Fine for recruitment company for ignoring requests for removal
The Dutch Data Protection Authority (DPA) has imposed a fine of 6,000 euros on recruitment company Ambitious People Group (APG). APG is being fined because the company had not removed the data of 3 different people after they had requested it.
Job seekers can register with APG* if they are interested in mediation by this recruitment agency. People can of course also request that their personal data be removed, for example, if they no longer want mediation. However, in the case of several people, that went wrong. Names, home addresses, email addresses, telephone numbers, dates of birth and CVs containing information about education and work experience remained in the APG database after the people requested their removal. APG also still approached these people about vacancies.
Right to be forgotten
People have the right to be forgotten. This means that an organisation must remove someone’s data if that person asks for it. This way, people’s privacy is protected.
Organisations must also do their best not to collect and store more personal data than necessary. If there is no good reason to retain and use personal data any longer, it is important that the organisation erases the data. Information that an organisation does not have cannot create a privacy problem. This data minimisation is a starting point of the General Data Protection Regulation (GDPR).
Working method adjusted
After an investigation by the Dutch Data Protection Authority (DPA), it turned out that APG did have a method for requests to remove data. Yet in practice, things went wrong several times. APG has examined its internal policy and adjusted a number of points. The Dutch Data Protection Authority (DPA) took this into account when determining the amount of the fine.
Procedure regarding publication of fine
The Dutch Data Protection Authority (DPA) imposed the fine on APG in 2020. The Dutch Data Protection Authority (DPA) may now make this decision public, after APG has initiated proceedings regarding the fine and its publication.
*APG currently operates under a different name: The Ambitious Group.
