The right of access covers all data about the candidate, whatever the medium. The CNIL (French data protection authority) expressly mentions paper and electronic documents as well as video and audio recordings, and states that the fact that data appears in a document does not make it exempt from disclosure (CNIL, responding to an access request).
In recruitment, this covers in practice:
- notes taken during the interview, including handwritten ones once they are kept or filed (a loose sheet that is not kept after the interview does not constitute processing, according to sheet no. 1 of the CNIL recruitment guide);
- evaluation scorecards and forms, including their comment fields;
- interview reports, transcripts and audio or video recordings;
- test results, and the information the recruiter relied on to make the decision.
The Court of Justice of the European Union has ruled that an examiner's annotations on a candidate's answers in a professional exam are personal data of that candidate, because they reflect the assessment of their performance (CJEU, Nowak, C‑434/16). The ruling concerns an exam, but the same reasoning carries over quite naturally to a recruiter's written assessments.
In addition to the copy, the candidate is entitled to the information listed in Article 15: purposes, categories of data, recipients, retention period, the source of data collected from third parties and, where there is automated decision-making within the meaning of Article 22, meaningful information about the logic involved.
Article 12(3) of the GDPR requires a response without undue delay and at the latest within one month of receiving the request. This period can be extended by two months given the complexity or number of requests, provided the candidate is informed of the extension and the reasons for it within the first month (GDPR, Chapter III). If you do not act on the request, Article 12(4) also requires you to tell the candidate within one month, giving your reasons and the possibility of lodging a complaint with the CNIL or going to court.
The first copy is free. A request received electronically calls for a response in a commonly used electronic form, unless the candidate asks otherwise.
You are not required to hand over the original documents. The CNIL recruitment guide allows a summary of the data contained in the documents to be provided. For business software, the CNIL accepts screenshots or a faithful transcription. A copy of the document itself becomes necessary when the candidate needs it to exercise their other rights, such as rectification. The recruitment guide adds two requirements: codes, acronyms and abbreviations must be explained, and a test result presented as a score or category must come with the information needed to interpret it. A note reading "3/5 SK" with no key therefore does not satisfy the request.
Article 15(4) provides that the right to obtain a copy must not adversely affect the rights and freedoms of others. Sheet no. 7 of the CNIL recruitment guide derives a two-step approach from this.
The first step is redaction. For an evaluation form with comments, the recruiter should remove the details that identify the people who wrote the comments, such as their names. For exchanges between panel members in which the candidate was neither sender nor recipient, anonymising or pseudonymising the data about third parties is good practice. For a test based on a scorecard or tool covered by a vendor's intellectual property, the recruiter shares the information about the candidate without revealing the protected elements.
Refusal only comes afterwards, if these measures are not enough to protect third parties, and it must be explained to the candidate with a substantiated justification. Article 12(5) also allows a request that is manifestly unfounded or excessive, in particular because of its repetitive character, to be set aside, and the burden of proving this is on you.
Two arguments are ruled out by the texts. A confidentiality undertaking is not a valid ground for refusal, according to the CNIL recruitment guide. As for Article L1221-8 of the French Labour Code, which makes the results of recruitment assessment methods confidential (Code du travail numérique, L1221-8), it is aimed at third parties. In its 2002 recommendation, the CNIL relied on this same provision (then numbered L. 121-7) to state that every candidate can obtain the information concerning them, including the results of tests or professional assessments, and specified that the confidentiality obligation cannot be invoked against candidates.
The candidate asks for the recording of their interview. The recording contains their data (their voice, what they said), so it can be disclosed, and the CNIL itself gives the example of a recorded telephone conversation. What the recruiter said belongs to a third party, but the candidate took part in the conversation. For emails the requester already knows, the CNIL considers that disclosing them can be presumed to respect the rights of third parties, and this reasoning seems to apply here too. A faithful transcript can replace the copy, unless the candidate needs the recording itself to exercise another right, such as rectification.
The manager took notes in a personal notebook. If these notes were kept, added to the file or copied into the recruitment tool, they fall within scope. A simple internal rule limits the risk: whatever matters for the decision is entered in the tool, and drafts are not kept after the interview.
The request arrives during a dispute. The exercise of the right of access is not subject to conditions, the CNIL points out. A candidate can exercise it alongside legal proceedings, for example before the employment tribunal (conseil de prud'hommes), and a refusal based on that ground alone would not be valid.
Since any interview note that is kept can be disclosed, it is better to write it assuming the candidate will read it. Article L1221-6 of the French Labour Code already requires that information requested from a candidate be directly and necessarily linked to the job offered or to the assessment of professional aptitudes (Code du travail numérique, L1221-6). An assessment is therefore stronger when it is tied to a job criterion and based on an observed fact.
A few typical rewrites:
- "Not very dynamic" becomes "Short answers on project management, no figures given despite two follow-up questions."
- "Profile a bit senior for the team" becomes "Salary expectations 15% above the range for the role." Age has no place in the note, and the first version hints at it.
- "Good feeling" becomes "Described in detail the migration of a 200-workstation estate, including their role and the difficulties."
- "Mother of two, availability to be checked" is deleted. Family situation is one of the prohibited grounds of discrimination and has no bearing on aptitude for the role.
A scorecard structured by criteria, with an "observed facts" field and an "assessment" field, makes both the decision and the response to an access request easier.
- Responding by listing only the categories of data held. The CNIL states that this is not enough and that the data itself must be provided.
- Forgetting secondary sources, such as internal messaging between recruiters, comments left in the recruitment software or, in an agency, the client's written feedback.
- Sending the copy without masking the names of assessors or the data of other candidates in the same spreadsheet.
- Letting the one-month deadline pass without responding or announcing a justified extension.
- Keeping notes beyond the period announced. For a talent pool, the CNIL recommends as a rule not exceeding two years from the last contact with the candidate, who must have been informed of this (CNIL, recruitment in small businesses).
This page gives a general framework. For a specific request or ongoing litigation, have your response checked by your DPO or a lawyer.
Only if there is reasonable doubt about the identity of the person making the request. The CNIL recruitment guide states that a request sent from the email address used throughout the recruitment process leaves no reasonable doubt, and that proof of identity should not be requested as a matter of course.
Not for the first copy, which is free. A reasonable fee based on administrative costs is only possible for additional copies or for a request that is manifestly unfounded or excessive.
The right to rectification covers data that is inaccurate or incomplete. A statement that was transcribed incorrectly or a factual error can be corrected. The CNIL guide also gives the example of a candidate in a talent pool who adds a new degree or certification to their file.
If the data is no longer kept, access is impossible and you tell the candidate so. As a precaution, any deletion should result from your usual retention period, not from a decision taken after the request was received.
Yes. The CNIL asks controllers to give the request its practical effect. A request that refers to documents about the person is to be read as an exercise of the right of access, and rejecting it solely because of the wording used may be a breach.
The right is exercised against the data controller, which may be the agency, the client company, or both as joint controllers, depending on who determines the purposes and means of processing. Sheet no. 3 of the CNIL recruitment guide sets out how these roles are allocated. For a specific case, consult your DPO or a lawyer.