A certificate of clean criminal record is classified as a document containing data on criminal convictions, offenses or related security measures. These are data that, in accordance with Art. 10 of the GDPR are subject to special processing conditions.

The processing of such information may only be carried out under the supervision of public authorities or if the processing is permitted by law providing for adequate safeguards for the rights and freedoms of data subjects.The scope of personal data that an employer may require from a job applicant, and then from an employee, has been specified in Art. 22(1) § 1 (candidate) and art. 22(1) § 3 (employee) of the Polish Labor Code.The employer may request the provision of personal data other than those specified above, only when it is necessary to exercise the right or fulfill the obligation resulting from the law.The Polish Labor Code does not mention information about a clean criminal record among the data that can always be requested during recruitment or employment. This means that the employer, in order to obtain them legally, must be entitled or obliged to do so under specific provisions. 

Are there particular issues in checking candidates’ social media profiles?

The Polish Office for Personal Data Protection in the guide for employers (Personal data protection at the workplace: A Guide for Employers) gave a clear opinion: the collection by employers and recruiters of information posted by candidates about themselves on social media is in principle unacceptable, and this also applies to publicly available information.The Polish Personal Data Protection Office indicated that such action may have a negative impact on the candidate’s assessment and may lead to profiling a candidate on the basis of these publicly available data. It is difficult to say whether the Office sees exceptions to this rule, because this topic has not been elaborated on either in the guide or in the positions taken later.A somewhat less stringent approach is presented by an important body for data protection – the Article 29 Working Party (Opinion 2/2017 on data processing in the workplace). It indicates that browsing candidate profiles should not be a common practice, but it may already be acceptable when, due to employment needs, it is necessary to review information about a candidate that is posted on social media. In such a situation, the Article 29 Working Party allows the possibility of viewing profiles based on the legitimate interest of the controller. Therefore, it would be necessary to weigh the interests of the employer and the candidate beforehand, and if it turns out to be acceptable, then it will be necessary to inform the candidate about browsing their profiles on social media.The opinion was issued on the basis of Directive 95/46 / EC, but under the GDPR, the legitimate interest of the controller could also constitute a legal basis for this action. This opinion is not a legal source, but can be used as a reference.The Article 29 Working Party draws attention to the most important issue – the nature of the profile. Before reviewing the candidate’s profile, the employer or recruiter should assess whether it is a private or professional profile. The private profile should not be checked. The mere assumption that we can use information about the candidate because he has made his data public is insufficient. In this way, the employer crosses the border of privacy and enters the sphere to which he should not have access. This is problematic especially when the recruitment is carried out by representatives of the employer, and not by an external recruiter, and obtaining private information about the candidate may result in assessing him through its prism already at the stage of employment.Therefore, a simple assumption can be made – browsing profiles on Linkedin is acceptable because they are professional in nature.It is good to use the description criterion – when in the description of the profile we find information that proves its professional character (e.g. a photographer, HR specialist, PR specialist, social media ninja), it is very likely that this person makes public content of a professional nature, unrelated to his life private. In the case of running a fanpage on Facebook, it seems obvious that such a profile is not private and that it is also possible to view it during the recruitment process. It has become a regularity to have two separate accounts in some portals – private and public. We observe this practice, for example, on Instagram. A public account created there may be a specific portfolio for some professions (e.g. in the creative industry) and the employer or recruiter should be able to freely browse this content. 

Can I ask candidates about their Covid-19 vaccination status?

The current regulations do not provide for the possibility of employing only people vaccinated with COVID-19 or asking during an interview about the vaccination. This type of practice is discriminatory, and therefore it violates the provisions of the Labor Code, which in Art. 113 states that any form of discrimination in employment is unacceptable.Pursuant to the Polish Labor Code, the employer requires the job applicant to provide personal data including: 1.    first name (names) and surname;2.    date of birth;3.    contact details indicated by such a person;4.    education;5.    professional qualifications;6.    the course of previous employment.The abovementioned list is closed and the request for health or vaccination data at this stage is unacceptable as there are no health and vaccinations in the primary data catalog. On one hand Article 22 § 4 of the Polish Labor Code slightly opens the way to include obtain some sensitive data from the candidates: “The employer requests other personal data than those specified in § 1 and 3, when it is necessary to exercise the right or fulfill the obligation resulting from the law”. Unfortunately, also in this case the employer has his hands tied, because COVID-19 vaccinations are not obligatory in Poland, and thus – there is no reason to ask whether the candidate or employee is vaccinated or not. The provision would be treated differently if vaccination were compulsory for everyone. 

