This is the view of one of the agencies Recruiter spoke to about new rules, which come into force today, applying to all organisations that handle European Union citizens’ data.

The rules give consumers new rights, including rights to find out what data is being held on them, and to delete that information, unless a firm can provide a good reason for retaining the data. 

Employment lawyer Chris Tutton, partner solicitor at law firm Constantine Law, told Recruiter agencies need a lawful basis for processing candidate data. The most appropriate grounds are legitimate interests or performance of a contract. Recruiters must also ensure that candidates agree to have their details put forward for specific roles and should direct candidates to the privacy notice of the potential hirer when doing so, he adds.

This has led to many firms sending out emails asking people to renew their consent to receive marketing – as we’re sure you are all more than aware...

Agencies Recruiter has spoken to are largely positive about the new rules. David Blackmore, head of technology recruitment at Oblix IT Partners, told Recruiter his agency has had to go through a “rigorous” process with their internal systems taking on the bulk of the work with regards to reaching out to candidates.

“We’re continuing to have to know where we’re getting people’s data from, the actual source and what we’re doing with it.

“It’s eliminating the cowboy recruiter now. You’ve got to be more well-rounded and more thorough in your candidate management, which we try to do anyway.

“We’re reaching out to everyone active within our network. We’re keeping them up to date with what’s happening with their data. With the people we’re representing, we’re making sure they’ve given us authorisation to do so [represent them].

“Likewise, if candidates are now wanting to sit on our database, we’re keeping those relationships and getting rid of the data and deleting it as soon as possible.”

Meanwhile Mark Lombardi, managing director of Ably Resources, who is part of his agency’s GDPR compliance team, told Recruiter for many of its clients it operates an executive search service and while it has candidate databases, does not send out mass emails. 

“Often, we are recruiting one key individual, or a small team of specialists at a high level. Our approach is usually one-on-one and is usually by phone to an individual, often one with whom we have an established relationship. This makes GDPR compliance easier, as it doesn’t involve unsolicited contacts."

Lombardi adds the agency also attends specific industry conference and events, which enables it to have face-to-face conversations with industry professionals to build its candidate database.

"Again, this means that we are having an interaction in person and receiving people’s business cards rather than cold calling or cold emailing en masse. Europe is certainly leading the field in data protection – the concept of respect for people’s personal data would be quite novel in some of the geographies where we do business!”

• Comment below on this story. You can also tweet us to tell us your thoughts or share this story with a friend. Our editorial email is [email protected]