How does the employer handle the issue of background checks, including those involving sensitive personal data such as criminal records?

Under the Hungarian Labour Code, the employer may require an employee to make such a statement or to disclose such personal data which is essential for the conclusion, performance or termination of the employment relationship or for the enforcement of claims arising out of the Labour Code (for this purpose, the employer may request the presentation of a document but may not make a copy of it, only a note that the given document has been duly presented and checked).

It is also important to comply with all data protection principles, e.g. only such data may be processed which are necessary for reaching a legitimate purpose and only for a period absolutely necessary.

Requesting criminal certificate

Under the Labour Code, the employer may process the criminal data of the employee or the person wishing to enter into an employment agreement with the employer for the purposes of examining if an act of law or the employer does not restrict or prohibit the employment of the relevant person in the respective position filled in or wished to be filled in. The employer may set a restrictive or prohibitive condition if the employment of the relevant person in the respective position would pose a risk to

a) the employer’s considerable monetary interest,

b) secrets protected by law, or

c) the safe storage of guns, explosives, poisonous or hazardous chemicals, biological substances and/or nuclear substances.

The employer has to determine in writing in advance (e.g. by way of a specific document) the restrictive or prohibitive condition serving as a basis for the processing of criminal data as well as the conditions for the processing of such data. The request of the presentation of a clean criminal certificate (“hatósági erkölcsi bizonyítvány” in Hungarian) cannot be general, i.e. the respective scope of work has to justify such request.

It is worth noting that pursuant to the Labour Code and the relevant practice of the Hungarian data protection authority (DPA), even if a criminal certificate may be requested, employers may only require employees to show them the criminal certificate but they may not make a copy of the document.

In addition to the above, since it is the employer’s legitimate interest (Article 6 (1) f) of the GDPR and Section 11 paragraphs (3)-(5) of the Labour Code) which may serve as a legal basis of the processing of the above data (i.e. the fact that an employee candidate or an employee has a clean criminal record), the employer has to prepare a so-called balancing test (aka proportionality test) prior to any processing taking place and due information must be given to the data subjects of the data processing before the commencement of any data processing.

Education and employment history (CVs)

The employer / potential employer has to provide information on the processing of the applications (including also CVs). As per the DPA, the personal data (including CVs) of rejected applicants and any notes made by the employer have to be deleted right after the decision on rejection of the applicant. (We note that at this point in time (i.e. when communicating the decision on rejection to the applicant), the employer / company may decide to ask for the consent of the rejected applicant to the further processing of his/her application (for a limited period of time, e.g. a couple of months) so that if there is any vacancy in a position, the employer / company could again evaluate the application and contact the candidate as necessary.

Education and employment history of the applicants who have become employees may be processed if the legitimate interest of the employer justifies it. This means that a balancing test has to be prepared in this regard and due information must be given to the employees in due course.

Credentials (i.e. reference letters from previous employers)

The above apply accordingly (i.e. processing has to be proportionate, balancing test must be prepared and information must be duly given to the data subjects prior to any processing taking place). The documents can only be checked, and not copied/stored.

The above-mentioned processing activities must be duly incorporated in the registry of processing activities to be kept in accordance with Article 30 of the GDPR.

Are there particular issues in checking candidates’ social media profiles?

In line with the practice of the DPA, the employer has to meet the following main criteria in this regard:

I. prior information must be given to the job applicants on the fact that checking the publicly available profile of the candidate forms part of the selection process,

II. only fully public information can be checked (information which is partially public (e.g. within a specific group only) or fully private cannot),

III. only such information can be checked which are relevant from the perspective of the scope of work/job (information on private life, family status, religion etc. cannot be checked),

IV. the employer is not allowed to download, store or transfer the profile of the applicant.

Since it is the employer’s legitimate interest which may serve as a legal basis of the processing of the above data, the employer has to prepare a balancing test prior to any processing taking place and due information must be given to the data subjects of the data processing before the start of processing.

The above-mentioned processing activity must be duly incorporated in the registry of processing activities to be kept in accordance with Article 30 of the GDPR.

Can the employer ask candidates about their covid19 vaccination status?

Yes, subject to certain conditions. The DPA issued an information paper in April 2021 on as to whether employers are allowed to get information on the fact if the employees are vaccinated against COVID-19. Below follows a summary of the information paper.

