Using Candidate CVs from LinkedIn: GDPR Limits in Recruitment

Using candidate CVs obtained from LinkedIn may be lawful in some recruitment processes, but it does not mean that the company can use that data for any purpose. A visible professional profile does not turn all candidate data into free information for marketing, commercial databases or unrelated communications.

What the Spanish Data Protection Authority says

The AEPD addresses this issue in its guide Data protection in employment relationships. During recruitment, companies must respect data minimisation, inform candidates and use data only for purposes compatible with hiring.

When LinkedIn may be checked

LinkedIn is a professional network and may be relevant to recruitment. Even so, the company should limit itself to information relevant to the position and avoid collecting excessive or unrelated data.

Common mistakes

• Extracting CVs or profiles to create commercial databases.
• Sending marketing communications to candidates.
• Failing to inform candidates about data processing.
• Keeping CVs indefinitely without justification.
• Reviewing personal social networks unrelated to the position.

How to do it properly

• Inform candidates about the controller, purpose, legal basis and rights.
• Use the data only for recruitment or hiring.
• Limit information to what is relevant for the role.
• Define retention periods for unsuccessful applications.
• Do not reuse data for marketing without an independent legal basis.

Conclusion

LinkedIn can be useful for recruitment, but companies must act transparently and proportionately. The professional nature of the network does not authorise unrestricted reuse of candidate data.