PSA: If you want to know why a company rejected you, send them a GDPR request | Hacker News Reader

PSA: If you want to know why a company rejected you, send them a GDPR request

old.reddit.com

89 pointsmudro_zboris52 comments

This is a great way to permanently damage your reputation and end up with nothing in return.

This is self-defeating. It is very legitimate to ask for what data a company has on you, especially for something that can affect ones livelihood.

The current lack of transparency is not fair to the candidates and is an artifact of people taking legal action (fairly or not) against companies when they didn’t get hired.

Would this work in an indirect way? Say you interviewed at company X which uses saas Z to handle interviews (so all the interview notes and feedback is stored in Z): would saas Z send me all the data they have about me if I can identify myself to them?

Depends on how its structured, but if the SaaS is purely a B2B service for specific things likely not. The data controller is still X, they merely use Z as a data processor for their operations, and as such X has the obligation towards you to answer access requests. Whereas if its a LinkedIn-type thing of "create profile on our site, apply to many companies through it", it likely would look different.

GDPR is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area (so all EU countries + Iceland, Liechtenstein and Norway, but not Switzerland). GDPR comes with a "Right of access by the data subject" to one's own personal information. This is what I believe the OP is using.

A "GDPR request" can be as simple as[1]:

  > Dear...
  > 
  > I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to...

GDPR does not apply to US citizens living in the US, but some federal and state-level (eg. CalOPPA or CCPA) privacy regulations might offer some similar rights (IANAL).

[1] https://www.dataprotection.ie/en/individuals/know-your-right...

The thing about GDPR is that they can’t prove one way or another whether you are or are not a European citizen, so they are legally obligated to fill the request regardless.

Wouldn't making such a request be fraudulent, then?

I'd love to see my interview feedback but abusing GDPR or CCPA to obtain it seems abusive.

It's data about you, GDPR gives you the right to access it. It is hardly abuse.

Hmm, I'm going to have to think about this.

A job applicant is a data subject of the company they apply to. The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary. However, GDPR permits the job applicant to act as a data subject and request the company's proprietary information (produced by employees who expected to remain semi-anonymous to provide candid feedback).

If that's the case, I think I have another in a long list of items to add to my list of "why GDPR is a crazy law and the implications weren't completely thought-through"

> The company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary.

To phrase it bluntly, a company needs to consider what laws apply to it before it forms such expectations. I'm sure some company also compiled databases of addresses for advertising purposes to based on the expectation that their internal data is kept proprietary, also doesn't work like that. Also note that an obvious solution to having to disclose data is not having it. Plenty places will have you re-interview if you re-apply anyways, so justifying why they keep detailed interview notes around is an interesting question, assuming this request comes after the process has ended.

> (produced by employees who expected to remain semi-anonymous to provide candid feedback).

Employees don't just expect that, they have a legal right to it. "my personal data" does not include "who did interview me", and the company has to protect the personal details of its employees. (presumably why the reddit OP mentioned data being redacted)

I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery.

So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved.

Just being able to read interview feedback is enough to recognize who wrote it.

But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around...

GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.

> Just being able to read interview feedback is enough to recognize who wrote it.

While that might be true internally, I think it's pretty unlikely that a candidate had enough of a sense of each person's writing style (especially if the interview was conducted via voice, as is typical)

> So I do think that companies shouldn't really have anticipated this when they formed their expecftations, unless they were formed after GDPR was approved.

The GDPR was passed in 2016. I feel like 5+ years is plenty of time to re-adjust expectations.

At this time, I believe that the law (either GDPR or CCPA) itself does not require companies to disclose confidential interview notes. Certainly when I worked at Google during GDPR they reorganized massive amounts of data storage to comply with that, but I don't recall anybody doing hiring saying GDPR applied.

From I can tell a random throwaway made this post on reddit, it may have happened, but it doesn't mean that companies are required to do this. I would like to see more supporting data.

GDPR very explicitly applies; see eg ICO (the UK DPA) guidance, or this: https://www.dickinson-wright.com/news-alerts/the-gdpr-covers...

As I mentioned above, CA privacy laws exclude this information.

