How do I handle the issue of background checks, including those involving sensitive personal data such as criminal records?

In Spain, one of the novelties included in the Personal Data Protection Regulation is proportionality.

Personal Data may only be requested if it is strictly necessary for the provision of the intended service.

Therefore, the only case in which the employee may be asked for a negative criminal record certificate is if the job in which the service is to be provided is regulated by a specific regulation that makes it essential to have this certificate, for example, in jobs that involve dealing with minors or exercising a public function.

Are there particular issues in checking candidates’ social media profiles?

The Spanish Data Protection Agency (AEPD) stresses that, even if it is publicly accessible, the company cannot search candidates’ social media profiles and use the data thus obtained “if it does not have a valid legal basis for doing so”. Similarly, it rejects companies sending out friend requests to their candidates in order to access the content of their profiles, or directly ask them to show the content they share with third parties in networks.

But when is there a legal basis? The AEPD l considers that the investigation would be justified if it is related to professional purposes. As a general rule, companies cannot review the digital activity of their candidates, but there are exceptions and nuances, one of which would be if the search on social networks serves to check whether the candidate meets certain qualities strictly related to the position. For example, if you are looking for an expert for a Communication or Marketing Department, it would make sense to check their Twitter account to see if they have the required communication skills

Can I ask candidates about their Covid-19 vaccination status?

Vaccination against the Covid-19 virus is not compulsory in Spain, which also applies to all other vaccines.

Vaccination is not compulsory in the workplace either, not even in the health sector (doctors, nurses), so it is not possible to dismiss a worker for not being vaccinated, nor can he/she be penalised. In these cases, in the event of dismissal, it would normally be considered unfair or even null and void, as fundamental rights could be violated in this process, such as the right to privacy. Nor would it be legal to keep a register of vaccinated and unvaccinated employees, as this is protected personal data that the employee is not required to communicate to the company. In the same way, a prospective employee cannot be asked whether he or she is vaccinated against the Covid-19 virus – much less could this be made a condition of employment. This applies regardless of the inoculation status (first, second or third dose). The fact that a candidate is excluded from a job because of his or her vaccination status constitutes a violation of the right not to be discriminated against on the grounds of birth, race, sex, religion, opinion or any other personal or social condition or circumstance, as recognised in the Spanish Constitution, and also the right to privacy.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

If the employee lies or omits information, the Company may apply the penalty regime stipulated in the applicable Collective Bargaining Agreement

How should I deal with the personal data of unsuccessful candidates?

Regarding the processing of unsuccessful candidates’ personal data, the Spanish Data Protection Agency (AEPD) clarifies that the data may only be retained with the candidate’s consent, unless the employer can demonstrate a legitimate interest. If this is not the case, the CV must be destroyed, and the personal data must be deleted and blocked.