The Personal Data Authority (AP) has fined recruitment company Ambitious People Group (APG) 6,000 euros. APG is receiving this fine because the company had not removed the data of 3 different people after they requested it.
Job seekers can register with APG* if they are interested in mediation by this recruitment agency. People can of course also request that their personal data be deleted, for example if they no longer wish mediation. But this did not go well with several people. Names, home addresses, e-mail addresses, telephone numbers, dates of birth and resumes containing information about education and work experience remained in APG's database after the individuals had asked to be removed. APG also approached these people about job openings.
People have a right to oblivion. This means that in many cases an organization must delete someone's data (1) if the person requests it. So that people's privacy is protected.
Organizations must also do their own best not to collect and retain more personal data than necessary. If there is no good reason to keep and use personal data any longer, then it is important for the organization to delete that data. After all, information that an organization does not have cannot create a privacy problem either. This data minimization is a principle of the General Data Protection Regulation (AVG).
After investigation by the AP, it was found that APG did have a process for data deletion requests. Yet in practice things went wrong on a number of occasions. APG has reviewed its internal policy and made a number of adjustments. The AP took this into account when setting the amount of the fine.
The AP imposed the fine on APG in 2020. The AP may now make the decision public, after APG filed lawsuits over the fine and its disclosure.
*APG now operates under a different name: The Ambitious Group.
(1) https://autoriteitpersoonsgegevens.nl/themas/basis-avg/privacyrechten-avg/recht-op-gegevens-verwijderen#voor-organisaties-recht-op-gegevens-verwijderen-in-de-praktijk
