How to handle CVs / resumes with GDPR rules?
<p>As a consultant my resume is personal information which is handed out to prospective clients frequently.</p>

<p>How personal should it be? Should some data be anonymized?
Should the resume be returned from prospective clients?
Is there any way to enforce a client to treat it confidential?</p>

<p>In answer to your questions, always get potential clients to sign a contract which covers the GDPR personal data processing requirements at a minimum, prior to giving them a copy of a consultant resume to retain. If you were sat in a meeting with them it is much simpler to record in your logs that the client had sight of the resume but was not left a copy of it in any format, than it is to keep track of which clients have a copy of which data and chasing up to ensure it is erased/destroyed when appropriate.</p>

<p>To ensure clients treat the resumes as confidential, make sure they are labelled in the header and footer as confidential. They could also be kept in an envelope clearly marked confidential. There could also be a footnote in small print that informs anyone with a copy, who the data controller is, and that processing is strictly subject to the terms of the 'client contract' or whatever you call it, and that it should be returned or shredded within X days of receipt for example. 
If you have a computer system generate these it could even specify the client's name and the specific date it should be shredded by. Your notice could include a reminder that the personal data is protected under the E.U. General Data Protection Regulation (GDPR) 2016 and that (client name) as a data processor could be held liable in the event of unauthorised disclosure or processing, if they act outside or contrary to lawful instructions of the data controller. </p>

<p>Whilst this won't enforce responsible processing at least it will ensure that your business has done its best to ensure any recipients are fully aware of their responsibilities to protect the information and it would be very difficult for a client to claim they weren't aware the information was confidential or that they had legally binding responsibilities to protect it.</p>

<p>It's also worth noting that simply sending CV's/resumes (or other personal data) out via email (unless suitably encrypted) would not meet the requirement in GDPR recital 39 for personal data to be "processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing." Email technology whilst convenient does not offer any guarantees regarding privacy and confidentiality, therefore instead of sending resumes as email attachments it might be better to use a web-based extranet system which authenticates users before granting access to view resumes. Emails could just let clients know there is a new resume or X number of resumes waiting for them to review and give them a link/button to login.</p>

<p>The records of processing activities are in GDPR Article 30 on page 50, and it does not specify a retention period nor that we can choose the retention period, but simply states that data controllers make the records available to the supervisory authority when requested to do so - this may imply indefinite retention of processing records even beyond the life of the processing system (e.g. discontinued products/services), however we may need to await further clarification on this issue from supervisory authorities to be sure.</p>

<p>I have been through this with HR now and this is what we have concluded.</p>

<h1>Consultants resumes</h1>

<ol>
<li>Resumes are personal data.</li>
<li>Sending out a consultants resume to a prospective client requires the consultant's consent. Although this may be essential to the job and thus consent is implicit.</li>
<li>Sending out a consultants resume must be logged.</li>
<li>Client's are not allowed to share this or keep it any longer or for any other reason than prospect states. Enforcing it is the client's responsibility, but confidentiality and handling of resumes may have to be mentioned in the prospects. </li>
</ol>

<h1>Job applicants resumes</h1>

<ol>
<li>Resumes are personal data.</li>
<li>You are not allowed to share this or keep it any longer or for any other reason than the job posting states. </li>
<li>You must ask for applicants consent to keep it longer or share it with other companies or other departments.</li>
<li>If this results in a contract then you may keep resume for records, otherwise resume must be deleted.</li>
<li>It must be logged, when received, sharing and when deleted.</li>
</ol>

<p>What we do not have an answer of is how long to keep the logs? We decided 3 years for now?</p>

gdpr