The Act and how it will influence the questions that will be asked will mainly be dependent on two key factors, he said:

• Are interviews seen as the processing of personal information of prospective employees or ‘data subjects’ as the Act refers to it?
• Is the data collected from prospective job seekers deserving of protection in terms of the Act?

“The second question is perhaps the easier one to answer. The Act’s purpose is indeed to protect personal information, and considering that questions and answers typically exchanged in interview processes are definitely personal information – such as race, sex, views, gender, and education – the interviewee is surely deserving of the protection afforded by the Act,” said de Villiers.

The answer to the first question – whether interview processes can be seen as the processing of personal information – can be found in the definition of processing as stated in the Act, which includes a multitude of acts typically performed in interviews such as collection, receipt, recording, storage, transmission, destroying of information, etc., he said.

What this means in practice 

Broadly put, all state and private bodies, who interview employees, will have to comply with the provisions of the POPI Act during interview proceedings, said de Villiers.

“In practice, this means that the interviewer will need to obtain informed consent from the interviewee when accepting, collecting, processing potential job seekers’ personal information.

“The hurdle to jump over is the concept of informed consent. That means that bodies will have to declare how they are to process the personal information obtained, and obtain consent to process it (in those terms) and no other.”

Human resources specialists, recruiters and public- and private bodies – and any party who could be seen to interfere with the protection of Personal Information – now have a heavy burden on their shoulders during an interview or job placement proceedings and may get sued if found non-compliant, face the hefty fines from the regulator itself, or even imprisonment, de Villiers said.

In terms of section 10 of the Act, employers are urged to obtain only strictly relevant information. They will, at all times, remain accountable to the job seeker to explain what they have done with the data.

“Data on race, for example, can only be processed if essential to identify someone or when it is strictly relevant.”

“Generally, data collected should at all times be purpose-specific. It is advisable that access to records of interview proceedings should be severely limited only to the essential staff on completion of the interview proceedings and be retained solely for purposes of employment equity audits by the Department of Labour.

“So no more CVs lying around in the office or on a database, for an unforeseeable period, for everyone to see,” he said.

In the consent form that interviewees sign, it will be prudent to inform them of this duty to retain records, said de Villiers. He said that the interviewer would have to obtain consent before the information is processed by (or shared with) any further person.

“All role players should ensure integrity, confidentiality and well-positioned organisational measures to be in place, especially if the information is to travel across borders.

“Aspects on which interviewers should tread carefully when it comes to the job seeker include aspects on religious and philosophical beliefs, race, ethnic origin, trade union membership, political persuasion, health or sexual orientation, criminal behaviour, biometric information, etc.,” de Villiers said.

originally posted on BusinessTech