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

Pursuant to Art. 61 § 1 of the Act of May 20, 1971 – the Polish Code of Minor Offenses, a person who appropriates a position, title or rank to which he or she is not entitled, shall be liable to a fine of up to PLN 1,000 or to a reprimand. Such a situation will take place when an employee lies in the CV that he or she has worked in a given place or that he has a specific professional or academic title (without presenting any supporting documents).On the other hand, when an employee presents, for example, a false employment certificate or a diploma of graduation, it fulfills the criteria of Art. 270 of the Act of 6 June 1997 – the Polish Criminal Code. According to this provision, anyone who, in order to be used as authentic, forges or forges a document or such document as authentic, is subject to a fine, restriction of liberty or imprisonment for a period of 3 months to 5 years. In addition, if an employee, despite the lies in the CV, is employed and is paid remuneration for work, and therefore gains financial benefits from misleading the employer, then he fulfills the features of fraud defined in Art. 286 of the Polish Criminal Code. Pursuant to this provision, anyone who, in order to gain financial benefits, causes another person to disadvantageously dispose of his own or someone else’s property by misleading him or by exploiting an error or inability to properly understand the action taken, shall be subject to the penalty of deprivation of liberty for a term of between 6 months and years. 8.

As a rule, the employee is entitled to remuneration for the work performed (Article 80 of the Polish Labor Code), which results directly from the employment relationship between the parties (Article 22 § 1 of the Polish Labor Code). Moreover, the employee may not waive the right to remuneration (Art. 84 of the Polish Labor Code). In the light of these provisions, it can therefore be assumed that the employee is entitled to remuneration because he has performed work.

Remuneration for work, however, is not due, in accordance with Art. 82 § 1 of the Polish Labor Code, for defective performance of products or services due to the fault of the employee. If, as a result of defective work due to the fault of the employee, there has been a reduction in the quality of the product or service, the remuneration shall be reduced accordingly.

What is more, the defrauded employer may seek to recover the salary paid as a consequence of the falsified CV, which, unfortunately, may involve filing a lawsuit. However, it is worth knowing that the employer, pursuant to Art. 88 of the Act of 23 April 1964 – the Polish Civil Code, has the option to evade the legal consequences of a declaration of will that was submitted to an employee under the influence of a mistake. For this purpose, the employee should submit a written declaration to the employee together with a request for the return of the paid benefit in the form of remuneration for work – in whole or in part.

In the light of Art. 78 § 1 of the Polish Labor Code, remuneration for work should be determined in such a way as to correspond in particular to the type of work performed and qualifications required for its performance, as well as to take into account the quantity and quality of work performed. It can therefore be assumed that if the employer had known about the lack of qualifications on the part of the employee, he would have set a lower salary or would not have employed the employee at all.

How should I deal with the personal data of unsuccessful candidates?

The period of storing personal data of candidates will depend on the result of a given recruitment. If a specific person is not selected, then there are no grounds for further processing of their personal data (application documents), therefore they should – as a rule – be removed immediately after the completion of this recruitment, unless the candidate has consented to the processing of such data on account for future recruitments for a specified period of time. In certain circumstances, however, and especially when there is a high probability that the unsuccessful candidate will pursue claims, referring to the alleged discrimination in the recruitment process, the employer may retain the personal data of such a candidate until the claims are time-barred, relying on his legitimate interest (Art. 6 (1) (f) of the GDPR). However, such a situation should be considered an exceptional and properly justified course of a specific recruitment.

It should also be remembered that the processing of personal data of candidates may be performed by employees who have the appropriate authorization to process them granted by the employer and related to their professional duties. They should also undertake to keep these data confidential. Only in the case of processing sensitive data, the confidentiality obligation does not have to arise from the content of the authorization, because it is a statutory obligation arising directly from Art. 221b § 3, second sentence, of the Polish Labor Code.