In HR Dive’s Mailbag series, we answer HR professionals’ questions about all things work. Have a question? Send it to [email protected].
Q: How — and for how long — should I store information on rejected job candidates? Where should I keep that information?
A: A general rule of thumb is that employers should hold onto rejected job candidates’ information for at least one year, said Cindy Minniti, partner at Reed Smith. That’s in part because several anti-discrimination laws apply to applicants just as they do to employees, so any information that an employer has on a candidate could be relevant in the event of a lawsuit.
As for where the information should be kept, Minniti said she recommends a confidential location, which may look different depending on whether an employer is dealing with digital or paper documents. For the former, employers have their pick of software applications, including applicant tracking systems, that encrypt sensitive digital documents.
On a broader level, Minniti said employers should have an overarching data protection policy in place to handle sensitive information.
“Make sure you’re following the policy that you have and that you follow it for applicants’ as well as employees’ files,” she added.
Separate rules for federal contractors
There are exceptions, however. Federal government contractors with 150 or more employees and those with a contract worth at least $150,000 must preserve such records for at least two years from the date on which a record is made or a personnel action involving the record is made, according to Office of Federal Contract Compliance Programs regulations.
Contractors with fewer than 150 employees, as well as those without a contract worth at least $150,000, need only keep rejected job candidates’ records for at least one year. If an employer has multiple contracts under $150,000, it would still meet OFCCP’s criteria for one year of records retention so long as it does not exceed the employee-count threshold and does not have one contract that exceeds $150,000, said David Goldstein, shareholder at Littler Mendelson and co-chair of the firm’s OFCCP practice group.
OFCCP’s regulations identify a broad array of records that contractors must keep, including records pertaining to hiring, rates of pay and other terms of compensation; records on reasonable accommodation requests; and job advertisements and postings, among others.
Per Goldstein, this includes information on the recruitment stage at which an applicant is rejected, and the reason for the rejection.
“It’s very important to be able to document where the person didn’t advance in the process, whether that’s if the person took themselves out of the running or they didn’t have the basic qualifications or some other reason,” he said.
During audits, OFCCP typically requests copies of job postings and applications, but the agency also may request electronic communications between contractors and candidates on matters such as salary negotiations, Goldstein added. But not all contractors understand just how important their recordkeeping responsibilities can be in the event of a legal action.
“Failing to comply with these obligations can very directly lead to liabilities,” Goldstein said.
Choosing the right products, and limiting access
Employers should be mindful about the sensitivity of job candidate data that they retain, Minniti said, and this includes knowing who has access to that data.
“Even if they have really good data retention policies, it’s also who has access to the documents and making sure that’s limited to who needs access,” Minniti said.
Employers also must be smart shoppers when it comes to buying ATS systems and related products, said Goldstein. Even after a purchase is made, the employer might still need to ensure that the product is configured to comply with applicable laws.
“Some of the ATSs do a great job in helping an employer comply with all these requirements [and] some of them are inadequate and noncompliant,” he added. “It depends on what components you’ve purchased and how you’ve set it up.”