GDPR is all over the news – mainly as fear inducing headlines aimed at the processors and controllers of personal data – but what does it actually mean for interims who want to be contacted about suitable roles? It may mean they need to increase their efforts to remain visible in the digital world as intermediaries clean up their data in advance of GDPR.
Update your profile with B2E Consulting - https://goo.gl/q2sc2n
What’s changed under GDPR?
The Data Protection Act, which GDPR replaces, was largely based around eight common sense principles relating to the use of personal data. The GDPR recognises that everyone’s idea of common sense might not be the same, and codifies these principles in much more detail. Crucially, it also asks every company to document and prove how it adheres to the principles.
Where have you posted your CV online?
One of the key ideas in GDPR is that a company must have a lawful reason for processing your personal data. The easiest of these to understand is “consent” (i.e. you have expressly given your consent for your data to be stored and processed).
However, consent is only one of the lawful reasons for processing personal data allowed under GDPR – for most job hunters, the next most likely is “Legitimate Interests”. This is where a company can use your personal data for their own business interests, as long as those interests don’t conflict with your own.
For example, if you have posted your CV in a public job board then an agency or recruitment company can reasonably assume that you are happy to hear about roles, and it is certainly in their legitimate interest to do so. However, the company must be able to show how it is balancing your needs with theirs, and clearly explain to you how they are using your data.
What rights does GDPR give you?
Over the next few months, there will be a flurry of emails from companies, telling you about the data they hold for you, and asking for permission to process it. You now have rights over this data which are:
the right to be informed; companies must tell you what types of personal data they are holding, why they feel this is lawful, how they are going to use the data and how long they are going to keep it for
the right of access; you can ask to see all of your personal data
the right of rectification; you must have the right to change any personal data which is inaccurate or incomplete
the right to be forgotten; you can ask for personal data to be erased and for processing to cease
the right to object; you can always object to processing (eg direct marketing, or processing based on legitimate interests)
rights related to profiling and automated decision making; if you feel that decisions are being made automatically based on your profile, you can object and insist that there is human intervention
What should you do?
B2E Editorial Team
The B2E Editorial Team brings together perspectives from across the B2E Consulting community, including consultants, partners, and subject matter experts to share insights on transformation, leadership, and the consulting industry.
