Psychometric tests are a popular tool which helps employers to identify optimal job candidates, or more accurately filter non-optimal job candidates based for example on their ability to process and use information, approach to interacting with other people and approach to recognizing and handling emotions. At least that is what providers of these tests advertise.
According to the WP 29, summarising opinions of national authorities, health data also include data about a person’s intellectual and emotional capacity:
„But health data (or all data pertaining to the health status of a data subject) is a much broader term than the term ‘medical’. Based on the current Data Protection Directive, national legislators, judges and DPA’s have concluded that information such as […], data about a person’s intellectual and emotional capacity (such as IQ),[…] are all data concerning the health of individual data subjects.“ [poznámka pod čarou: Annex to the letter of 5th of February 2015 sent by the Article 29 Working Party to the European Commission that responds to a request to clarify the scope of the definition of health data, available at https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf]
This means that apart from legal title under Article 6 (for example, in this scenario, legitimate interest or contract conclusion) of the GDPR, exception from the general prohibition of processing of special categories of personal data under Article 9 of the GDPR is necessary for the lawful processing of these personal data.
Although explicit consent as one of the possible exceptions might be used by the employers to ensure their compliance with the GDPR, such approach would be against opinions of WP29 on personal data processing within employment and recruitment process, where such consent might not be considered as freely given by the data subjects, and therefore, would be invalid. According to our opinion, only possible exceptions remaining under Article 9 of the GDPR are paragraphs b), f) or h), i.e. processing for the purposes of carrying out obligations and exercising specific rights of the employer; processing for establishment, exercise or defense of legal claims; or processing for the purposes of assessment of working capacity (however an assessment of working capacity would have to be conducted by medical professional). But none of these exceptions fits this scenario perfectly and clarification from data protection authorities would be welcome.
Such an approach adds another layer of complexity to hiring processes and also increases the risk of such processing and execution of the psychometric test. We would at least recommend modifying information about data processing provided to employees and records of processing. Higher risks connected with the processing of sensitive data should also be taken into account. We will let you know in case of any further progress in this area.
