Denmark: Datatilsynet issues decision finding Carlsberg's processing of recruitment data to be GDPR compliant
The Danish data protection authority ('Datatilsynet') announced, on 2 June 2020, that it had issued, on 25 May 2020, its decision ('the Decision') finding that Carlsberg Danmark A/S's processing of personal data in connection with recruitment is compliant with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') following an audit of the same. In particular, the Decision highlights that the audit focused on Carlsberg's retention and deletion of personal data of unsuccessful applicants collected in connection with recruitment for employment. Furthermore, the Decision notes that Carlsberg processed information about applicants to ensure documentation of proper recruitment procedures in the event of any complaints about, for example, discrimination, which was processed with a legitimate interest under Article 6(1)(f) of the GDPR.
In addition, the Decision notes that Carlsberg processed information about applicants for information on future job opportunities in the company, which was processed on the basis of consent. Moreover, the Decision highlights that in both cases, the Datatilsynet found Carlsberg's legal bases for processing to be compliant with the GDPR. Furthermore, the Decision outlines that job applicants have the opportunity to delete their own applicant profile from the recruitment website, and if the applicant does not delete their applicant profile themselves, it will be automatically deleted after six months. In addition, the Decision highlights that Carlsberg had documented this through an anonymous deletion log, written down procedures, statements and similar documentation regarding deletion of information about applicants. The Datatilsynet considered Carlsberg's retention and deletion of applicant information to be done in accordance with Articles 5(1)(e) and 5(2) of the GDPR.