To find a suitable job, tender sites or social networks are often used. The platform enables the creation of a personal profile, where all relevant CV data can be entered. The profile can be used to apply for the advertised positions and to share the personal data with the relevant companies. The company will usually have its own user account to recruit personnel and manage the applications. An applicant or the platform operator on behalf of the applicant will share personal data with a company.
On such a job platform, two different purposes of use and processing come together. On the one hand, the platform operator looks after the applicants who wish to apply for a job. On the other hand, it is also used by companies that want to recruit the appropriate personnel. In most cases, the use of the platform is associated with costs for companies, since an advertising effect is achieved or even entire application processes can be handled via the platform.
The resulting data processing must be considered individually to determine the data protection status of the platform operator. If he is responsible for the processing, he must independently guarantee all data protection requirements for the processing. As a processor on behalf of a customer, he can rely on the justification of the responsible party and does not have to prove a legal basis for this.An operator is considered to be responsible where only personal data of the respective user is processed. With regard to a personal applicant account and the associated personal data, the platform operator is responsible for data protection.
The same applies to a company profile, which is created for information purposes only. Insofar as the profile data represents personal data at all, the platform operator is considered to be the person responsible for data protection.If the platform now offers the company the possibility to process personal data of third parties (application management, mailing services), the question arises whether or not commissioned data processing is involved. This is the case if the company decides on the means and purpose of processing and the platform operator is merely the executor.
The decisive factor for a final classification is the answer to the question of whether or not the platform operator can have a say in data protection parameters of the data processing (e.g. the categories of data to be processed, how and where they are obtained, how long they are kept). If he cannot do so, the processing of data tends to be commissioned.
The assessment of the platform operator in terms of data protection law requires a technical consideration of the functions offered by the platform and the classification should not be made hastily. Since a written contract with processors will also be necessary in Switzerland in the future, it is advisable for both the platform operator and the company to examine the data processing and to conclude a possible contract for commissioned data processing.