Data authority sets rules for personal data in job CVs

The National Authority for the Protection of Personal Data (ANPDP) issued new rules on Wednesday that limit how public and private bodies handle personal details in job CVs.

Awras reported that the rules are laid down in Deliberation No. 05, which applies Law 18-07 on the protection of individuals in the processing of personal data. They cover how CVs sent by job applicants are collected, recorded, stored, used and passed on.

The authority said that sensitive data may be handled only in the exceptional cases the law allows, under the conditions and safeguards in Article 18. Sensitive data include racial or ethnic origin, political opinions, religious beliefs, trade union membership and genetic data.

The authority said that including such details in a CV is not, on its own, a sufficient legal reason to process them. This applies whether the candidate adds them or the receiving body asks for them.

Duties for organisations

Data controllers must not require sensitive details in CVs unless the law gives a clear legal reason. They must delete or hide sensitive details that are not needed, and keep CV files confidential and secure.

The retention period for CVs of candidates who are not selected is one year. It runs from the end of the hiring or professional selection process.

After that period, the CVs and the data in them must be deleted or destroyed in a safe way that stops them being recovered or viewed again. This does not apply if another legal text requires otherwise or sets a longer period.

What candidates can do

The authority urged candidates to leave out sensitive details that are not needed to prove their skills or meet the legal conditions of the job.

The rules apply to paper and electronic CVs, including those received through recruitment platforms. The bodies concerned are under the supervision of the authority, which can take legal measures if it finds a breach of the rules on personal data.