Between transparency requirements and AGG risks
After a rejection, applicants often remain unclear about why they were not selected. Many companies deliberately refrain from providing reasons to protect themselves from potential discrimination claims under the General Equal Treatment Act (AGG).
In practice, however, it is increasingly common to see applicants claiming rights of access under Article 15 of the GDPR, often with the aim of being able to understand the reasons for the selection decision. This raises the question for companies of what data actually need to be disclosed in the context of the access request and where the limits lie.
Legal starting point
1. No right of information under the AGG
As early as 2012, the European Court of Justice (ECJ) in its Judgment of 19.04.12, C-415/10 On the basis of a decision by the Federal Labour Court (BAG), it was ruled that the relevant European anti-discrimination directives do not provide for the right to know whether and, if so, for what reasons an employer has hired another candidate in the context of a selection process. This applies even if an applicant clearly demonstrates that he or she meets the requirements specified in the job advertisement. However, the Court of Justice of the European Union pointed out that the complete refusal of any information in a given case can constitute evidence of discrimination.
The BAG subsequently issued its subsequent decision on 25.04.2013, 8 AZR 287/08 Among other things, it is held that the mere refusal to provide information regarding the relevant selection criteria in itself does not constitute a single indicator within the meaning of § 22 of the General Equal Treatment Act (AGG). However, such an indicator would be required to substantiate a presumption of discrimination based on a discriminatory characteristic mentioned in §§ 1 and 7 of the AGG.
Therefore, companies are generally not required to justify their selection decision.
2. Right of access under the GDPR
Regardless of this, there is an independent right of access under Article 15 of the GDPR. While the AGG aims to prevent and sanction discrimination, the GDPR aims to create transparency regarding the processing of personal data.
Candidates therefore have the right to obtain information about all personal data processed as part of the application process. The term “personal data” is to be understood in a broad sense. It includes not only objective data but also subjective assessments and evaluations, provided that they relate to the data subject.
Scope of the right to information
H3: 1. What data must be provided
The right to information includes, in particular, application documents such as the CV and the cover letter, the corresponding correspondence (e.g. emails), as well as internal notes or evaluations with personal context, such as documented records of conversations.
H3: 2. Which data do not need to be disclosed
The right of access does not cover purely selection decisions without personal reference, general or abstract evaluation systems, business secrets, or the personal data of third parties. In particular, companies are not required to provide a justification for the refusal.
What is meant by a copy of personal data
The case law has recently further concretized the scope of the right to access information. The European Court of Justice has clarified that the right to a „copy“ generally refers to personal data, not to complete documents. The disclosure of entire documents is only necessary when it is necessary to make the data understandable.
The Federal Court of Justice has further clarified this: Documents written by the applicant himself must be fully disclosed. Internal notes may only be disclosed insofar as they contain personal data. There is no blanket right to disclose all documents.
Importance for companies
The right to information under Art. 15 GDPR is increasingly being used strategically in the application process. However, companies are not required to disclose or justify their selection decision under the AGG in this context. Rather, all personal data must be fully and transparently disclosed.
Conclusion and recommendations for action
A structured application process, a clear approach to requests for information, and the consistent adherence to retention and deletion deadlines are crucial to avoid legal risks while simultaneously meeting legal requirements.
Practical tips:
FAQ
Do companies have to inform rejected applicants about the reasons for their rejection?
Basically no. According to the case law outlined in the article, the AGG does not require companies to disclose or explain their selection decision.
Do rejected applicants still have a right to information?
Yes. Regardless of the AGG, there is an independent right of access under Article 15 of the GDPR. This applies to the personal data processed in the application process.
What data must be disclosed as part of a GDPR inquiry?
These include, in particular, application documents, related correspondence, and internal notes or evaluations with personal reference, for example documented notes of conversations.
Which information must not be disclosed?
In particular, it does not cover purely selection decisions without personal context, general or abstract evaluation systems, business secrets, or the personal data of third parties. A justification for the rejection must also not be provided.
Do companies have to provide complete documents?
Not necessarily. The claim for a „copy“ basically refers to the personal data itself. Full documents must only be issued if this is necessary to make the data understandable. Documents written by the applicant themselves are fully required to be issued in accordance with the article.
How should companies organize their response to requests for information from applicants?
Clearly defined responsibilities, standardized procedures, factually formulated internal notes, and timely processing within one month are recommended. Additionally, retention and deletion deadlines should be observed, and third-party rights and business secrets should be taken into account.
