Online privacy is a foremost concern, particularly among online jobseekers, for whom details concerning past employment history and current employment status can be particularly sensitive.

Though it may be so obvious as to be overlooked, gathering resumes on a corporate Web site is gathering private information, which places the activities of corporate recruiters squarely under the jurisdiction of privacy legislation. Privacy legislation has important ramifications for corporate policies on data use, retention and destruction. To see the impact of privacy legislation on corporate recruiting practices, let´s look to the example being set in Europe.

EU Privacy Directive
The European Union Privacy Directive, which took effect on October 25, 1998, compels the fifteen member countries of the Union to enact legislation that will in turn impose specific requirements on corporations that gather personal information online. In accordance with the EU Privacy Directive, member states´ privacy legislation must require organizations to implement privacy policies that include the following principles:

a) an individual shall be informed of the purpose for which his or her personal information is being gathered;

b) an organization must acquire an individual´s consent before transferring his or her personal information to a third party;

c) individuals have the right to access their personal information gathered, and;

d) organizations must appoint an officer who will be responsible within the organization for the protection of individuals´ personal information.

The EU Privacy Directive also prohibits the transfer of data to any country that does not have legislated privacy protection at least as strong as what is set out by the Directive. Owing in part to the leadership role taken by the EU, but also because of the restriction placed by the EU Privacy Directive on the transfer of data to countries that have weaker standards for privacy protection, countries around the world are enacting legislation that match the standard set by the EU Privacy Directive. The most notable exception is the United States, which currently does not have federal legislation protecting personal information in the marketplace.

Private Sector Compliance in Europe
The top 500 European companies are only just beginning to comply with the principles of the EU Privacy Directive. A study by iLogos Research, Best Practices for European 500 Career Web Site Recruiting, found that of the 500 largest corporations in Europe by revenue (the "European 500"), only 22 percent state a privacy policy on the corporate Careers Web site.

Seventy-eight percent of privacy policies on Careers Web sites in the European 500 state that a candidate´s personal information is being gathered for recruiting purposes. Only 59 percent of privacy policies on corporate Careers Web sites of the European 500 address data transfer. Though the European corporations are now required to grant individual´s access to their personal information, only 51 percent of privacy policies on Careers Web sites in the European 500 explain how to access personal information held by the company.

Online privacy is taken most seriously by French corporations in the European 500, with 41 percent of that group of companies providing jobseekers with a privacy policy statement on the Careers Web site. Adherence by the European 500 to online privacy principles is lowest in Germany, with only six percent of German corporations in European 500 declaring a privacy policy on the Careers Web site.

Future of Privacy Protection in E-Recruiting
Recruiting by global corporations is increasingly being conducted online. Information can be moved and processed much more efficiently when it is in digital form. However, it is precisely the ease with which digital information can be transferred that poses a threat to individual privacy. Starting with the EU, legislative bodies have moved swiftly to protect online privacy. Because of the provision in the EU Privacy Directive concerning the transfer of personal information to non-EU countries, there has been a certain amount of harmonization in worldwide privacy laws to the standards set by the EU. However, the EU Privacy Directive only sets a minimum threshold or standard for privacy protection; the protection required in certain jurisdictions may be more stringent.

Global corporations may be subject to the laws of more than one jurisdiction, which complicates the task of knowing what personal information may be acquired, how it may be used or transferred, and to whom. The top corporations in Europe are just beginning to adapt corporate recruitment practices to legal privacy requirements. Corporate recruiters in global corporations will likely find their activities and policies for data use, retention and destruction will come under greater scrutiny for compliance in the next several years.