zlacker

[parent] [thread] 11 comments
1. frereu+(OP)[view] [source] 2018-05-18 08:35:00
This sounds like the arguments that organisations make against freedom of information laws. There is that risk, but what is the alternative? There doesn't seem to be a middle ground to me - either people can make subject access requests or they can't.
replies(2): >>repolf+h >>abraae+l
â—§
2. repolf+h[view] [source] 2018-05-18 08:39:05
>>frereu+(OP)
FOI laws apply to governments, not corporations.

And yes, civil servants did use those arguments to try and stop FOI. They lost because ultimately they pay themselves out of tax revenues, and when you force people to buy something the bar for denying them information about how that money is used is a lot higher.

This doesn't apply in the case of companies and especially not job candidates.

replies(1): >>frereu+D
â—§
3. abraae+l[view] [source] 2018-05-18 08:39:36
>>frereu+(OP)
Not an alternative - but the only obvious defence is to do the right thing, and delete data as soon as you have completed processing. e.g. delete those interview notes the second you have declined the candidate.
replies(1): >>repolf+Q2
â—§â—©
4. frereu+D[view] [source] [discussion] 2018-05-18 08:42:35
>>repolf+h
Fair point about it being public bodies. But my point stands in terms of abuse of the system - the deluge didn't happen.
replies(1): >>repolf+E1
â—§â—©â—ª
5. repolf+E1[view] [source] [discussion] 2018-05-18 08:55:07
>>frereu+D
I have actually seen government agencies complain about being deluged by FOI requests, the cost of dealing with them etc. They mostly get ignored because on inspection the "deluge" of FOI requests tends to be from journalists digging for stories, and that's sort of what we want them to do. Also because the high cost of FOI responses tends to reflect messy and disorganised internal information systems rather than anything fundamental.

That said, I don't think it's really comparable to the GDPR. For one FOI compliance is a joke, organisations get out of it all the time on the thinnest of pretexts. There's no real incentive for a government to police itself in this regard. But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt.

replies(1): >>bkor+l6
â—§â—©
6. repolf+Q2[view] [source] [discussion] 2018-05-18 09:09:17
>>abraae+l
That's ridiculous. Has anyone in this thread actually ever run a recruiting operation?

I have. There's no way we will be deleting interview notes the moment a candidate is rejected. For one, we have to be able to prove later that we didn't reject based on grounds of discrimination (other regulations). But you also need the ability to review what your interviewers are doing to ensure consistency and quality of assessment. We also go back and re-read interview notes if someone doesn't make it through probation or gets fired, to see if we could have picked up on the issue earlier.

But hey GDPR defenders, here's a question to ponder. I have argued above that I legitimately need interview notes for the operation of my business. If you disagree, what makes you so sure your interpretation is correct and not mine? Don't you think it'd be good if we could resolve this disagreement in some clear way, like if the law itself spelled it out?

replies(3): >>Sean17+W3 >>DanBC+i4 >>hartat+TB
â—§â—©â—ª
7. Sean17+W3[view] [source] [discussion] 2018-05-18 09:21:21
>>repolf+Q2
> I have argued above that I legitimately need interview notes for the operation of my business.

I agree that you do legitimately need interview notes, but I don't understand why this conflicts with GDPR. In other words, why am I not allowed to see my interview notes?

replies(1): >>repolf+H7
â—§â—©â—ª
8. DanBC+i4[view] [source] [discussion] 2018-05-18 09:25:42
>>repolf+Q2
The onyl change you need to make is to be able to delete information about criminal offences when those convictions become spent. Arguably that's not a new requirement, but GDPR does make it clearer.

> I have argued above that I legitimately need interview notes for the operation of my business.

That's the point. You're keeping data to comply with a law (Equality laws) or for legitimate reasons, and so you don't need permission and you don't need to delete it when asked.

https://gdpr-info.eu/art-6-gdpr/

> Processing shall be lawful only if and to the extent that at least one of the following applies:

> processing is necessary for compliance with a legal obligation to which the controller is subject;

> processing is necessary in order to protect the vital interests of the data subject or of another natural person;

> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Any of these would suit.

https://gdpr-info.eu/art-17-gdpr/

◧◩◪◨
9. bkor+l6[view] [source] [discussion] 2018-05-18 09:47:53
>>repolf+E1
> But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt.

What do you mean here? It seems to be about suggesting that GDPR is about getting the fine money? Elsewhere the law is quoted where it states the fine should be appropriate to be effective. So even if you don't trust this there's legal ground to back it up. Secondly, why is the EU technically bankrupt? Or is this a theoretical organization?

Appreciate some clarification because currently the sentence I quoted is too open to interpretation.

replies(1): >>repolf+361
◧◩◪◨
10. repolf+H7[view] [source] [discussion] 2018-05-18 10:03:54
>>Sean17+W3
We were talking above about deleting them, not publishing them.

But interview notes tend to contain personal evaluations of people, often critical. If interviewers believe they are effectively having to criticise people to their face (which is what this change would do), then they won't be willing to be as honest. No interviewer wants an angry job candidate tracking them down via LinkedIn or whatever and then getting mad because you wrote that they sucked in their notes.

This is an interpretation of the GDPR that I don't think makes any sense or aligns with the original intentions at all, but moreover, if it was interpreted and enforced that way it simply means firms would switch to discussing candidates in person and not write down evaluation notes at all.

â—§â—©â—ª
11. hartat+TB[view] [source] [discussion] 2018-05-18 15:03:43
>>repolf+Q2
> There's no way we will be deleting interview notes the moment a candidate is rejected. For one, we have to be able to prove later that we didn't reject based on grounds of discrimination (other regulations).

The fun of red tape. You will be violating one or the other regulation, that’s the beauty of it.

◧◩◪◨⬒
12. repolf+361[view] [source] [discussion] 2018-05-18 18:42:07
>>bkor+l6
What does "appropriate" and "effective" mean in the context of law? Put it like this - do you really believe the first targets won't be Google, Facebook, Apple, etc? Very rich companies in industries the EU has failed to compete in and which handle data all day? It's free money for the EU.

Secondly, why is the EU technically bankrupt? Or is this a theoretical organization?

Because its liabilities are greater than its assets, or put another way, it spends more than it receives and does so structurally.

http://bruegel.org/wp-content/uploads/2018/03/PB-2018_01_cor...

EU budget commitments exceed payments by about €10 billion a year, leading to an ever-rising volume of outstanding commitments, known as reste à liquider (RAL). RAL is expected to exceed €250 billion by 2020.

The EU is not a company, it's effectively a government, and so it simply doesn't allow itself to go bankrupt in a legal sense. It can violate contracts at will because it ultimately controls the courts. So when it doesn't have enough money to make payments it has committed to, it simply delays those payments. This results in an ever growing backlog of delayed payments that can't be made because the EU doesn't have sufficient funds.

Note that this behaviour is illegal under the treaties. The EU is not allowed to spend more than it receives. It does so anyway because it correctly believes the member states are too weak to enforce the rules. Also, the EU controls the ECB and ultimately the ECB is keeping many member states afloat via massive bond purchases. Whilst the EU Commission cannot legally just print money to fund its own operations, in practice that's what it's doing - the ECB prints money and uses them to buy the bonds of insolvent member states, which then turn around and hand some of that money back to the EU as part of its budget.

[go to top]