Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Denmark: Datatilsynet issues decision finding Carlsberg's processing of recruitment data to be GDPR compliant

The Danish data protection authority ('Datatilsynet') announced, on 2 June 2020, that it had issued, on 25 May 2020, its decision ('the Decision') finding that Carlsberg Danmark A/S's  processing of personal data in connection with recruitment is compliant with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') following an audit of the same. In particular, the Decision highlights that the audit focused on Carlsberg's retention and deletion of personal data of unsuccessful applicants collected in connection with recruitment for employment. Furthermore, the Decision notes that Carlsberg processed information about applicants to ensure documentation of proper recruitment procedures in the event of any complaints about, for example, discrimination, which was processed with a legitimate interest under Article 6(1)(f) of the GDPR.

In addition, the Decision notes that Carlsberg processed information about applicants for information on future job opportunities in the company, which was processed on the basis of consent. Moreover, the Decision highlights that in both cases, the Datatilsynet found Carlsberg's legal bases for processing to be compliant with the GDPR. Furthermore, the Decision outlines that job applicants have the opportunity to delete their own applicant profile from the recruitment website, and if the applicant does not delete their applicant profile themselves, it will be automatically deleted after six months. In addition, the Decision highlights that Carlsberg had documented this through an anonymous deletion log, written down procedures, statements and similar documentation regarding deletion of information about applicants. The Datatilsynet considered Carlsberg's retention and deletion of applicant information to be done in accordance with Articles 5(1)(e) and 5(2) of the GDPR.

You can read the press release here and the Decision here, both only available in Danish.