Hacker News new | past | comments | ask | show | jobs | submit login
Ask HN: Can companies ask for private info before any interview/offer?
56 points by mingodad on Feb 2, 2019 | hide | past | favorite | 54 comments
We are talking about abusive privacy issues that several agents in our society are practising, some countries have laws regulating some issues like what a company can ask for a job applicant.

Today I received an email inviting to participate in the selection process for a company that praise privacy in it's main product, but surprisingly it doesn't seems to apply the same in it's internal workflow, for example see what they ask in their invitation (the company listed it's offer here on HN https://news.ycombinator.com/item?id=19055166 ):




For 2019, it is no longer legal to ask for salary history in California. Applicants may volunteer it and prospective employers may ask for the salary the applicant is looking for, but not past salary, either of the applicant or reference checks.


That also became the law in Massachusetts in 2018.

https://www.mass.gov/service-details/learn-more-details-abou...


Connecticut's went into effect last month

https://www.lawandtheworkplace.com/2018/05/connecticut-enact...


Same with New York as of November of 2017, I believe.


I recently appliedm for a job where the demographic questions of gender and hispanic origin had no opt out - I had to mark male or female. It's my understanding that's not legal, but what is my recourse aside from ending the application process early? Realistically even if I wanted to find a lawyer who'd take the case on, any future employers would be able to see the court records that I sued a potential job in a Google search and I doubt the payoff would be enough to retire on.


Of course you can't sue them and get enough money to retire on. They didn't destroy your life, they had a misconfigured form on their damn website.

Send them an email, "I recently used your website and it appeared that several demographic questions did not have "Prefer Not To Say"/"No Answer" options, which I am used to seeing. I think these are fair to people who do not wish to provide that information at that time, and have understood opt-out options might even be required by anti-discrimination law. I wanted to let you know about this concern and hope you can fix it."

Do it from a throwaway email if you are particularly paranoid.


>Of course you can't sue them and get enough money to retire on. They didn't destroy your life, they had a misconfigured form on their damn website.

Most HR systems default to allowing a decline due to it being a legal requirement. I spoke to someone I know who worked HR in the valley for years - it requires quite a bit of effort to override that.

So the issue isn't so much a minor mistake, it's purposefully reconfiguring a system in an illegal manner to aid discrimination.

(And it is absolutely illegal to refuse to accept an application without this information)


It is perfectly legal to ask. It's illegal to base hiring decisions on that info though.


> It is perfectly legal to ask. It's illegal to base hiring decisions on that info though.

It's not legal to make answering a condition to submit an application, whether it's a mandatory field or a secretary who won't accept the paper application until you confirm you are white and male.


Thought I would chime in with the CA laws. It's important to note that CA has some of the strictest employment laws in the US surrounding protected classes and more recently the notion of contractors and what's allowed there.

Some people have said it's perfectly legal to ask, and it most certainly is not. Some things may naturally come up in conversation in an interview but if they are specifically asking in writing, and/or in their application process that is illegal. Like others said, you might not get millions in a lawsuit, but depending on what state you're in, it wouldn't be hard to find a lawyer to take a case like this.

-Age: employers can't ask anything in the application or in the interview process that would indicate age. So an overt question of DOB is completely illegal as are any questions like "what years did you attend university?" or "how old were you when youtube became popular" all are questions that could indicate age. -Citizenship: it is illegal to ask a candidate PRE OFFER what country their citizenship is in. But they are perfectly fine asking you "Are you legally authorized to work in the United States" -Marital status: It is illegal to ask “Are you married?” “Have you been married?” The only thing marital status related that's okay to ask is if applicant has a spouse or child that is currently employed by the company. -Copy of your passport: Absolutely not legal pre offer! No employer can require an applicant to produce employment authorization documents prior to hire. -IBAN: Again, not allowed pre-offer. It's touchy to even ask for this info post-offer but nonetheless pre-offer is certainly not legal.

There are a ton of other protected classes in CA (that are also protected in the rest of the US in different ways/shapes/forms).


A few years back, I remember being on my way out of what I thought was a pretty successful interview with a very well known (CEO seems to be on the front page of HN every week) U.S. Silicon Valley company. The interview itself was professional and by-the-book. While the H.R. rep was walking me to the front lobby area, she was making small talk and eventually asked something along the lines of "So, are you married? Have any kids?" I was shocked to say the least, and mustered up "You know, I don't think you're allowed to ask that question." I mean, she's in H.R. If anyone in the company should know what to ask and what not to it's her. Never got an offer, and always kind of wondered if my push-back might have been part of it.


Idk. Personally, you even said it yourself above, that just seems like it was honest/genuine “small talk.” It could have totally been just that and nothing more. I wouldn’t jump right to “invasion of privacy” if someone asked me that. To me, those don’t seem like invasive questions. Same thing I’d imagine to hear from any random stranger at a work event, for example. Pretty basic boilerplate “get to know ya/small talk” questions, besides the ol’ “so, this weather huh?!” Haha Maybe I’m just being optimistic that not everyone in tech is evil, with an agenda? ¯\_(ツ)_/¯


It’s incredibly stupid for HR to ask that. We had training from HR so we didn’t even unintentionally ask questions during small talk they could indirectly force them to reveal sensitive information. How on earth could a HR rep make that mistake astounds me.


People are human. No mistakes astound me anymore. They simply fall on the range between "they haven't had their coffee yet" to "you're going to need corrective surgery for that not to be permanently debilitating" to "you might need a great attorney to get you out of this".


even Microsoft has rules in place for their HR people not to do this...come on its 2019


Asking questions about protected characteristics (race, sexual orientation, gender, age, disabilities, etc) isn’t illegal but it’s incredibly stupid since the company is leaving itself open to trivial wrongful discrimination suits whenever the reject a candidate. If you don’t ask for those details, you can’t be accused of using them to screen out candidates.


