Unravelling GDPR for job boards – Peter Moore

Job boards are in the position of being a data processor as well as a data controller.

The news is filled with coverage on how the introduction of GDPR will impact recruitment agencies. This week, I spoke with Peter Moore of Look at your Data, exploring ways in which this new legislation will alter the ways in which job boards operate.

Steve: Hello Peter.

Pete: Hi.

Steve: We work very closely with job boards. How is GDPR going to be impacting them?

Pete: I think the job boards have got a real, yet manageable problem on their hands. One of the big differences between a job board and a standard recruitment company is the use of terms and conditions. Job boards are in the position of being a data processor as well as a data controller.

Steve: Can you give us an example?

Pete: Let’s say Jane adds her CV to a particular job board, and that CV ends up in the hands of a recruitment company. They quite legitimately go and download the CV and then that recruitment company does something non-compliant with that data. Previously, that was all on the recruitment company as a data controller. Now the data processor needs to tighten up their rules.

Intelligent candidate attraction.
Arrange a free idibu trial now.

Not speaking about job boards specifically because there’d be minutiae about which I don’t know so much about, but the role of the data processor has changed. The best way of describing that came from someone in your organization, Martin Bramall, who said, “It’s like someone introduced the law for handling stolen goods. Or rather someone’s introducing it on May 25th of next year.” I rather liked that because data processors are now complicit, whereas previously it was all the data controller.

Steve: A lot of job boards provide CV search across data providers. What’s going to happen with that data?

Pete: There’s a great scene in the UK version of The Office where Ricky Gervais gets a pile of CVs and he puts half of them in the bin because he doesn’t like employing unlucky people. Now, that is a process. It’s possibly not a documented process; it’s possibly not a standard process, but if you do the automated version of that, there is, “Are you profiling?” Yes, but are you doing automated profiling? The jury’s out on that one.

Steve: So, this is still something that’s very much up in the air?

Pete: We’re waiting to see if entering the terms on a CV search breaks you out of automated processing. Automated profiling is a part of the regulation but we’re kind of waiting on that one. At what point does something become automated?

Steve: Thank you for your time Pete.

Pete Moore (@thedatabloke) is the founder, chief data strategist and GDPR export at Look at your Data.