CERs Data Privacy & Candidate Information Security 2

Question 1

What does 'purpose limitation' require of recruiters handling candidate data?

Accepted Answer

Using candidate data only for the specific recruitment purpose for which it was originally collected

Answer

Limiting the total number of open requisitions a recruiter can manage simultaneously

Answer

Setting restrictions on how many candidates can apply for a single position

Answer

Prohibiting recruiters from contacting the same candidate more than once

Question 2

A recruiter accidentally receives a candidate's unsolicited medical records. What is the most ethical course of action?

Accepted Answer

Securely destroy or return the records and inform the sender that the transmission was an error

Answer

Review the records since they were received and may contain relevant information

Answer

Store the records in a restricted folder but refrain from referencing them in decisions

Answer

Forward the records to the hiring manager so they are aware of the situation

Question 3

Under GDPR's 'right to erasure' (right to be forgotten), what obligation does a recruiter have when a candidate formally requests deletion of their data?

Accepted Answer

Delete all of the candidate's personal data unless a legal obligation requires retention

Answer

Archive the candidate's data and make it inaccessible but not permanently deleted

Answer

Inform the candidate that deletion is not possible once data has been entered into the ATS

Answer

Transfer the data to a third-party storage service before deleting the local copy

Question 4

What is the primary purpose of a candidate-facing 'privacy notice' in the recruiting process?

Accepted Answer

A document informing candidates what personal data is collected, why it is processed, and how it will be used

Answer

A warning to candidates who submit applications containing excessive personal detail

Answer

An internal policy restricting recruiter access to applicant files without manager approval

Answer

A legal liability waiver that candidates sign before participating in interviews

Question 5

Which categories of candidate information are classified as 'sensitive' or 'special category' data under most major privacy regulations?

Accepted Answer

Race or ethnic origin, health status, religion, and biometric data

Answer

Prior work history, employment gaps, and professional references

Answer

Educational qualifications, degrees earned, and professional certifications

Answer

Contact details such as email address, phone number, and mailing address

Question 6

When configuring an Applicant Tracking System (ATS) for a recruiting team, which data security measure is most critical to implement?

Accepted Answer

Implementing role-based access controls so users can only view data relevant to their role

Answer

Granting all recruiters unrestricted access to maximize team collaboration and speed

Answer

Storing all candidate data exclusively on local servers without cloud redundancy

Answer

Disabling system audit logs to improve overall ATS performance

Question 7

What is the primary purpose of a Data Processing Agreement (DPA) executed between a recruiter's organization and a third-party background check vendor?

Accepted Answer

To ensure the vendor processes candidate personal data in compliance with applicable privacy laws

Answer

To establish pricing and service-level terms for the background screening contract

Answer

To transfer all legal liability for data breaches from the organization to the vendor

Answer

To authorize the vendor to use candidate data for their own marketing and research purposes