Most people are now aware of impending EU regulation GDPR, the General Data Protection Regulations, which is intended to strengthen and unify data protection for all residents of the EU. There are many interesting consequences of GDPR, especially so for employers who hold databases of potential employees.
Some employers are starting to take steps towards making their candidate databases GDPR-compliant well in advance of the enforcement date, May 25th. There are many different interpretations of GDPR and each of the 28 countries involved may apply their own variation on the regulation into their own legal system so there a number of factors that are still unclear.
However, one thing we know from the regulation is that an additional opt-in from candidates already your existing databases may be unnecessary. In order to process their details, you could use legitimate business interest as your legal basis for processing. Legitimate business interest could be achieved if you prove you have an ongoing and genuine relationship with the people on your database. If they are interacting with your emails, text messages, website, social media, job descriptions and other online content, voila; legitimate business interest.
Two international employers I know have applied the belt and braces standard of compliance to their candidate databases however by sending each person an email to ask them to opt in. Neither have received more than 10% opt-in rates and consequently must now delete 90%+ of their candidate databases. This is disastrous.
The trade-off between platinum standard compliance and retaining competitive advantage needs serious consideration.
In preparation, my colleague Billy McDiarmid has developed the world's first GDPR-compliant marketing automation campaigns, now being run by employers internationally.