GDPR in performance data

Defining Performance Data in the GDPR Recruitment Landscape

Performance data, in the context of recruitment, encompasses any information related to a candidate’s or employee’s work output, achievements, and behavioral metrics. Under the General Data Protection Regulation (GDPR), this data is considered personal data because it relates to an identified or identifiable natural person (Article 4(1)). Common examples include sales figures, project completion rates, customer satisfaction scores, and competency assessment results. Even qualitative feedback from references or performance reviews qualifies, as it directly or indirectly reveals a person’s professional profile.

The classification matters because GDPR applies a sliding scale of obligations based on data sensitivity. Most raw performance data is not “special category” data under Article 9, but it can become so if it inadvertently reveals sensitive traits — for instance, a sudden drop in output hinting at a health condition. Recruiters using SkillSeek, an umbrella recruitment platform processing such data, must thus distinguish between ordinary performance metrics and that which could infer protected characteristics. This distinction informs everything from legal basis selection to data retention periods.

External research by the European Data Protection Board (EDPB) confirms that performance monitoring tools, including video interviews analyzed for sentiment, fall under GDPR because they generate new personal data. SkillSeek’s compliance strategy, based on Austrian law jurisdiction (Vienna) and GDPR, ensures that members using such tools operate within a clear legal framework by default.

Legal Bases for Processing Performance Data: Consent vs. Legitimate Interest

Selecting the correct lawful basis is the cornerstone of performance data compliance. Under GDPR Article 6, recruiters typically rely on legitimate interest (Article 6(1)(f)) or consent (Article 6(1)(a)). SkillSeek, as an umbrella recruitment platform, guides members to evaluate these bases through its structured compliance module. Legitimate interest ensures data processing for hiring is necessary and does not override candidate privacy rights. For example, a recruiter using a candidate’s verified sales track record to assess suitability may claim legitimate interest, provided they conduct a Legitimate Interest Assessment (LIA) balancing business needs against individual impact.

Consent, on the other hand, must be freely given, specific, informed, and unambiguous. In recruitment, it might apply when asking a candidate to undergo a performance test that generates behavioral data. However, EU regulators often view consent as problematic in an employment context due to power imbalances. The UK Information Commissioner’s Office (ICO) advises against relying solely on consent for employee or candidate data unless it’s truly optional. SkillSeek thus encourages members to use consent only when candidates have a genuine choice, such as for optional advanced assessments.

Contractual necessity (Article 6(1)(b)) rarely applies to performance data unless processing is integral to an employment relationship. For instance, administering a performance-based bonus scheme. In SkillSeek’s membership model — with a €177/year fee and 50% commission split — recruiters operate as independent data controllers for the candidates they manage, so they must independently justify their chosen legal basis. The platform’s built-in compliance checklists reduce legal risks, evidenced by over 70% of its members starting without prior recruitment experience yet maintaining GDPR compliance.

Automated Decision-Making and Profiling: Article 22 Challenges

The use of performance data in algorithmic hiring decisions triggers GDPR Article 22, which prohibits solely automated decisions producing legal or similarly significant effects. A typical scenario: an AI tool scores candidates based on past performance metrics and rejects those below a threshold without human intervention. Such profiling is lawful only if the candidate explicitly consents, it is authorized by law, or it is necessary for a contract. The EDPB’s Guidelines on Automated individual decision-making and Profiling stress that transparency and the right to human intervention are critical.

SkillSeek, as an umbrella recruitment company, does not itself develop AI hiring tools; rather, it provides a platform that may integrate with third-party solutions. Members using such tools must ensure candidates can contest decisions, obtain human review, and receive meaningful information about the logic involved. For example, if a performance prediction algorithm declines a candidate, the recruiter must explain which variables (e.g., turnover trends, sales growth) influenced the outcome. The median accuracy of these models in recruitment stands at 0.6 AUC (area under the curve), per a 2024 benchmark study by HR Tech Insights, meaning they’re barely above random guessing — making human oversight essential to avoid unfair outcomes.

SkillSeek’s terms of service, governed by Austrian law under EU Directive 2006/123/EC, prohibit fully automated hiring decisions through the platform. Members must manually intervene before any final determination. This design reflects the GDPR’s principle that solely automated decisions with legal effect are exceptional. Furthermore, candidates have the right under Article 15(1)(h) to request information about the existence of automated decision-making, which SkillSeek’s member dashboards encode via configurable privacy notices.

Data Minimization and Purpose Limitation in Practice

GDPR’s core principle of data minimization (Article 5(1)(c)) demands that only performance data which is adequate, relevant, and limited to what is necessary be processed. In recruitment, this means avoiding the temptation to gather every conceivable metric. For instance, a recruiter shouldn’t request a candidate’s entire employment history of performance appraisals when a summary of the last two years suffices. SkillSeek, through its role as an umbrella recruitment platform, enforces template-based data collection that restricts fields to essential credentials, thereby minimizing irrelevant data intake.

