CERs Data Privacy & Candidate Information Security 2

Question 1

What does 'purpose limitation' require of recruiters handling candidate data?

Accepted Answer

Using candidate data only for the specific recruitment purpose for which it was originally collected

Answer

Purpose limitation is a GDPR principle stating that personal data collected for one specific purpose must not be reused for a different, incompatible purpose without new consent.

Question 2

A recruiter accidentally receives a candidate's unsolicited medical records. What is the most ethical course of action?

Accepted Answer

Securely destroy or return the records and inform the sender that the transmission was an error

Answer

Retaining unsolicited sensitive health data creates legal and ethical exposure; the correct action is to destroy or return the data and notify the sender of the mistake.

Question 3

Under GDPR's 'right to erasure' (right to be forgotten), what obligation does a recruiter have when a candidate formally requests deletion of their data?

Accepted Answer

Delete all of the candidate's personal data unless a legal obligation requires retention

Answer

GDPR's right to erasure requires organizations to delete personal data upon request unless specific legal grounds — such as ongoing litigation or statutory retention requirements — justify keeping it.

Question 4

What is the primary purpose of a candidate-facing 'privacy notice' in the recruiting process?

Accepted Answer

A document informing candidates what personal data is collected, why it is processed, and how it will be used

Answer

A privacy notice fulfills the GDPR transparency principle by giving candidates clear, upfront information about how their data will be handled before they provide it.

Question 5

Which categories of candidate information are classified as 'sensitive' or 'special category' data under most major privacy regulations?

Accepted Answer

Race or ethnic origin, health status, religion, and biometric data

Answer

Privacy regulations such as GDPR identify specific categories — including racial origin, health data, religious beliefs, and biometrics — as requiring heightened protection and explicit consent.

(CERs) Certified Ethical Recruiters Practice Test

(CERs) Certified Ethical Recruiters Practice Test

CERs Data Privacy & Candidate Information Security 2