When a candidate is rejected there is period of to months they can sue for discrimination. After that one additional month is considered to be justifiable. So everything has to be destroyed three months after the rejection letter if there is no discrimination case.
I was thinking for example: I can request a copy from my employer of HR docs specific to me. Does this only apply because I'm employed, or does it extend to interview notes?
Think multi device ad retargeting. How cool would it be to get back information on what the ad exchange thinks I am like...
I'm also thinking about the rights of everyone including criminal (including terror) suspects to see (I am specifically not asking permission to alter or delete, that's another conversation) all the information the government (and their agents in the private sector) stores about them.
I know it sounds onerous specially because of the issue of authentication (how does the CIA know that it is me who is asking for information about me and not someone impersonating me?) and I don't have a good solution for these questions.
"We're not banning thoughts, just those that are inside books."
Scanning paper HR records was the single most painful job we had to do. The entire file became a complete legal nightmare purely because it stopped being paper and became covered by Data Protection.
Usually the HR department had to go through every single employee file and shred any documents that might be grounds for legal action before they got scanned.
The process before scanning was: - employee is annoyed - employee requests their HR file - HR sanitise file and sends it to employee
after scanning, every single page was indexed. So they couldn't react to a request by destroying pages (because there'd be holes in the index). So they had to sanitise every single file before scanning.
I understand the point of Data Protection law, but in this case it was really counter-productive. Evidence was destroyed wholesale.
Not our HR process, our customer's. What was actually destroyed depended on their interpretation of the law.
One common one was the Data Protection requirement to not keep inaccurate data meant that all but the latest employee change of address forms had to be destroyed. Easy to implement post-scanning, pain in the arse to do pre-scanning.