATA IN ANY CASE?

12 Nov IF THERE IS SOMEONE INTERESTED IN HIRING WITH ME, DO I NEED HIS CONSENT TO BE ABLE TO TREAT HIS PERSONAL DATA IN ANY CASE?

The answer is no. This is because Article 7 (b) of the GDPR, says clearly that you have a legal basis (or sufficient justification for the treatment of other’s personal data) in situations where “treatment is necessary for the execution of a contract in which the person concerned is a party or for the application of pre-contractual measures adopted at the request of the person concerned. ‘

In other situations, you do not need the express consent of the person concerned. Not bad! Isn’t it?

But… what are the cases in which a personal data of the person interested, that you have or treat, is “necessary” for the contract?

According to group 29 (which has now become………..) There would be two different scenarios:

1.In the first place, situations in which treatment is necessary for the execution of a contract in which the person concerned is a party. This could include, for example, the treatment of the address of the person concerned, so that the goods acquired online can be delivered, or the processing of the data of the credit card in order to make a payment. In the labour context, this legal basis may, for example, permit the processing of wage information and bank account data so that the salary can be paid.

Now, put the brake on and don’t rush, as this provision must be interpreted strictly: and it is necessary to exclude the situations in which the treatment is not really required for the execution of a contract, but unilaterally imposed on the interested on the part of the person responsible for the treatment. Moreover, the fact that the treatment of some data is covered by a contract does not automatically mean that the treatment is necessary for its execution. For example, it would not be an appropriate legal basis to develop a profile of the user’s lifestyle preferences and options, based on his tour on a website and the purchased articles. This is because the data Processing manager has not been hired to produce profiles, but to deliver goods and provide specific services, for example. Even if these treatment activities are specifically mentioned in the small print of the contract, this fact alone does not make them “necessary” for the execution of the contract.

But what is thisss? Even when I put it in the contract I can’t deal with data that I think is necessary?

Well, stop for a moment and fine-tune your eyesight man (yes, what times these…) here is not what it “seems” necessary to you but there is a clear relationship between the valuation of the need and compliance with the principle of limiting the purpose. In other words, it is important to determine the exact justification of the contract, that is, its essence and fundamental objective, since the evaluation to verify if the data processing is necessary for its execution will be carried out according to this information.

In some dubious situations it may be debatable, or more specific inquiry may be required in order to determine whether treatment is necessary for the execution of the contract. For example, the creation of an internal database of Contact details of employees of a company that contains the name, labor address, telephone number and email address of all employees, to allow employees to contact their co-workers, can in certain situations to be considered as necessary for the execution of a contract under article 7 (b)), but may also be lawful under article 7 (f), if it is demonstrated that the interest of the person responsible for the treatment is prevalent and taken All appropriate measures, including, for example, consultation of employees ‘ representatives.

Other cases, for example, the electronic supervision of the use of the telephone, the e-mail and the Internet by the employees, or the video surveillance of the employees, constitute more clearly a type of treatment that is likely to exceed what is necessary for the execution of a contract of employment, although this may also depend on the nature of the job.

In short, do not fool yourself and think that the situation we are talking about only applies to what is necessary for the execution of a contract. It does not apply to other actions triggered by non-compliance or other incidents occurring in the execution of a contract.

But hey, let’s not pout as you have other legal bases or perfectly legal justifications for the processing of data from those with whom you have been hired even without having the consent of them, as is the Legitimate interest.

What is that?, in short, the one for example you have as part of a contract, if, for reasons of the development of the same and not initially envisaged, you defend your stakes in play and must use any additional data. (I think for example the context of a breach and the inquiry of contact data of the default, ways of location or whereabouts, property situation, etc.)

2. Secondly, article 7 (b)) also covers the treatment that takes place for the application of pre-contractual measures. This covers pre-contractual relations, provided that the measures are taken at the request of the person concerned, and not on the initiative of the person responsible for the treatment or a third party. For example, if an individual requests a retailer to send him an offer of a product, the treatment for these purposes, such as maintaining the address data and the information on which the application was made, for a limited period of time , will be appropriate under this legal basis. Similarly, if an individual requests a budget from the insurance company of his/her car, there is a need to process the necessary data, for example, the model and the antiquity of the vehicle, and other relevant and provided data, in order to prepare the budget.

However, detailed background checks, for example, the processing of medical recognition data before the insurance undertaking offers life insurance or health care to an applicant would not be considered as measures adopted at the request of the person concerned. Verifications of credit references prior to the granting of a loan are not made at the request of the person concerned under article 7 (b), but by virtue of article 7 (f)), or of its letter (c), in compliance with the legal obligation of the banks to request an official list of registered debtors.

Prospecting at the initiative of the retailer or the person responsible for treatment will not be possible on the basis of this legal basis. In some cases, article 7 (f)) could provide an adequate legal basis instead of subparagraph (b)), subject to the appropriate guarantees and measures and to the test of weighing. In other cases, including those involving generalized profiling, shared information, online prospecting or behavior-based advertising, consent shall be considered under article 7 (a).