Sharing Job Candidates’ Data with Third Parties
The Office of the Data Protection Commissioner has issued a determination which clarifies the obligations of recruitment firms when sharing candidate personal data with prospective employers.
Background
In Margaret Manyange v Brites Management Services Limited, the Complainant submitted her CV to Brites Management Limited for the purpose of securing employment as a Legal Assistant. She attended an interview in October 2024. In June 2025, she was invited to attend another interview on short notice and declined.
Approximately two weeks later, she was contacted directly by another law firm expressing interest in engaging her as a Legal Assistant. The law firm disclosed that it had received her CV from the recruiter. The Complainant had not authorised the sharing of her CV with that firm.
Determination of the Data Protection Commissioner
The Data Commissioner found that:
- the Complainant had only consented to the sharing of her personal data with one specific prospective employer.
- The Respondent did not demonstrate that they informed the Complainant that her personal data would be shared with other entities or that she had provided consent for broader disclosure.
- In the circumstances, the disclosure of the Complainant’s CV to another employer, without prior notification or fresh consent, constituted a violation of her right to be informed, contrary to section 26(a) of the Data Protection Act.
- On the issue of lawful basis, the Respondent urged that it relied on the agreement signed with the candidate as authority to share the CV. However, the Commissioner found that the agreement only authorised the sharing of the Complainant’s personal data with a specific employer. No fresh consent was obtained and no alternative lawful basis was demonstrated in respect of the subsequent disclosure. The Commissioner therefore found that the Respondent had failed to establish a lawful basis for the additional processing of the Complainant’s personal data.
In the circumstances, the Commissioner awarded the Complainant KES 262,500 for the infringement of her rights and unlawful processing of her personal data.
