Access to test results taken as part of an interview process ?

[SerendipityJane]

I'm trying to help some people apply for jobs.

One person was invited to take an online test - they were required to submit their personal details to the website.

The company did not progress with their application.

What rights - if any - would this person have to know what the results of the test were, given they are/were clearly personal data ?

This isn't my area of expertise, so wondered if anyone knew for sure ?

They would have a right to a copy of the data that is held about them so it depends what the company conducting the assessment and the company making the decision (if different) have retained.

They have a right to a copy of all personal data the company holds on them.

ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/

Many thanks for replying.

The reply from the outfit was:

The test scores are just one item we review, in addition to your resume and application. Unfortunately we don't release the test scores.

sent as a "go away" I'm guessing - despite it being a specific request under GDPR (my idea). If it helps I think this isn't a UK based outfit so they might not want to follow GDPR ?

Not really sure what to do from here ? I don't like seeing people brushed off because they're not super high powered executives.

ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/what-to-do-if-the-organisation-does-not-respond-or-you-are-dissatisfied-with-the-outcome/

Where are they based? Where is the job based?

GDPR applies whenever data is controlled or processed within the EEA (EU plus a couple of other European countries). It might be more complicated if they are outside the EEA.

Next steps here:

ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/what-to-do-if-the-organisation-does-not-respond-or-you-are-dissatisfied-with-the-outcome/

It might be worth calling the ICO helpline - 0303 123 1113

thanks all, I'll try and find out more and report back ...

Check out the website of the company - there should be a privacy notice with an address at which to direct queries. Then she can make a data subject access request.

Providing she is an EEA citizen then it’s unlikely to matter where the company is based - the GDPR relates to both companies in the EEA and those outside who are processing data related to activity in the EEA.