Irish Data Protection Commission Case Studies

Sharing of CVs by recruitment companies [08/04/2010]

In April 2009 I received a complaint against a recruitment company (company A) regarding an alleged disclosure of the complainant's curriculum vitae (CV) to another recruitment company (company B).  The complainant submitted his CV to company A for a particular job which was advertised on a recruitment website.  However, he was subsequently contacted by company B asking for further details in relation to his CV.  In a phone call, company B confirmed to the complainant that it had received his CV from company A.  The complainant claimed that the company to whom he sent his CV did not obtain his consent to disclose his CV to another company.

My Office commenced an investigation into the matter and we wrote to company A and asked it to demonstrate the consent it considered it had in place to disclose the complainant's CV to company B.  A key principle of data protection is that personal data should be used and disclosed only in ways compatible with the purposes for which it was obtained.  Company A explained that it and company B, although they were separate legal entities and registered separately with the Companies Registration Office, were effectively run as one company.  They both shared, among other things, the same office space, databases, IT infrastructure, telephone system and management.  However, one of the companies handled recruitment of middle and senior management while the other one handled recruitment of office and customer support staff.  In this case, when the complainant submitted his CV to Company A, the consultant who received it passed it to a consultant in Company B as possible skills were identified from the CV which may have been of interest to the other consultant's clients.

My Office advised Company A that the companies were two separate entities and therefore, individuals using the services of either one should be made fully aware, prior to submitting their personal information, that it would be shared between the two companies.  We also noted that the privacy policy on its website did not contain any reference to the fact that both companies share information and we advised that it should contain a statement which informed individuals using the website how their information would be processed and that their information would be shared between the two companies.  My Office also advised that, if it was unable to do this, the only alternative was to separate out the two entities completely and cease sharing personal information.

As a result of our investigation, we received an assurance from Company A that it would insert a statement on both of the companies' websites to inform individuals using the websites how their personal information would be processed and of the fact that it would be shared between both companies.  It also indicated that it would no longer have separate entities and that, although this would take some time to arrange, both companies would trade as one company in future. 

I welcome the fact that the data controller immediately put in place the measures needed to bring it into compliance with the Acts. It is important for any data controller to make individuals fully aware at the outset as to how their personal data will be processed and to whom it may be disclosed.   As a general rule personal data may not be shared between two legal entities without the consent of the individual about whom the data relates.