GDPR - are you getting emails from recruitment agencies?

[DaveB]

Yes, had quite a few. Mostly from agencies I've never heard of.

I think the requirement to opt in is because many agencies harvested details from the likes of jobserve and never gained explicit consent. So they have to prove that you want them to hold your information. I suspect that the old job website T&C's that said your data was theirs to sell to whomever they wished are not good enough for GDPR compliance.

This.

The market for commercially harvested and sold contact lists is going to vanish after GDPR comes into effect. In order for it to work anyone buying a mailing list has to get evidence from the seller that everyone on that list has explicitly consented to being contacted by the buyer. This is never going to work in practice and I've had several "lively" discussions with marketing managers about it.

You can distribute marketing material under the banner of "Legitimate Interests" but you have to conduct an assessment of whether your legitimate interests as a business carry more weight that the privacy expectations of the subjects. In essence, if they would not reasonably expect you to contact them, then you can't and if you do and they complain to the ICO you may find yourself on the wrong end of an ICO investigation.

So, if you have had dealings with an agency in the past to discuss a role or put forward for one, then they can reasonable expect you not to be unhappy if they contact you in the future, and you should not be that surprised if they do, unless you have told them otherwise. If they've never had contact with you before then spamming you without warning is a no-no.

[Stevie Wonder Boy]

Interesting to see how GDPR is interpreted differently between agencies and in general.
Getting so many emails - mix of re-consent , here is an updated privacy policy, competitions to re-consent and some no contact. My understanding is that if data is collected correctly in the first place and legitimate interest no need for re-consent. And if they are a relevant company then why wouldn't I engage for more. Are you getting many emails?

<modsnip>

[PerfectStorm]

Actually another thought - while some agencies might be able to make a case for consenting communications, the "98% takehome via a loan held in trust in Mauritius " lot certainly won't, so it should help with shutting them up.

[DaveB]

Actually another thought - while some agencies might be able to make a case for consenting communications, the "98% takehome via a loan held in trust in Mauritius " lot certainly won't, so it should help with shutting them up.

Indeed, see my post above re. the legal basis for doing this.

If you do get any more after the 25th then send them a Subject Access Request. They can't charge for it under GDPR and have to respond within 30 days. If they don't then report them to the ICO

[washed up contractor]

Just got my first notification of removal from agency's database due to GDPR and not having given my consent for them to retain my data.

Well done Smart Sourcing, whoever they are!

[Eirikur]

Getting about 10 - 15 per day now . Loads of agencies I've never used (got all my applications back to 2005 in my history folder)
Most agencies also don't understand GDPR as you have to email them or visit their website to opt out

[saptastic]

Getting about 10 - 15 per day now . Loads of agencies I've never used (got all my applications back to 2005 in my history folder)
Most agencies also don't understand GDPR as you have to email them or visit their website to opt out

what should they be offering ?

[Eirikur]

what should they be offering ?

You have to opt in, if you don't do that you are automatically opted out

[DaveB]

Getting about 10 - 15 per day now . Loads of agencies I've never used (got all my applications back to 2005 in my history folder)
Most agencies also don't understand GDPR as you have to email them or visit their website to opt out

Depends on what they are citing as their legal basis for processing.

If they are claiming Legitimate Interests rather than Consent, which they can do if you've previously dealt with them in any way - Sent them a CV, responded to a job email etc. then you do need to opt out. In that case they can argue that you would reasonably expect them to contact you about roles in the future as you have engaged with them on that basis in the past, and it doesn't give rise to an unreasonable risk to your privacy. You can ask them to stop doing it, but that is where you have to actively opt out.

The ones that need consent are the ones who have never had any previous contact with you other than them sending you stuff. They are the ones who will have to remove you from their lists if you don't actively opt in.

[saptastic]

Depends on what they are citing as their legal basis for processing.

If they are claiming Legitimate Interests rather than Consent, which they can do if you've previously dealt with them in any way - Sent them a CV, responded to a job email etc. then you do need to opt out. In that case they can argue that you would reasonably expect them to contact you about roles in the future as you have engaged with them on that basis in the past, and it doesn't give rise to an unreasonable risk to your privacy. You can ask them to stop doing it, but that is where you have to actively opt out.

The ones that need consent are the ones who have never had any previous contact with you other than them sending you stuff. They are the ones who will have to remove you from their lists if you don't actively opt in.

Yes that is my understanding and well articulated!

If you have registered with them and that registration was clear i.e. T&C's, ability to unsubscribe etc then they dont need reconsent.

Of course if someone got your details in a way that was not through a contract/legitimate sign up etc then they should ask for reconsent to carry on.