Introduction

Under the Brazilian legal system, the gathering of candidates’ personal data in hiring and on-boarding procedure must comply with the Brazilian General Data Protection Law (LGPD), which, inspired by the European General Data Protection Regulation (GDPR), is also applied to the Labor Law.

How do I handle the issue of background checks, including those involving sensitive personal data such as criminal records?

To check candidates’ background and gather their personal data, the companies must comply with the LGPD principles, such as:

I. Purpose Principle, concerning the need of defensible, explicit, specific and well-informed objectives for the data processing;

II. Adequacy Principle, concerning the need of compatibility between requested information and company goals;

III. Necessity Principle, concerning the need of requesting the least data possible for the shortest time possible;

IV. Transparency Principle, concerning the need of notifying candidates in a clear, precise and accessible way about which data will be collected and how it will be processed; and

V. Non-Discrimination Principle, concerning the prohibition of using the data for discriminatory, illicit or abusive purposes.

In view of the Non-Discrimination Principle, personal data considered to be sensitive or liable of being used for acts of prejudice against candidates shall not be requested. Therefore, criminal records, toxicologic exams, ethnical origins, sexual orientations, religious beliefs, credit restrictions and political opinions should not be checked. Regarding criminal records, toxicologic exams and religious beliefs, their gathering and use is only defensible, for example, for positions involving, respectively, property security, professional driving and religious education. Anyway, when gathering sensitive personal data, the employers need to take special care in its processing, which is why the companies should carry out an extensive analysis about its real need. Furthermore, the sensitive personal data processing requires a specific and detached consent of its holder for an extremely well-defined purpose.

Regarding criminal records specifically, the Brazilian case-law authorizes its checking not only for positions involving property security, but also for those involving:

I.  domestic work;

II. minors, elderlies and disabled care;

III. cargo drive; (iv) agro-industrial sharp instruments use;

IV. banking activities;

V. weapons and toxic substances handling; and

VI. confidential information processing.

To keep candidates well-informed about their data processing, the companies should prepare a Hiring Policy with all the information related to data storage, use and sharing. Anyway, applications forms should be brief and simple, asking, at first, only information considered relevant and essential. Besides, when asking or checking candidates’ information, the employers must obtain their free, unequivocal and well-informed consent in order to storage, use and share their personal data. Finally, the companies shall always keep a wide communication channel with the data holders, since they are entitled to access, update, delete and revoke the information given at any time.

Are there particular issues in checking candidates’ social media profiles?

The LGPD does not prohibit checking candidates’ social media profiles. However, this data must be made available by its owners or, in other words, must be found in public databases. In these cases, the candidate’s permission is not even necessary. Yet, the checking shall not be used for discriminatory purposes, as for “company profile” selections based on age, religious belief, sociability, political opinion, sexual orientation or ethnic origin. Therefore, even when social media profiles are publicly accessible, the gathering of their data shall have a proper purpose for the hiring and on-boarding procedure, such as information and respectful behaviour check or knowledge and technical skills search. Finally, social media’s protected and restricted data shall not be pursued or checked.

Can I ask candidates about their covid19 vaccination status?

Although the candidates’ Covid-19 vaccination status configures sensitive health personal data, it may be requested during hiring and on-boarding procedure, since it has a well-defined and reasonable purpose, namely: the compliance with health, hygiene and safety requirements in the work environment. In this way, the gathering of this data does not depend on the candidate’s consent, mainly because, as mentioned before, it serves to protect the life and physical safety of the data holder and third parties. However, it must still be respected the Principles of Effectiveness, Necessity, Proportionality, Confidentiality and, above all, Non-Discrimination. Therefore, to respect, as much as possible, the candidates’ privacy and intimacy, the companies shall not disclose this data and must store it in a safe and secure way.

Regarding the non-discrimination, the lack of Covid-19 vaccination shall not be used as an arbitrary elimination standard. So, before asking candidates about their Covid-19 vaccination status, the employers shall be clear about its purpose, showing them how this information meets the company objectives and goals. Furthermore, this purpose must be fair, defensible, relevant and strictly necessary for a specific and legitimate goal, as the one related to reducing the risk of contamination and death from Covid-19 in the work environment. Therefore, if the company is not able to present a purpose (e.g. it adopts the remote work arrangement) or if its goals can be reached through other means, the Covid-19 vaccination status shall not be asked.

Finally, there is a motion pending in Brazilian Supreme Court in which is being discussed the constitutionality of requiring proof of vaccination when hiring new employees. In the moment, despite there is no final decision, there has already been a precautionary one authorizing the requirement when the candidate does not have medical contraindication.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

Candidates are entitled to lie or omit information. Nonetheless, lies and omissions may lead to just cause termination or to hiring and on-boarding procedure exclusion.

How should I deal with the personal data of unsuccessful candidates?

Curriculum and personal data sent by unsuccessful candidates shall not remain archived indefinitely. However, they should not be immediately deleted, since they could be required in eventual motions challenging the hiring and on-boarding procedure. Therefore, such information must be kept for the period set by the hiring and on-boarding program, which should fix a period of about two years. Anyway, the company will need the candidate’s consent, that must be free, unambiguous and well-informed. This consent is essential for the maintenance of a curriculum database, which requires an agreement in proper terms and for a determined time, regardless of whether it is in the candidate’s legitimate interest or not. Furthermore, while the data remains stored, the candidate is entitled to know who is responsible for its processing, as well as to access, update, delete and revoke the information given. Finally, when deleting the data, the employers must guarantee that non-authorized third parties will still be unable to access or retrieve the discarded information.

Summary

During hiring and on-boarding procedure, employers should always keep in mind the Principles of Purpose, Adequacy, Proportionality, Necessity, Effectiveness, Transparency, Confidentiality and, above all, Non-Discrimination, since, under Brazilian legal system, they are the basis of LGPD and, thereafter, of personal data protection within the working environment.