That's for employee, not applicant data, though.

ok, in my comments I glossed over the fact that you specifically argued about the interview notes a bit, which maybe are not as clear as other data points.

But that on the other hand that applicant data is personal data that falls under GDPR and that applicants can request their data is quite obvious, and that notes contain "personal data" about a person is also established, so you'd really need a specific argument why they don't fall under the access request requirement.

At least in the German case law I've seen, it's by now established that internal notes etc about a person also count specifically for the data access request - a prominent case was someone suing their insurance company for all internal records.

> I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

The basic legal principle (GDPR article 6) is that processing data about people is allowed only if a specific legal basis applies, and only to the extent that this legal basis allows it.

So before we're even talking about expectations of the availability of this data - e.g. detailed interview notes in some company HR system (personal notes of specific interviewing employees would not count if these notes are not used in the company processes) - the company must consider why do they think they are allowed to record and store that data in the first place, since the "default expectation" is that they are not. And if they have a valid reason, they are required to have their Data Protection Officer to know that they are processing this data and it's the duty of the DPO to inform these people about what exactly they are permitted and required to do with this data - so if the people recording this data have a misleading expectation, that's fully the fault of the company. Before "the company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary" it's the duty of the company to ensure that this processing of private data is reviewed, verified whether that processing is lawful in the first place and ensure that the people recording this information are informed about what they can/can't/must do with it, as the law requires the company to either ensure "appropriate organizational measures" for that, or not process this data at all. If the company has their employees "simply" producing data that includes personal data of others without considering the GDPR impact, that by itself is a breach of their legal duty of Article 24 of GDPR.

In situations like these, most companies would assert that they have a specific legitimate interest (article 6.1.f) in processing the data for conducting the interview and application decision process, which is a perfectly valid justification - however, that would not necessarily grant them the right to process the data after the interview process ended with a rejection; there's no inherent right for the company to just continue storing the detailed interview notes just because, so it would be interesting to see what legal basis they assert for having that data in the first place, and IMHO in most EU companies the standard HR process now would require to discard the details after the interviews.

At least in Germany it seems storing records for up to 6 months is common, since that's when the deadlines for suing under discrimination law expire and an employer has a legitimate interest in being able to produce detailed documentation about their decision process to defend against such lawsuits. But that's again a very specific thing that justifies it.

This has been the case since long before the GDPR.

The ability to make subject access requests was in the Data Protection Directive which was passed in 1995.

I would just say it has been deleted, so no data is available. Why waste your time with a response?

Because sometimes people who send you such a request might actually already know parts of the data you have on them. Telling them there is _no_ data shows them that you are either untrustworthy or utterly incompetent.

If they are the wrong type of person they might come with a lawyer next.

I’m saying I had no data ever, I’m saying I have none now. Unless you have big bucks GDPR is toothless for stuff like this. I firmly believe data about interviews is private, to the company.

Why do you need big bucks? You make a complaint to the regulator and then they do the heavy lifting on your behalf.

I'm sure it's that simple. You'll need big bucks to get a lawyer and prepare a compliant. The regulator will have bigger fish to fry. One or two people whining about "their" interview data is laughable. Your little complaint will land on the bottom of the stack, where it will stay, forever.

It is.

Are you sure you have none now? This could be very expensive : )

How is someone going to figure out if I actually do, if none of the data is externally accessible?

I tried to use the GDPR angle to close a bunch of old accounts I'd gathered over the last decade. One of them, an MMO, wanted me to provide proof of my EU citizenship by scanning and sending them my passport / national ID in order to proceed.

GDPR applies to non-citizens too, so that requirement was bogus.

GDPR also applies to EU residents, so asking for a passport or national ID is not enough to avoid answering a request.

it also applies to people that just physically are in the EU, no residency needed.

This is a common cop-out and is not specified in the laws whatsoever. If they are slimy enough to require proof (instead of just being good data processors and honoring the request anyway) tell them they should check your IP's location if they really want proof, and that if they do not comply you'll open a complaints case against them with the relevant authority for the country in which you reside.

Citizenship is irrelevant to GDPR.

