Australian employers are increasingly using social media to find out about candidates for employment. Information obtained from social media reviews is becoming more accepted as a means for assessing the cultural fit and aptitude of prospective employees. However there may be privacy and discrimination law implications when this information is relied upon to make hiring decisions.
The Privacy Act 1988 (Cth) regulates the way that certain private sector organisations in Australia collect personal information in a record and the use that information. Generally, the Act applies to an organisation that has an annual turnover of more than $3 million. However it may also apply to organisations that have an annual turnover under this threshold if they provide a health service or services to a Commonwealth agency, or they are a business that sources personal information about individuals from someone other than the individual without their consent, or a customer of such a business receiving that information.
The Privacy Act only applies to an organisation when a record is created. For example, if a recruiter views information about a candidate on the Internet but does not make any notes or other record of that information, the Privacy Act does not apply. Given the exposure to general protections or discrimination claims from rejected candidates (see below) it is good practice to document the information relied upon to reject the candidate.
If the Privacy Act applies, the organisation will need to comply with certain principles:
- only collect information necessary for the purposes of recruitment;
- obtain consent from the candidate to collect the information;
- inform the candidate that they have the right to view the information and correct it if necessary; and.
- secure the information, and destroy it if no longer required (unless the candidate authorises you to keep it on file).
Another principle is to obtain the personal information by lawful and reasonable means, in a manner that is not unduly intrusive. The reported practice of employers demanding login details for social media accounts as condition for the job application is likely to contravene that principle, not least because it is inconsistent with the terms of service of Google and Linked-In.
Federal and State anti-discrimination laws do not regulate the collection of information about candidates from social media networks. However the fact that information has been collected and relied upon in making the decision to reject a candidate may become relevant if it is alleged that the reasons were discriminatory. For this reason it is prudent to document the relevant information that was obtained and used in assessing the candidate. It is also important that the information collected and record have direct relevance to the job requirements.