Job hunting is a stressful process, particularly in the London legal bubble where rumours about potential partner departures spread quickly.

But the constant circulation of CVs by recruiters can have a more serious consequence. Some say that data privacy concerns are being ignored by recruiters looking to gain from placing a candidate at a top firm.

Lawyers, human resources directors and recruiters say that by not checking with candidates which firms they'd like to send their CVs to be sent to, many recruiters are prioritising their own chances of placing a candidate over that candidate's privacy issues.

A secondary effect, they say, is that this practice increases the likelihood of law firms receiving complaints from people who did not want their personal data to be shared to them — a transgression that will be taken far more seriously since the introduction of the General Data Protection Regulation (GDPR) in 2018.

According to data from the Information Commissioner's Office (ICO), recruitment remained the most complained-about sector for marketing abuses in the four months following the GDPR's implementation.

'At best, legally questionable'

A person working in the resourcing department of an international law firm says that recruiters sending candidates' personal information directly to partners rather than resourcing teams poses "a real risk" to the firm. If personal data is found on a law firm's system without the candidate's express permission, they say, a firm can quickly find itself in hot water.

Tom Fielden, the chief operating officer of online recruitment platform Route1 International, says that "many recruitment agency practices before the GDPR came into effect were at best, legally questionable under the old Data Protection Act are now, without question, offside".

"There is a fundamental disconnect between the protections around personal data that the GDPR provides and the pressure on agents to put candidates forward for jobs without their permission," he adds.

Another recruiter adds: "At some stage someone is going to be hired, it will fall apart and then that person will sue the law firm. They will say, 'These guys took on personal data without consent'. Someone will be in trouble for their CV having popped up on [a firm's] desk, and that's going to be a problem."

"There is a fundamental disconnect between the protections around personal data that the GDPR provides and the pressure on agents to put candidates forward for jobs without their permission"

The resourcing manager stresses the point, however, that in their experience it is the smaller, one-man-band recruitment agencies who are more likely to drop CVs onto the desks of unwitting partners compared to the larger agencies. Recruiters from large companies agree

One firm, they add, has even put a cap on the fees that its mandated recruitment agents can receive if they send CVs to partners rather than resourcing.

A financial penalty, they say, is one way that firms could keep rogue recruiters in check as it gives them "a stick to beat them with", adding: "Hopefully the more that people or firms that do this, the more it brings this type of thing into line."

Protecting reputations

In order to combat the threat of data being handed over to HR directors without permission, applicant tracking and recruitment companies such as the U.K.-based AllHires have devised systems that allows individuals to grant permission for people in HR to receive an email from individuals giving permission for their CV to be looked at.

AllHires' client list includes the likes of Skadden Arps Slate Meagher & Flom, Weil Gotshal & Manges, Hogan Lovells, Dentons and Bryan Cave Leighton Paisner, according to its website.

By sharing CVs in a secure sharing portal, the candidate's desire to move firms is not on show for everyone to see. One female partner who recently moved jobs says: "When you get to a level when you've been in the industry for a while, and your name has been around for a little while longer, you think 'I don't want my CV to appear in every partner's inbox'. You build up a brand over the years and you want to preserve it if you can.

"I would also say I had lots of options to apply to a variety of big firms. But you're encouraged by recruiters to make a decision as to what you want, and even then your CV can end up in the wrong place.

The partner adds that because a recruiter's aim is to place a candidate wherever they would get the highest salary "there's an element of mistrust there".

"I don't want my CV to appear in every partner's inbox"

Fielden says that Route1 is trying to warn employers in the City about the risks of processing data that has been passed to them without a candidate's consent, and this should always be obtained. However, he adds that "the industry is carrying on as it used to because no one has been caught or rapped on the knuckles yet."

By way of example he points out: "Think about the risk of your CV being with a competitor being leaked just ahead of internal bonus or retention discussions — one day some of this will come back to bite an agent — very hard."

In March of this year, Route1 decided to conduct a survey of 152 recruitment firms in the U.K. as to their data privacy compliance by making Subject Access Requests (SAR) to the recruiters under the GDPR.

"One day some of this will come back to bite an agent — very hard."

Of the recruiters who were sent SARs, only 45% responded to the request during the 30-day compliance period.

One London-based recruiter argues that concern over data protection legislation is largely confined to the U.K.-headquartered London firms, adding that in their experience U.S. firms are far more relaxed about the circulation of CVs outside of a firm's resourcing department.

But a senior partner in a U.S. firm based in London said that they, along with many of their peers, sign up to such CV-sharing portals that require the express consent of the candidate in order to be looked at.

Either way, it is clear that the concerns of partners are very real, and they do not feel they are being addressed. The partner who recently moved adds: "[Recruiters are] never really going to be looking out for your own best interests, they're looking out for their own. I think as long as the recruitment industry gets paid in this way, nothing's really going to change."