“In recent years, it has become increasingly common in Poland for employers to conduct background screening, i.e. to verify information presented by candidates during the recruitment process, as well as to collect additional information on employees during their employment, including from third parties. It usually takes place by contacting former employers or by reading the social media accounts of candidates and employees.

Under the current legislation, the accessing of a candidate’s/employee’s personal data that is not listed in the catalogue of personal data that an employer may process is questionable. This is particularly the case when the employer (or the recruitment company supporting the employer) carries out such background screening without the consent or knowledge of the candidate/employee or when, as a result of the screening, the employer gains access to sensitive information which should not be processed during the recruitment process or during the period of employment.

The use of background screening is also questionable in the light of the GDPR and the proposed amendments to the Polish Labour Code. In order to minimize the risk of a possible breach of the regulations on personal data protection and meet the requirements of the GDPR, the employer should obtain the candidate’s/employee’s prior, explicit consent to carry out the screening. Importantly, the consent should be given freely, which in practice means that the employer should reassure candidates and employees that failure to give it will not have a negative impact on the outcome of the recruitment process and will not be the basis for any decision concerning their employment. If the relevant consent is obtained, the employer (or the recruitment company) should be able to contact third parties to confirm the candidate’s/employee’s experience and educational achievements. However, in this case, the verification should be limited to the information provided by the candidate/employee and should not include other personal data (…)

It should be noted that, apart from a possible breach of personal data protection law, the background screening of candidates and employees may also constitute a breach of the right to privacy under civil law, both at the stage of recruitment and during the period of employment.”

The above section is a part of the guide prepared by DLA Piper entitled “Changes in the Protection of Personal Data”. We encourage you to familiarize yourself with its contents.