Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview? Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview process, the recruitment panel makes some sort of quantified assessment of each candidate after the interviews have been completed. Do I have the right of access to such assessments relating to myself? In case it matters, this relates to job interviews at national and supranational governmental organisations within Germany, after the candidate has been formally notified that she/he has been unsuccessful.
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
Can job interview questions be confidential? Is this legally enforceable? It is lawful, unless the nature of questions is outlawed or hinting at illegal activity. For practical purposes, though, confidentiality would be hard to enforce because Google cannot realistically prevent you from disclosing those questions. Whether or not Google can remedy any breach of that clause, that is a separate and uncertain aspect. Google's clause is binding only if you consent to it. Signing an NDA is not the only way to render confidentiality binding. Consent can be evidenced by anything that reflects your agreement to abide by that condition. It could be an email reply, or by subsequent conduct such as attending the interview with knowledge that constraint and without objecting to it. The fact that you attended the interview after reading that email makes their clause binding unless you objected and they nonetheless conducted the interview.
This question shows a misconception of GDPR. GDPR creates an obligation not just towards the data subject but also towards the authorities of the relevant state(s). The data subject cannot waive your responsibility to safeguard data, document internal processes, etc. GDPR is not a blanket ban on the handling of personally identifying information (PII). Informed consent is one of the ways to get permission to process and store this data. If your data subjects are prepared to give your sweeping permissions, ask for consent (informed, revocable, etc.), document the consent, and go from there. The data subject does not get to decide what classification data falls under. If you collect, say, medical data, then you are subject to increased restrictions and safeguards.
By itself, a chess position is not personal data. Personal data is “any information relating to an … identifiable natural person”. Since the file in question includes the name of the opponent, it is clearly personal data about the opponent. If the files are used for “purely personal or household purposes”, the GDPR won't apply per Art 2(2)(c). If the files are shared more widely – especially if the files are published – then GDPR becomes relevant. The person/entity who is data controller has to consider GDPR compliance. Data controller is whoever determines the purposes and means of processing of personal data (the “why” and “how”). The first question would be under which legal basis this personal data about another person can be shared. The GDPR offers multiple legal basis, notably “legitimate interests” and “consent”. Consent is always an option, but must be freely given (entirely voluntary). Legitimate interests can serve as a legal basis after a balancing test between your interests and the data subject's rights and interests. This balancing test also depends on the reasonable expectations of the data subject, which in turn depends on the more general context. For example, in a chess community where such sharing is completely normal there would likely be a legitimate interest for you to share games as well, if the games occurred in the context of this community. But if you play a game with a friend who is not part of this community, the friend cannot reasonably expect that their name and associated personal data would be shared. The second question would be how you would satisfy further GDPR compliance obligation, in particular the Art 13/Art 14 right to information. When collecting personal data, it is necessary to provide certain information such as your identity, what processing is being carried out, and how the data subject can invoke their GDPR rights (a privacy notice or privacy policy). This might be difficult or awkward to do. Practical solutions to these problems: If you want to share a game but aren't sure that the opponent is OK with this, remove identifying aspects such as names. For example, you could crop a screenshot, or describe the game in textual notation without listing the opponent's name. Play the game via a chess website that publishes the game. This way, the website is the data controller, and you and the opponent are the data subjects. This avoids having to act as the data controller yourself. This might work for private interactions, but not e.g. if you run a chess club and require members to play via that website – you might still be in a data controller role then and have full compliance obligations.
People are laid off all the time when sales are down, the market is bad, etc: there is no legal "right to a job" except whatever is in your employment contract. There is a legal concept of promissory estoppel which boils down to promises being binding. However, there has to be a clear and definite promise, not for example a statement like "we hope to bring you back after this is over". Normally, the employer can argue that they have the right to fire you regardless of performance, and that would be the end of it. Let's say you have it in writing, and it is clear that they unconditionally promise to hire you back: you would want to (e)stop them from arguing that they have the right to fire you. The underlying idea of promissory estoppel is that such a promise keeps them from making that argument. But: it is not enough that they made the promise, you also had to rely on the promise and act / forbear from acting in some way because of that promise. It could be, for example, taking another job, or moving to another country, or simply looking for another job. The hard part, then, would be getting a clear and definite promise.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
It sounds like you've read about two party consent and public spaces. But while anyone can sue, it's winning a case that's relevant. "My client respects the applicant's beliefs, but choosing to express beliefs in such a way during a job interview indicated sufficiently questionable judgement that my client was unable to consider the applicant further for the advertised position." "It has also become apparent that the plaintiff was not acting in good faith in making an application for employment." Court finds for the defendant and orders the plaintiff to pay costs.