What is candidate data privacy?
Candidate data privacy covers the legal obligations and good practices that apply to personal information gathered during recruitment: resumes, contact details, interview notes, test results, references, checks, and even scores produced by software. The basic principle is the same everywhere: collect only what you need, for a purpose the candidate knows, protect it, and do not keep it longer than necessary.
What counts as personal information in recruiting?
- Information supplied by the candidate (resume, cover letter, form).
- Information created by the employer (interview notes, scorecards, internal comments, emails).
- Information obtained from third parties (references, background checks, public profiles).
- Outputs of automated processing: a match score or ranking is also information about the person.
Examples by jurisdiction
Quebec. The Act respecting the protection of personal information in the private sector, modernized by Law 25, applies to businesses that collect information about candidates. Its section 12.1 directly targets automated recruiting: a business that makes a decision based exclusively on automated processing must inform the person no later than when it informs them of the decision. On request, it must also tell them what personal information was used, the reasons and main factors and parameters that led to the decision, and their right to have that information corrected. The person must be able to submit observations to a staff member who can review the decision.
Rest of Canada. According to the Office of the Privacy Commissioner of Canada, PIPEDA applies to employee information of federally regulated businesses. For employees of other organizations, only Alberta, British Columbia and Quebec have their own laws covering the private sector. PIPEDA's principles (consent, identified purposes, limited retention) remain a good reference everywhere.
United States. In California, since January 1, 2023, California Consumer Privacy Act (CCPA) protections apply to employee and job applicant information held by covered businesses, including rights to access, correct and delete. In New York City, Local Law 144 requires, before using an automated employment decision tool, a bias audit less than one year old and notice to candidates at least 10 business days before use. Other states vary.
This summary is general information, not legal advice.
Best practices
- Minimize. Do not ask for a social insurance number, date of birth or photo at the application stage.
- Inform. Tell candidates what their data will be used for, who can access it and how long it will be kept.
- Disclose automated tools. See AI in recruitment. A clear notice in the posting avoids surprises and meets obligations such as Ontario's.
- Keep a human in the decision. A decision reviewed by a person is not "exclusively automated".
- Keep a trail. Logging who viewed, changed or decided what makes access requests easier to answer.
- Destroy on schedule. Set a retention period for unsuccessful applications and stick to it.
With RecruitEasy
Job postings published with RecruitEasy show an AI use notice by default, on the posting and the application form. Rejection feedback never goes out without a recruiter's approval, and each approval is recorded with its author. That feedback never mentions location. The activity log keeps the history of actions on applications. The Quebec Law 25 and recruitment guide goes deeper into Quebec-specific obligations.