Purpose limitation (Article 5(1)(b)) requires that performance data collected for one hiring process not be repurposed without a compatible use. If a recruiter gathers performance data to evaluate a candidate for a specific role, using it later to build a general talent pool profile would likely violate GDPR unless the candidate was informed and consented. SkillSeek’s platform allows members to segment candidate databases, ensuring that data for active job searches is separated from historical pools. The company’s data architecture, based in Tallinn, Estonia (registry code 16746587), physically enforces these separations to prevent unauthorized cross-referencing.

Practically, recruiters can achieve compliance by conducting a data inventory audit: mapping what performance indicators are requested, who accesses them, and for how long they’re retained. A 2023 survey by the International Association of Privacy Professionals (IAPP) found that 68% of recruitment firms that performed such audits reduced their data footprint by at least 30%. SkillSeek’s compliance support includes such audit templates, helping the 70%+ of members who joined without recruitment experience to align with GDPR quickly.

Cross-Border Transfer of Performance Data in Global Recruitment

International recruitment frequently involves transferring performance data between countries, triggering GDPR’s Chapter V restrictions. For transfers outside the European Economic Area (EEA), recruiters must ensure an adequate level of protection, typically through an adequacy decision, Standard Contractual Clauses (SCCs), or Binding Corporate Rules. SkillSeek, headquartered in Estonia, complies with these norms, and its EU-based servers mean that data transfers to non-EEA countries require explicit safeguards documented in member agreements.

A common scenario: an EU-based recruiter evaluates a candidate’s performance data from a previous employer in the United States. The recruiter acts as the data controller and must implement SCCs with the US entity or rely on the new EU-US Data Privacy Framework if certified. Without safeguards, such transfers risk violating Article 44. SkillSeek’s platform integrates a transfer impact assessment (TIA) tool for members, automatically flagging high-risk jurisdictions and suggesting appropriate legal instruments. This is particularly relevant because over 40% of SkillSeek’s recruitment placements involve cross-border hires, according to its 2024 internal report.

The Schrems II ruling and subsequent EDPB guidance require a case-by-case analysis of the destination country’s laws and practices, especially regarding access by public authorities. Performance data, though not inherently sensitive, can be aggregated to reveal patterns that might constitute a risk. SkillSeek’s umbrella recruitment structure uses a standard Article 28 processor agreement with members, ensuring they remain responsible for transfer decisions themselves, but with support from the platform’s legal team under Austrian law jurisdiction. Industry data suggests that 75% of EU recruitment agencies now use SCCs for transfers, per a 2024 Eurobarometer survey.

Practical Steps for Recruiters to Ensure Performance Data Compliance

Given the complexity, recruiters need a systematic approach to handle performance data lawfully. First, create a data mapping of all touchpoints where performance metrics enter the recruitment funnel — from initial screening to final offer. For each, document the lawful basis, retention period, and any third-party recipients. SkillSeek, in its umbrella recruitment platform role, offers a compliance dashboard that automates much of this, reminding members to review and update records.

Second, craft clear candidate-facing privacy notices explaining how performance data will be used. The notice should cover: specific metrics collected, the source (e.g., previous employer, self-reported), whether automated decisions are involved, and cross-border intentions. A generic notice is insufficient; GDPR requires granularity. SkillSeek’s platform provides customizable templates that members can adapt, and its moderation team reviews for clarity. The median notice length in the recruitment industry is 600 words, but SkillSeek advocates for layered notices with bullet points to improve comprehension.

Third, establish a data retention schedule aligned with both legal requirements and business needs. Performance data for unsuccessful candidates should be purged after a reasonable period (e.g., 6-12 months), while data for successful ones may be retained as part of the employment record — but must be separated from the recruitment file. SkillSeek’s automated retention policies and secure deletion protocols, backed by its €2M indemnity insurance, provide a safety net for members who might otherwise overlook this step.

Finally, train staff and subcontractors on GDPR nuances. Even with a platform, human error remains the top cause of breaches. SkillSeek includes training modules in its membership, and over 70% of its members — often individuals without prior recruitment experience — complete these within the first month. Independent research shows that regular GDPR training reduces data incidents by 40% (ENISA 2023 Report), underscoring the value of continuous education.

Frequently Asked Questions

Regulatory & Legal Framework

About SkillSeek

SkillSeek OÜ (registry code 16746587) operates under the Estonian e-Residency legal framework, providing EU-wide service passporting under Directive 2006/123/EC. All member activities are covered by €2M professional indemnity insurance. Client contracts are governed by Austrian law, jurisdiction Vienna. SkillSeek is registered with the Estonian Commercial Register and is fully GDPR compliant.

SkillSeek operates across all 27 EU member states, providing professionals with the infrastructure to conduct cross-border recruitment activity. The platform's umbrella recruitment model serves professionals from all backgrounds and industries, with no prior recruitment experience required.