Candidate consent

Where consent fits in hiring

Reading and assessing an application needs no consent at all. Someone who applies is asking to be considered, and the GDPR covers that as steps taken before a contract. Asking candidates to consent to their own application being processed is therefore worse than pointless: it implies a basis that could be withdrawn mid-process, when the real basis cannot.

Consent earns its place one step later, whenever the intended use outgrows the vacancy. Keeping a rejected candidate for future roles, adding them to a talent pool, sharing the profile with a sister company: each is a new purpose, and each needs its own agreement rather than a line in the job ad.

The tests a valid consent passes

Article 7 of the GDPR and its definitions clause set four conditions, and hiring gives each one a concrete shape. Freely given: declining costs the candidate nothing in the current process. Specific: agreeing to stay in the pool is not agreeing to marketing email. Informed: the candidate knows which data, for what, for how long. Unambiguous: they did something affirmative, because staying silent grants nothing.

Free is the contested one. The EDPB’s Guidelines 05/2020 on consent, adopted 4 May 2020, warn that an imbalance of power can strip consent of its freedom, and few relationships are more unbalanced than hopeful candidate and potential employer. The practical answer is scope: only ask for what is genuinely optional, and treat the candidates who decline exactly like those who agree.

Where it breaks down

The recurring failures are structural, not malicious. Consent folded into the careers-site terms, which the candidate accepted as a document rather than as a choice. A single broad agreement “to data processing”, too vague to be specific to anything. Consent inferred from the act of applying, which covered one vacancy and nothing more. Each of these reads fine in a form builder and fails the moment a regulator, or the candidate, looks closely.

Proof and withdrawal

Two mechanics decide whether consent holds up years later. Proof: the employer must be able to show when the candidate agreed, to what wording, through which action. Withdrawal: it must work with the same ease as the original yes, take effect without delay, and trigger the deletion of whatever was kept on its strength alone.