Company makes confidential CV publicly available and searchable. Legal recourse?
<p>A friend of mine was looking for a job last August. She sent CVs for various positions.</p>

<p>Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure enough, the first result is her CV in PDF format, from the website of one of the companies she contacted. The link is in a <code>wp-content/2018/08</code> format, which means it was uploaded on their website, but it’s freely available for anyone to search and download it.</p>

<p>My question is: <strong>does she have any ground for legal action? Is such action worth the effort in terms of compensation?</strong></p>

<p>The location is Cyprus, covered by EU and GDPR laws.</p>

<p>She could refer this to the <a href="http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_el/home_el?opendocument" rel="noreferrer">Cyrpriot Commissioner for Personal Data Protection</a>, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an official complaint is likely to take longer.</p>

<p>She may have grounds for legal action which would result in the company being compelled to take down the data (or to close the website), but if your friend is thinking in terms of compensation, what compensation would she seek? If she can demonstrate and quantify financial losses that occurred specifically because of this disclosure there might be a possibility, but I suspect that would be difficult to prove.</p>

european-union gdpr data-protection