Job Applicants' Information From the Careers Page

Where the resumes go

A careers page invites applications, and they arrive with a name, an address, a phone number, a work history and the contact details of references. Some include a date of birth, or a social insurance number nobody asked for.

Then the copies begin. The application lands in a shared inbox, syncs to several phones, is printed for the interview and saved in a folder on someone's desktop.

The website often keeps its own copy as well, without anyone deciding it should.

A business that hires a few people a year can end up holding hundreds of applications from people it never hired.

Where copies collect

• The shared inbox, read by everyone who answers customer email.
• Phones and laptops that sync that inbox.
• The form's own storage in the website's database.
• Uploaded files saved in a folder on the web server.
• Printouts from interviews, in a drawer.
• Forwarded copies in managers' personal email accounts.

The fourth is the one most owners never see. Some form tools save attachments in a public folder, where anyone who has a file's address can open it, long after the email has gone out.

What privacy law expects

Privacy law can protect an applicant's information just as it protects a customer's. This is a practical outline, not legal advice; a lawyer can tell you which rules govern your hiring.

Which law applies turns on where the business operates and how it deals with personal information. Federally regulated businesses, such as banks and airlines, follow PIPEDA, while some provinces have privacy laws of their own for private businesses.

The principles are similar. Collect only what you need to make a hiring decision, say what it will be used for, protect it, use it for that purpose alone, and keep it only as long as necessary.

Whichever law covers your business, the same habits make sense.

Ask for less

The simplest protection is not collecting something in the first place.

A careers form needs a name, contact details, the position, availability and a resume. It does not need a date of birth, a social insurance number, a photograph or marital status.

Questions about age or family status can also cause trouble under human rights rules, which is one more reason to leave them off.

Add a short notice beside the form: who will read applications, what they are used for and how long they are kept. A line asking applicants not to include identification numbers helps too.

Send applications to one place

Set the careers form to send to a mailbox used only for hiring, read by the people who make hiring decisions, rather than the general inbox the whole front desk sees.

Turn off automatic forwarding to personal addresses. Applicants who email resumes to whoever they know can be pointed to the form or the hiring address.

And check the page itself. A careers form on plain HTTP sends every resume across the internet unencrypted; a security certificate fixes that, and free ones are now widely available.

A worked example

A Lebanese restaurant in a busy neighbourhood hires servers and kitchen staff every spring for its patio season, mostly through a careers form on its website.

When the owner went looking for one applicant's resume, she found copies in five places: the shared inbox, two managers' phones, the form's storage in the website's database and a folder of uploaded files on the server.

That folder held every resume submitted over three years, and anyone who had a file's address could open it. A manager who had since left still had two seasons of applications on her phone.

Nothing had been done carelessly. The form tool kept everything by default, and the inbox copied it everywhere.

The form now sends to a hiring mailbox read by the owner and the head manager, and keeps no copies on the site. The old folder has been emptied, and the former manager deleted what she held.

A reminder each spring, before the new season's hiring, clears applications more than a year old from people who were not hired.

The website's own copies

The email is rarely the only record. A form tool often keeps its own copy of every application on the website itself, which is easy to forget because nobody looks at it.

Check the settings with your web company. If email is enough, turn storage off; if the plugin can delete entries automatically after a set time, use that.

Uploaded files deserve the same attention. They should not sit in a folder anyone can open, and they should go once they have been delivered.

Ask, too, whether the folder can be listed in a browser. On some servers, visiting a folder's address shows every file in it by name.

Backups hold copies too, and they only age out on their own schedule. Cleaning the live site now means future backups stop collecting them.

How long to keep them

Keep an application as long as you need it for the hiring decision, plus a period in which the applicant could reasonably ask to see it.

How long that period is depends on the law that applies to your business, so confirm it once rather than guessing. After it, applications from people you did not hire can be deleted.

For people you hired, the application moves into their staff file. For someone you would like to keep on file for a future opening, ask them first.

Write the routine down, with its dates, so it outlasts the manager who set it up.

The counter-case

A business that hires rarely, or mainly through referrals and people walking in, may hold very few applications. A careers page with only an email address still creates copies, though fewer.

Larger employers often use dedicated hiring software that handles storage and deletion for them.

For everyone else the routine is small: one mailbox, no copies on the website, and a yearly reminder to delete what is no longer needed.

The routine

1. Find every copy of past applications.
2. Create one hiring mailbox for the careers form.
3. Remove questions you do not need answered.
4. Stop storing uploaded files in public folders.
5. Add a short notice to the careers page.
6. Set a yearly reminder to delete old applications.
7. Move hires' applications into their staff files.

Step four is the most urgent. Every other copy sits behind a login or inside the building; files in a public folder are the only ones a stranger could reach.

Answering an applicant who asks what you hold works much the same way as when a customer asks what you have on file.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.