A non-EU company could probably request at least some proof that you're in scope if they have reasonable doubts about if you are, but I suspect in practice many find it easier to just oblige a reasonable request they have a process for than getting into the weeds of scope and risk getting it wrong. (i.e. I suspect there's some fun legal nuance in scenarios like "I'm a US citizen living in the US that applied and got rejected 3 months ago, now I'm on holiday in Copenhagen and writing an access request" - I could see ways of arguing that either way depending on the circumstances, but also am not a lawyer). Although a request for interview information like this might be enough hassle to be restrictive.

It's not actually that unfeasible. A pretty standard first step in complying with a Subject Access Request is to verify the identity of the person you're talking to (wouldn't want to hand over a load of personal data to some random after all), so checking their nationality at the same time isn't miles off.

again: citizenship/nationality/residency doesn't matter.

A non-EU company, or a company that believed a data subject was not subject to GDPR, would definitely demand some proof the company was GDPR obligated before handing over job applicant or employee data, since that is likely being used to prep for a lawsuit.

You can't fly to Copenhagen and submit a request if the employer and application took place in eg the US. That's all part of the territorial applicability -- you don't necessarily need a presence in the EU, but you do need an establishment through eg stable arrangements. See Guidelines 3/2018 on the territorial scope of the GDPR (Article 3).

I was thinking more multinational corp, where there could be interesting questions if the US could in edge-cases still count as touching the context of the (clearly existing) EU establishment. E.g. if an employee in an EU office happened to do one interview stage or was otherwise involved, they'd have done "data processing" in the EU. Or if the same hiring process and organization also runs the equivalent for EU offices, does that pull it in through same way. Etc. Very possible that not, just not something I'd be confident on for all cases. Of course a large multinational is also likely to have had people look at these questions and design their process around them where needed.

Good point on the lawsuit risk being a reason to be strict though.

One aspect is that for companies within EU it applies for everyone - i.e. if you're an EU company which serves 100% only Chinese and Brazilian individuals and noone within EU, GDPR still applies to you and how you must handle the data of individuals so they all get GDPR rights. Citizenship and residence matters only for foreign companies doing business in EU.

So, if I’m an American who has never been to the EU, could I file a GDPR request against Google Europe or whoever?

Yes

You could, however, IMHO the result would be that "Google Europe" (in my case, Google Ireland Limited) would notify that they and their subsidiaries have no data on you since they do not deal with your data in any way as you are the customer of "Google USA" and not their customer, unlike all the users Google thinks are in EU and switched their accounts/contracts/etc to the EU subsidiary.

And if your data is processed by "Google USA", then GDPR applies to that processing only if you are "a data subject in the Union".

This is not true. They are allowed to figure out where the request came from, even if it is from IP information.

I had a pretty nasty back and forth with a Grammarly alternative about retention of my data, where he insisted he needed my passport and a whole bunch of other stuff to fulfill the request, to verify I was requesting from Europe. I kindly reminded him that his privacy policy states the site collects IP information.

After about a month of legal threats, the GDPR request was fulfilled.

CCPA excludes most employee data, per CA legislature Bill 25, and the CPRA -- CCPA successor taking effect 1 Jan 2023 -- explicitly excludes it.

you're not an employee if you are interviewed and then rejected.

you too can read the bill, and if you did, you'd find out that employee data is shorthand for

> natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business, as specified

I reside in the US (not California), but I used to reside in the EU and California.

Can I make requests for data generated during my time in the EU/California?

IANAL but no. The request must come from an EU resident, as per my understanding. I cannot speak for the California laws.

>IANAL but no. The request must come from an EU resident, as per my understanding

Article 3 (Territorial Scope) of the GDPR:

> 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

> 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

> (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

> (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

> 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

So if either the data controller(s) or processor(s) are legally established in the EU or the data subject is physically in the EU then the GDPR applies.

>Can I make requests for data generated during my time in the EU?

Yes.

If a data controller (or processor) is based in the EU then they must comply with the GDPR regardless of where you are/were.

If a data controller (or processor) aren't based in the EU, then they must comply with the GDPR when they're processing personal data about you when you are physically in the EU.

This is set out in Article 3 of the GDPR

> GDPR does not apply to US citizens living in the US

It does, actually. If the data controller is based in the EU then the GDPR applies regardless of where the data subject is.

Reply on news.ycombinator.com