8. Can an employer collect copies of the identity cards of job applicants? How long is an employer allowed to keep the personal data of unsuccessful job applicants?

Generally speaking, an employer must not collect a copy of the identity card of a job applicant during the recruitment process unless and until the individual has accepted an offer of employment.

Personal data of unsuccessful applicants (for future recruitment purposes) can be retained for a period of up to two years from the date of rejecting the applicants, and must then be destroyed. The data can be retained for a longer period if there is a subsisting reason that obliges the employer to do so (e.g. to fulfill a legal obligation), or the applicants have given their consent for the data to be retained beyond two years.