Introduction

According to the Czech Labour Code, during a job interview, an employer may seek only such information that is directly linked to the intended employment. No other information may be sought either from the candidate or any third party. Employers are never allowed to inquire about sensitive issues such as pregnancy, family status, sexual orientation, religion, criminal record etc., unless, in some cases, there is a material reason lying in the nature of the job to make such an inquiry and some other conditions are met. These are the general rules employers must adhere to during the hiring process and throughout the employment, while also complying with all their data protection obligations based mostly on the GDPR.

How are employers supposed to handle the issue of background checks, including those involving sensitive personal data such as criminal records?

As explained above, an employer is entitled to request only information that is directly related to the performance of the employee’s (job candidate’s) work duties and to the establishment, change or termination of the employment.

There are several types of information which the employer is strictly prohibited from requesting. Among these are the following: sexual orientation, ethnic origin, trade union membership, membership in political parties and religion.

Other sensitive information, such as pregnancy, criminal records, marital status and the employee’s financial situation, may be requested in certain cases, provided that such a request is proportionate and reasonable. In some cases, such information may be required based on specific laws (e.g., if the law requires that the job should be performed only by an employee with a clean criminal record or if the work cannot be performed by pregnant women, etc.).

A situation in which an employee (or another person, such as a previous employer) provides sensitive information without being asked is not considered a violation of applicable laws, but an employer shall not keep any records containing such information. 

As regards background checks, these are generally possible, but an employer must comply with the principles above. On the other hand, a person (such as a previous employer) asked for information about a job candidate should consider very carefully whether they are allowed to provide personal data of the candidate in question to third parties.

Are there particular issues in checking candidates’ social media profiles?

Again, the employer is entitled only to information directly related to the performance of the employee’s work duties or the employment itself. If the employer wants to check a candidate’s social media profile, they should check only career-oriented social media such as LinkedIn. Personal social media such as Facebook should not be part of the social media check unless a very specific reason is given. Especially, the employer should not make any records of information which they found on the social media. If the employer records such information, they may not only violate the GDPR but also, if they select a candidate based on information found on the social media forbidden to the employer, the unsuccessful candidate could have grounds for a discrimination suit.

Can employers ask candidates about their Covid-19 vaccination status?

No. The COVID-19 vaccine is not mandatory in the Czech Republic and therefore, the employer is not entitled to know if its employees are vaccinated against COVID-19 or not. There may exist rare exemptions to this rule based on the specific nature of the work. 

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can employers do?

If an employer requires information beyond the scope allowed (such as family status) and the employee lies, no negative consequences for the employee can be derived based on that.

If an employee provides false information related to the employment (such as qualification, previous experience etc.), the employer needs to assess the intensity of the impact of such false information on the performance of the employee’s work duties and/or prerequisites for the work performed by the employee (e.g., if a certain qualification or licence is required by the law for the respective work and the employee does not hold it, contrary to their initial statement). Based on such assessment, the employer may have several options on how to handle such a situation. If the employee causes any damage by such a lie, the employer may sue the employee and claim damages in full. In certain cases, the employer could terminate the employment.

How should employers deal with the personal data of unsuccessful candidates?

The employer should delete the personal data of unsuccessful candidates without undue delay after the hiring process is completed. If the employer wishes to further process such data, they must have a consent from the data subject (unsuccessful candidate). Such consent must be granted in written form and contain all mandatary elements of a consent required by the GDPR. That means that the consent must be voluntary, the data subject must be informed about the purpose of the consent (future hiring opportunities), the conditions of the processing and about their rights arising from the processing. It is also important to keep in mind that the consent allows for data processing only for a predetermined period of time (stated in the consent) and that such period of processing must be adequate to the purposes of the processing (we can generally speak about one year in respect to the processing relating to unsuccessful candidates).