Can an employer screen my online profiles and past when applying for a job?

In today's competitive job market, employers want to make sure they are hiring the right candidate. This often leads to a desire to screen an applicant thoroughly, such as by checking social media or checking references. While this is understandable, background checks are not allowed. Legislation imposes strict limits to protect an applicant's privacy.

The legal context: a balancing act

There is no specific law in Belgium that compiles all the rules around screening job applicants. Admissibility is assessed using a general legal framework, which relies mainly on three pillars:

1. Collective Labour Agreement No. 38 (CLA No. 38).: This collective bargaining agreement regulates the recruitment and selection of employees and emphasizes that the applicant's privacy must be respected.
2. The General Data Protection Regulation (GDPR).: Once an employer collects, stores or uses information about a job applicant, it is a "processing of personal data. The strict rules of the GDPR then apply.
3. The Private Investigation Act: This recent law has a very broad scope and can be unexpectedly relevant when a human resources department conducts its own research on candidates.

It always comes down to balancing the employer's legitimate interest in finding a suitable candidate with the applicant's fundamental right to privacy.

The regulations: the three major principles

To guard this balance, each background investigation must be tested against three fundamental legal principles.

Principle of finality (the goal).
The collection of information must serve a specific, explicit and legitimate purpose. In a hiring context, that purpose is to assess a candidate's suitability for a specific job. Information that is not relevant to the job should not be requested or researched.

Proportionality principle (the method).
The interference with privacy should not go beyond what is strictly necessary to achieve the goal. If the employer can obtain the necessary information directly from the applicant, it should choose that route. Only if there are inconsistencies or ambiguities may a more thorough investigation of third parties be justified.

Transparency principle (the communication)
The applicant must be clearly informed in advance of the possibility of a background check. The employer must communicate what information it can examine and why it is relevant to the position. This can be done, for example, through a privacy notice that is provided to the applicant at the start of the procedure.

Legal analysis and interpretation: the legal basis under the GDPR

The mere retrieve of information is one thing, but the processing of it (storing, noting, sharing) requires a valid legal basis under the General Data Protection Regulation. For an employer, there are a few options, each with their limitations:

• Consent: While it may seem logical to seek the applicant's consent, this is legally shaky. The Data Protection Authority (DPA), following the lead of European institutions, states that consent in an employment relationship is rarely "free" due to the imbalance of power. An applicant may feel pressured to consent for fear of not getting the job.
• Legal obligation: For some positions, such as in finance or security services, the law requires an employer to verify that the candidate has a blank criminal record. In that case, the processing is, of course, permitted.
• Legitimate interest: This is the most appropriate legal basis. The employer may process data if this is necessary for the fulfillment of its legitimate interest (e.g., the proper functioning of the company). However, this interest must be weighed against the rights and freedoms of the applicant. This balancing is a question of fact and will be more stringent the more sensitive the information is. Important: this legal basis cannot be used for special categories of data such as health information, religious beliefs or union membership.

What this means concretely: practical cases

Checking references
Contacting a previous employer should not be done lightly. It is highly recommended to ask the candidate's explicit permission to do so. Moreover, be extremely discreet: contacting the current employer without the applicant's knowledge is out of the question and can even lead to a claim for damages if the applicant is disadvantaged as a result.

Vetting social media
An employer may access public profiles on platforms such as LinkedIn, Facebook or X (formerly Twitter). The reasoning is that those who share information publicly have a lower privacy expectation. However, this does not mean that the employer may simply process that information (e.g., save screenshots, share party photos with co-workers). The fact that information is public does not give a free pass to reuse for any purpose. Requiring access to a protected profile is absolutely prohibited.

Asking about a criminal record
Asking for a standard excerpt from the criminal record ("proof of good conduct and morals") is not permitted. This is allowed only when a specific law requires it for the position in question. In all other cases, the DPA considers that no questions about the criminal record should be asked.

Questions about salary, health and personal life

• Wages: The future European Wage Transparency Directive, which must be implemented by 2026, will prohibit inquiring about an applicant's salary history.
• Health: Questions about health are prohibited unless it is strictly necessary for the assessment of fitness for work for a specific high-risk job (e.g., through a prior health assessment by the occupational physician).
• Private life: Questions about desire for children, pregnancy, ancestry or family status are irrelevant and prohibited because they may give rise to discrimination.

FAQ (frequently asked questions)

Q: My social media profile is public. May a recruiter use anything he finds there against me?
Answer: A recruiter may view a public profile. However, he may not simply store the information he finds there or use it systematically in his decision unless that information is objectively relevant to the job and the processing complies with the GDPR rules. Party photos from your college days generally are not.

Q: Do I have to list my previous employer as a reference if I did not leave there in good standing?
Answer: You are not required to provide references. If a potential employer insists on it, you can refuse. It is up to you to strategically choose which references you share. An employer should only contact those you provide, and ideally only after your permission.

Q: May an employer ask for a criminal record extract by default?
A: No, absolutely not. This is a widespread misunderstanding. A criminal record extract may only be requested if a law explicitly requires it for the specific position for which you are applying (e.g., security guard, certain positions in education or finance).

Conclusion

Screening job applicants is a legal minefield. Employers must be extremely careful and test each step against the principles of finality, proportionality and transparency. The temptation to use all available information is great, but privacy laws impose clear and strict restrictions.