european-union gdpr germany data-ownership
Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?
<p>Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a <a href="https://www.thebalancecareers.com/what-is-a-structured-job-interview-2062109" rel="noreferrer">structured job interview</a>?  Presumably, in a structured job interview process, the recruitment panel makes some sort of quantified assessment of each candidate after the interviews have been completed.  Do I have the right of access to such assessments relating to myself?</p>

<p>In case it matters, this relates to job interviews at national and supranational governmental organisations within Germany, after the candidate has been formally notified that she/he has been unsuccessful.</p>

<p>These documents constitute <a href="http://www.privacy-regulation.eu/en/article-4-definitions-GDPR.htm#a4_nr1" rel="nofollow noreferrer">personal data</a> and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request".</p>

<blockquote>
  <p>The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (<a href="http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm#a15_p3" rel="nofollow noreferrer">Art. 15 (3) GDPR</a>)</p>
</blockquote>

<p>GDPR applies to controllers of any kind, including government organisations.</p>

<p>The subject access request can usually be a simple email. The ICO has a template for this: <a href="https://ico.org.uk/your-data-matters/your-right-of-access/" rel="nofollow noreferrer">https://ico.org.uk/your-data-matters/your-right-of-access/</a> (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have).</p>

<p>The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (<a href="https://www.ldi.nrw.de/LDI_EnglishCorner/mainmenu_DataProtection/Inhalt2/authorities/authorities.php" rel="nofollow noreferrer">see here for Germany</a>; note that federal institutions are supervised by the <a href="https://www.bfdi.bund.de/DE/Home/home_node.html" rel="nofollow noreferrer">BFDI</a>, not the data protection authorities of the <em>Länder</em>).</p>

<p>Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject.</p>

<p>There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case.</p>

<p>Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors:</p>

<ul>
<li>You can't <strong>object</strong> to processing based on <em>consent</em> (but you can revoke your consent), <em>fulfilment of contract</em> (but you can cancel your contract), a <em>legal obligation</em> on the part of the processor, or a <em>vital interest</em> (but you still have the right to erasure)</li>
<li>Your <strong>right to portability and right to erasure</strong> does not apply if processing is based on a <em>legal obligation</em> or a <em>public task</em> (justice, parliamentary or government functions, statutory functions etc.)</li>
<li>your right to <strong>portability</strong> also doesn't apply if processing is based on <em>vital interest</em> (e.g to protect someone's life) or <em>legitimate interest</em> of the processor.</li>
</ul>

<p>It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.</p>