Under labour and, respectively, labour protection laws,

• the employer is required to continuously maintain a safe and healthy workplace,
• the employee’s personality rights can only be restricted if the restriction is absolutely necessary for a reason directly connected to the employment and if it is proportionate with the purpose wished to be achieved,
• the employer must inform the employees in advance and in writing about the method, conditions and expected duration of the restriction and also about the circumstances justifying the necessity and proportionality of the restriction,
• the employer may require the employee to make such a declaration or to provide such personal data, which is relevant from the perspective of the creation, performance or termination of the employment or the assertion of claims based on the Labour Code. To reach this purpose, the employer may require the employee to show a document.

Requiring an employee to show his/her “immunity certificate” (which is a plastic card proving that the relevant person has been vaccinated against COVID-19) or the app certifying vaccination to the employer qualifies as a restriction of the employee’s personality rights.

The DPA stresses that what is included in the opinion paper applies in the then current pandemic situation. In our view, even though, the current situation is much better than it was when the opinion paper was issued, officially, there is still a state of danger in Hungary and we might be facing the next wave in the Fall. Based on this, we are of the view that what is included in the opinion paper likely still holds.

In the DPA’s view, under the labour law regulations mentioned above, based on a so-called labour (health and safety) risk assessment to be prepared by the employer in advance, requiring employees in certain positions (i.e. with a certain scope of work) to present their immunity certificate or show their app to the employer may be a necessary and proportionate measure (the protection of the life and health of employees and third persons getting in contact with the employees may justify the measure). The DPA adds that this kind of data processing can also serve the interest of the public.

As per the DPA’s view, the employer can request the employee to present his/her immunity card or the app (i.e. the employer can get the information on whether or not an employee has been vaccinated) if:

I. the employer prepares a risk assessment in advance, which is to justify which employees can be requested to show the plastic card or the app (i.e. to get the information if the relevant employee is vaccinated or not). It is important that if an employee works from home and he/she keeps working from home also in the future, no such request can be made to him/her. However, such request can be justified in regard of employees with a number of daily contacts (e.g. receptionists) or employees working mainly outside the workplace and getting in contact with a number of people (e.g. at the sites at other companies),

II. the employer gives prior information to the employees affected (i.e. data subjects) in a documented way about a number of factors as required by the GDPR and the Labour Code, including the legal basis (a legal basis from Article 6 (1) of the GDPR and a legal basis from Article 9 (2) of the GDPR has to be named, the latter could be clause b), h) or i), as the case may be) and the purpose of processing, the retention period, the persons having access to the information, rights and remedies available to the data subjects, etc.),

III. the purpose of the employer must be real, meaning that if the employer decides to ask for the information (data) in regard of certain employees if they have been vaccinated, then the employer is required to take the necessary measures in light of the information obtained and to duly document them. Also, it is important that the personal data processed must be capable of reaching the purpose of the employer (no data not necessary for reaching the purpose may be processed),

IV. the employer can only process (make a brief note of) the following data: the fact that a certain employee has been vaccinated and, if indicated on the immunity certificate or in the app, the duration of the immunity (i.e. no any other data may be processed),

V. the employer can only request the respective employees to show their immunity certificate/app and the employer is not allowed to make a copy of the documents, and the data cannot be stored and/or transferred, the employer is only allowed to make a note of the fact that the respective employee has proven that he/she has been vaccinated and, if indicated on the immunity certificate or in the app, the duration of the immunity,

VI. data protection principles must be respected (e.g. data security (for example, only those persons can have access to the information collected who need to have access to such information for the purposes of performing their work), accuracy of data, etc.).

The opinion paper is silent on the retention period, and there is no specific statutory retention period, thus, the employer is responsible for applying a proper retention period. In our view, keeping the data until the end of the state of danger may seem reasonable.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

Employees are not allowed to lie. Furthermore, if the employer lawfully requests certain information from the employee, the employee has to provide such information. If it turns out later that the information the employee provided is false, this may have labour law consequences. The consequence depends on the concrete circumstances of the case.

How should employers deal with the personal data of unsuccessful candidates?

As a rule, the employer must delete the data of unsuccessful candidates (i.e. candidates it did not hire) since the original data processing purpose has ceased to exist. However, if there is a legitimate purpose and legal basis for further processing, then the data can be kept for some limited additional time. Namely, when the employer informs the candidate that his/her application has been rejected, the employer may ask for the candidate’s consent to the further processing of his/her CV so that the employer can contact the candidate in case of a vacancy. If the candidate gives his/her consent to such further processing (based on proper prior information given on such further processing), then the employer may further process the relevant CV. This processing should normally be limited to no more than about six months.