Germany: Adopted HmbBfDI statement on protecting personal data in recruitment processes

On 6 June 2024, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) adopted a statement on protecting personal data in recruitment processes. The HmbBfDI notes that the General Data Protection Regulation (GDPR) principles such as legality, purpose limitation, and data minimisation must be adhered to when processing applicant data, with clear information obligations under Articles 13 and 14 of the GDPR. Further, the HmbBfDI noted that the use of artificial intelligence (AI) applications in recruiting, from job postings to interview analysis, brings efficiency but also data protection challenges. Technologies such as resume parsing and LLM chatbots must comply with GDPR, ensuring human oversight in decision-making.