On July 11, 2019, the Commission for Personal Data Protection (CPDP) issued an opinion aiming to bring practical clarity to the contradiction between the Bulgarian Personal Data Protection Act (PDPA), amended in February this year, and the Law on Protection against Discrimination (LPAD).
The contradiction is with regard to the statutory retention periods that employers must comply with when it comes to storing personal data of job applicants.
While according to the newly amended PDPA, the period for storing the personal data of the participants in the procedures for recruitment and selection of personnel cannot be longer than 6 months (Art. 25k, para. 1 of the PDPA), the Law on Protection against Discrimination provides 3-year period (by argument of Article 52 of the LPAD), during which an unsatisfied candidate for a job may make claims to the employer that he was discriminated against during the selection, respectively, the personal data of the candidate himself are necessary for the employer to be able to defend himself and to rebut allegations of discrimination on his part.
Hence the logical question, namely: for how long should an employer store the personal data of the participants in the procedures for recruitment and selection of personnel, while simultaneously respecting the conditions of art. 25k, para. 1 of PDPA and taking into account his legitimate interest in keeping of this data for a period of 3 years, in order to protect his rights in possible proceedings in accordance with the Law on Protection against Discrimination?
After a well-reasoned and consistent presentation of the reasons and explanations for such a contradiction, CPDP’s position succeeds in striking a balance between the legal requirements of the two laws, considering the documents containing the personal data of job applicants in two groups – primary and secondary.
Primary documents are all the necessary documents for applying for a specific job, such as CVs, cover letters and other documents proving specific experience (language skills, etc.). These documents containing the personal data of job applicants shall be kept in accordance with Art. 25k, para. 1 of the PDPA, that is not more than 6 months from the moment of the final completion of the recruitment procedure, after which the same data should be deleted or destroyed.
On the other hand, secondary documents containing the personal data of job applicants are all internal documents related to the recruitment and selection procedures provided by the employer, such as tests, interview protocols, etc. These documents should be kept for a period of three years, which is related to Art. 52 of the LPAD.
Thus, the CPDP’s official position succeeds in satisfying both the rights of job applicants, with regard to the lawful storage of their personal data, and of employers, who will be able to effectively defend themselves against possible claims against them for violation of the anti-discrimination rules.