Chapter 2 — Privacy and data protection: service and stakeholder context
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 How recruitment works"]
N2["2.2 Stakeholders"]
N3["2.3 Roles"]
N4["2.4 Candidate expectations"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 How recruitment works"]
N2["2.2 Stakeholders"]
N3["2.3 Roles"]
N4["2.4 Candidate expectations"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 How recruitment works]
|
v
[2.2 Stakeholders]
|
v
[2.3 Roles]
|
v
[2.4 Candidate expectations]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) describe Halden's processing and stakeholders; (2) identify controller and processor roles; (3) understand candidate expectations.
2.1 How recruitment works
Halden advertises roles, receives applications, screens CVs, interviews candidates, collects references, sometimes arranges background checks and sends shortlists to client employers. Each step processes personal data. Marta maps the steps with a senior consultant and notes where data come from: candidates themselves, job boards, professional networking sites and referees. She learns that data collected from sources other than the candidate trigger the information duty in Article 14, so Halden must tell candidates where their details were obtained. Job board profiles are a common source for consultants searching for passive candidates.
2.2 Stakeholders
The stakeholders include candidates, client employers, referees, job boards, the background check provider, Halden's consultants and management, and the supervisory authority. Each has different interests. Candidates want fair treatment and discretion, especially when they are still employed elsewhere. Clients want suitable candidates quickly. Consultants want efficient tools. Marta notes that referees are data subjects too, because their names and opinions are recorded, and that their interests are often forgotten in recruitment processes. A referee who gives a frank opinion expects it to be handled with discretion, and a careless disclosure could damage working relationships.
2.3 Roles
Ms. Lin helps Marta work through roles. Halden is a controller for its candidate database because it decides why and how the data are processed. When Halden sends a shortlist to a client, the client becomes a separate controller for its hiring decision. The background check provider acts as a processor for some checks and a controller for others, depending on the contract. Marta uses EDPB Guidelines 07/2020 on controller and processor concepts to reason through each relationship rather than guessing from job titles.
2.4 Candidate expectations
Marta reviews twenty anonymised synthetic complaints from a sector survey. Common themes include CVs sent to employers without the candidate's knowledge, profiles kept for years after the candidate asked for removal and unexpected calls about unrelated roles. She concludes that candidates expect to be asked before their CV goes to a specific client and to know how long they stay on the books. These expectations shape her later work on consent, retention and transparency at Halden. Discretion matters most to candidates who are currently employed and searching quietly.
Worked example
Marta maps recruitment steps and sources, lists stakeholders including referees, works out controller and processor roles with EDPB Guidelines 07/2020 and identifies candidate expectations from synthetic complaints.
Synthetic case. Complaints are synthetic; GDPR Article 14 and EDPB Guidelines 07/2020 are real.
Errors and limits
Roles depend on facts and contracts; record the reasoning for each.
Exercises
- EX006 — Article 14 trigger. When does Article 14 apply at Halden? Rubric: 3 = data obtained from job boards or networking sites;; 2 = mentions other sources;; 1 = vague;; 0 = none.
- EX007 — Forgotten subjects. Which data subjects are often forgotten? Rubric: 3 = referees;; 2 = partly correct;; 1 = clients;; 0 = none.
- EX008 — Client role. What role does a client employer have for its hiring decision? Rubric: 3 = separate controller;; 2 = partly correct;; 1 = processor;; 0 = none.
- EX009 — Role guidance. Which guidelines help decide roles? Rubric: 3 = EDPB Guidelines 07/2020;; 2 = partly correct;; 1 = other;; 0 = none.
- EX010 — Expectation. What do candidates expect before CVs go to a client? Rubric: 3 = to be asked;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 12)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.