From Which Sources and How the Data Concerning an Employee Can Be Gathered?

The employer must collect personal data on the employee primarily from the employee personally. For the collection of data from a source other than the employee, the provisions of the GDPR on processing based on consent apply. However, consent cannot be a ground for processing if the employer collects personal data during the employment relationship for the purpose of exercising the employer's rights or obligations under the law or if the processing of personal data is expressly provided for by law. On the other hand, if the employer wishes to use any information found by internet searches or from social media channels for the recruitment process, the employee must give consent for it and he/she must be informed about searching during the recruitment process. Searching for said information is not prohibited per se, but using information other what the job applicant has provided in the recruitment process is not allowed.  

Credit data information can be disclosed to an employer only if the assignments require special trust, which means there is a possibility to obtain illegal financial benefits, such as in positions where an employee has independent discretion to make substantial financial commitments. A private sector employer cannot gain any information on criminal records, excluding a criminal background extract from those who work with children and requesting a security clearance from the police, which requires the employee’s approval. For more information on this see Credit data information can be disclosed to an employer only if the assignments require special trust, which means there is a possibility to obtain illegal financial benefits, such as in positions where an employee has independent discretion to make substantial financial commitments. A private sector employer cannot gain any information on criminal records, excluding a criminal background extract from those who work with children and requesting a security clearance from the police, which requires the employee’s approval. For more information on this see [Security Clearance Procedure].

The employee must be informed of data collected from any other source than the employee him/herself prior to utilizing said data in decision making concerning the employee. The employee should be informed of the information immediately upon receiving the information, as far as possible, in order for the employer to be able to correct possible errors.