01 May 2019

Exercising my Right to be Forgotten Yet Again: The Case of the Headhunter

Man, I am on a roll when it comes to exercising my GDPR Article 17 Right to Erasure. I had a third instance which came on the heels of the second. This time, it involved a headhunting agency.

See, one day at work I got a phone call in my personal phone. I was in a meeting and therefore I didn't see the phone call until I looked at my phone later, which was on silent. The number was not known to me, so I looked it up on Google. It turned out to be a headhunting agency based in the EU.

I quickly probed my memory and remembered that this was the headhunting agency that I actually submitted a copy of my CV two years ago, when I was looking for a new job as I left academia. This meant that the CV they had of me is now outdated: I initially applied for positions in the data science and data analytics space, but now I have left that space and instead work in the data protection field. So I can only imagine that the headhunter who has been trying to contact me is trying to do so because he has some data science positions to fill. Needless to say, I wasn't interested.

A few hours later, I receive an email in my personal email account. He wanted to chat. He said that he wanted to see what I am interested in because even though I might not be looking for jobs now he would like to understand my profile better to better match it to some data science positions he is trying to fill. He asked when would be a possible time to call.

My response the day after was firm but polite. I said that I have left the data science space already and instead am working in the data protection field by now. I also mentioned that the CV he has of me is now outdated, since it was from 2 years ago. Hence I mentioned I am invoking my right to erasure, and requests his firm to delete all personal information they hold of me, overriding their retention period of 5 years as stated in their Privacy Policy. I involved the firm's Data Privacy Office in my response.

They confirmed receipt, and told me that my data would be deleted within 30 days.

The annoying thing is that on top of that, I felt like I was a commodity. The email communication he sent to me was full of grammatical errors, not to mention that he misspelled my name. Instead of feeling like a client, I felt like I was just a statistic and a data point he was trying to plug to an opening that he might have.

Given that impression, I definitely didn't hesitate to exercise my right to erasure. Sorry but if you treat data subjects like that, then I definitely don't want you to have my data.


  1. This is so weird they kept your resume for two years! Especially considering you didn't seem to have a relationship with them. Also, unprofessional emails are a big red flag :-/

    1. Zhu,

      The more surprising thing is that their retention schedule is 5 years! Such a long time, especially thinking that plenty of things can happen in one's career within 5 years.