Some time has passed since the Polish Labour Code was adjusted to the provisions of the EU’s General Data Protection Regulation, but some issues remain unclear. Problems with interpretation of the provisions arise at the stage of recruitment and determining which personal data of candidates may be collected and processed by prospective employees. Doubts are raised for example by the issue of the permissibility of obtaining residential addresses from job applicants.
May an employer demand information from job candidates on their place of residence?
Under Art. 221 §1 of the Labour Code, an employer may require candidates for employment to provide personal data including, among other things, their name, date of birth, and contact details, which the candidates themselves indicate. This means that prospective employees themselves should decide whether to reveal contact details to their prospective employer, and if so, which contact details to provide. Candidates should make their own decisions on whether to provide the prospective employer with their residence address, or for example an email address or telephone number.
If at the recruitment stage the employer demands that candidates provide their residential address, this may be found to be excessive. Gathering of excessive personal data means obtaining data about a person that are not essential to achieve the specific purpose of the data processing. More simply, the employer cannot demand information if the employer can achieve its purpose without processing that data.
Excessive processing by the employer infringes the principle of “data minimisation” (Art. 5(1)(c) GDPR), one of the fundamental principles of personal data processing. This rule states that personal data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” This should be understood to mean that processing of personal data exceeding the scope necessary to achieve the purpose of the processing is a violation of the regulations. The principle of data minimisation is also stressed in recital 39 of the preamble to the GDPR, stating: “Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means.” It should be borne in mind that violation of the principle of data minimisation is threatened by the aggravated sanction provided for under the GDPR, i.e. an administrative fine of up to EUR 20 million or up to 4% of an undertaking’s total worldwide annual turnover.
It is also relevant that currently most recruitment is conducted via internet. In that situation, to establish contact with the candidate it suffices for the person to provide an email address (typically when completing the application form) or possibly a telephone number. Demanding candidates’ home addresses thus cannot be justified by the need to contact the candidates, as this aim can be achieved by other means.
When can an employer require a home address, and from whom?
In turn, Art. 221 §3 of the Labour Code expressly provides that the employer may require the employee to provide a home address at the time of hiring. Providing a home address at that time is justified because the employer must have it in order to complete various obligations imposed by law, for example to register the employee for social insurance.
Sample documents published on the website of the Ministry of Family, Labour and Social Policy in January 2019 are also helpful in resolving doubts on this issue. They include a form for a job application, which states that the applicant should decide which contact details to provide to the prospective employer, and thus the employer may not require the candidate to provide a home address. However, in the sample HR form for new hires, there is an item for the employee’s home address.
In short, an employer has a right to require an employee to provide a home address, but at the recruitment stage providing such information is voluntary.
Rozanna Piela-Wojciechowska, Jarosław Karlikowski