Using social media searches in your recruitment processes, if not done correctly, can be discriminatory, breach data protection rules, infringe rights to privacy and most of all may be wholly unreliable. Only do this if you have proper processes in place. When an employer collects personal data about an applicant during a recruitment process, whether this is directly from the applicant on social media or from someone else such as a recruitment agency, it must provide the applicant with an information notice, also known as a 'privacy notice' or 'fair processing notice.' This notice must set out certain required information, including the purposes for which the data will be processed, the legal bases for processing and the period for which the data will be retained. The employer could provide the information notice on its website, and send a link or copy of the notice in correspondence to individual applicants.
The UK data protection regulator considers that, to use social media searches in recruitment, you must comply with the data protection rules on pre-employment vetting. This means you should only do it to obtain specific necessary information where no alternative exists. You should tell the candidate early on of your intention to do this. The search should be done at a late stage for shortlisted or confirmed candidates, not as a general screening process. Furthermore, it should be done proportionately and using reliable sources and comply with data protection rules for the information gathered.
Employers should put in place policies setting out for how long recruitment data will be retained that is collected from social media. The policy should cover whether the employer uses information from a candidate's social media profiles to make a decision and their legal basis for collecting the information from the candidate's social media profile. It should also state that any data collected from the profiles will be deleted once the recruitment process has finished.