CERs Data Privacy & Candidate Information Security

Question 1

According to GDPR storage limitation principles, how long should candidate personal data be retained after a position is filled?

Accepted Answer

Only as long as necessary for the original recruitment purpose

Answer

For a minimum of 5 years for compliance documentation

Answer

Indefinitely, provided the candidate gave initial consent to apply

Answer

Until the candidate formally requests deletion, regardless of business need

Question 2

Which US federal law primarily governs the use of background check data in recruitment and requires written candidate consent before conducting a consumer report?

Accepted Answer

Fair Credit Reporting Act (FCRA)

Answer

Americans with Disabilities Act (ADA)

Answer

Title VII of the Civil Rights Act

Answer

The Privacy Act of 1974

Question 3

What does 'data minimization' mean in the context of ethical recruiting?

Accepted Answer

Collecting only the personal data that is strictly necessary for the recruitment process

Answer

Reducing the digital file size of candidate resumes to save storage costs

Answer

Limiting the total number of candidates stored in the ATS at one time

Answer

Using data encryption to minimize the risk of unauthorized access

Question 4

Under the California Consumer Privacy Act (CCPA), which right do job candidates have regarding their personal data collected by a recruiter?

Accepted Answer

The right to request that their personal data not be sold to third parties

Answer

The right to demand monetary compensation for providing their personal data

Answer

The right to access only their publicly available information held by the employer

Answer

The right to prevent all data collection during the application process

Question 5

What constitutes valid 'consent' for candidate data collection under modern privacy regulations?

Accepted Answer

Explicit, informed agreement from the candidate before their personal data is collected and used

Answer

The employer's internal policy that authorizes data collection on all applicants

Answer

A verbal agreement made during the initial phone screen with the recruiter

Answer

Automatic consent assumed when a candidate submits an online job application

Question 6

When storing candidate resumes in a shared recruiting environment, which security measure is most critical?

Accepted Answer

Implementing access controls so only authorized personnel can view candidate personal information

Answer

Sharing resumes freely among all HR team members to maximize collaboration efficiency

Answer

Storing resumes on personal laptops for convenient remote access

Answer

Printing resumes and storing physical copies in a locked filing cabinet

Question 7

What is the ethically correct immediate action when a recruiter discovers a data breach involving candidate personal information?

Accepted Answer

Notify affected candidates and relevant regulatory authorities promptly, as required by law

Answer

Quietly remediate the breach internally without notifying candidates to avoid reputational damage

Answer

Delete all candidate data immediately to prevent any further exposure

Answer

Notify candidates only if the breach specifically involved their financial information