Here is what they ask:

Hi XXXXX!

Thank you for reaching out to us, may I ask you how you found us and what peaks your interest in XXXXXX ? You have built some impressive tools, and I think we can offer you a set of great challenges in your daily work. You can find a brief intro to XXXX: https://XXXXX.XXX/onepager.pdf

I will briefly outline the steps of our hiring process so you have all necessary information and know what is going to happen. Luckily, it's not that complicated. As a startup, we can allow our hiring process to be a lot simpler and faster than what you will find at most big companies! We just want to evaluate a few core competences, the rest we can teach you.

Step 0: CV

Could you please share your CV, including:

- date of birth

- phone number

- physical address

- citizenship

- marital status

- IBAN

- Copy of your passport

After we collected all information we will start the evaluation process. Please note that if there is some personal information which you prefer not to share yet, that is ok! We hope that you can send this to us before the interview in step 2. Furthermore, any confidential information can be encrypted using my PGP key: https://XXXXX.XXX/pgp.asc

Step 1: Challenge We first give all of our candidates a challenge. This challenge is by far our most important means of evaluation, so your effort will be greatly appreciated. Instead of a whiteboard interview, we have chosen for our test to be more similar to the type of work that you will be doing at summitto on a daily basis. That way you know what is awaiting you and we know that you are up for the challenges ahead. Although most of our applicants have been able to finish their challenges in a weekend, we do not set a time limit on any of our challenges, and the time is not taken into account in our evaluation. For us, communicating well and achieving good results are more important than the speed at which you can achieve them. We prefer quality over quantity, same as in our daily business!

Step 2: Interview If the results of the challenge are promising, the interview will only be a formality in which you can talk to our team members during two to three interviews. This is really just a social check to see if we like each other and to see whether we can work together for many hours a day in the same room ;) but no more tests or coding required!

Step 3: offer You made it. The challenge looks great, we match on a personal level, and you've managed to excite us about your talent. We'll send you an offer as soon as possible, normally within a week, and we will discuss which items and equipment we can order to get you all settled in our office.

We're looking forward to working together with you!

Secure regards,


I would quickly pass on this, sounds more like an identity theft method disguised as a job posting. IBAN is linked to your bank account if I understand it correctly, so that's a big no.

Outside the US it isn't rare to see people asking age and marital status (lots of CV's even have it on there), which to American's is a big no-no as it can land the company into trouble with the government. IIRC through it isn't technically illegal in the U.S., just dangerous grounds to be on and all companies train you to avoid those types of questions, or even questions like how many kids etc.


Yeah, I’m sure there’s variation country-to-country, but in Canada this application would be ridiculous (and likely illegal?), with HUGE identity theft alarm bells going off.


A lot of that info was traditionally included in CVs in Spain (dob, phone# and address, citizenship, marital status and even driver permit situation, and a photo). These days it is increasingly rarer, and if a company asks it for a tech position it would definitely be a big red flag.

But, IBAN and copy of your passport, in a CV??? I can't believe it is not an outright scam.

Steer clear either way.


Not sure about your industry, but during the +10 years that I've been working as Software Engineer in Spain, nobody has asked me for:

- Date of birth: Never been asked that, but they could guess from my graduation date, I suppose.

- Address: Never been asked that. Only if I live in the same city (or close to that). Why should I have to give them my address?

- Marital status: Never been asked that and would be a big red flag IMO. Could be illegal, don't know.

- Driving license: Usually an optional field in resume web forms. Not required unless some travel by car is expected (not my case).

Only full name, citizenship (if Spanish, EU, or residence permit, obviously), city of residence, email and phone (to contact me, obviously). As long as you're legal and speak medium level of Spanish and English, you're clear.

In Spain is expected to include a photo in your CV, but it's not already the case in the world with professional social networks like LinkedIn? Thus, they are going to see me in the recruiting or HR interview, so what's the point on not including it?

Once an employee, IBAN is asked before the first salary monthly payment (obviously) and a photocopy of his/her national ID (or passport) for their legal department.


Even if they would be a legitimate company they would need to understand that in this market they are not buying but selling.

So apart from blatant privacy issues - way too many hoops.

Scam either way, stay clear.

(the hiring dynamics described in this article are basically valid for all devs in the current market - pretty much everywhere - don't fall for anachronistic HR schemes: https://hiringengineersbook.com/post/trouble-hiring/)


In the US at least, asking for DOB and marital status could potentially put the company in hot water.

The rest just looks sketchy from an identity theft perspective and is truly unnecessary at the early screening stages of hiring. Even if it’s legal wherever this company is located, I would hard pass on this.


Thank you for reply !

Yes I know that happen in USA and also in UK.

Can someone from Netherlands say how is it there ?

Cheers !


I’m Dutch. All of the requested data are legal to request as an employer in the Netherlands. Asking for an IBAN number (which is not considered “secret” btw) up front is a bit much though. You would only need that in case you are hired and they need too send the salary somewhere.

See list (in Dutch though) https://www.easypersoneel.nl/files/bewaarrichtlijnen-persone...


It is legal to request, but you would/should never do so as part of interviewing.

You really don’t want to know the candidates age, marital status or citizenship as part of an interview process. Once you do, you’re open to discrimination lawsuits for your hiring practises. Avoid asking questions that reveals information about stuff that is protected from discrimination.

https://www.government.nl/topics/discrimination/prohibition-...


Well, perhaps the IBAN is officially not considered secret, but it's still pretty sensitive - one bank had to disable a new feature in their app that allowed people who knew your phone number to obtain your IBAN: https://nos.nl/artikel/2268664-abn-schakelt-nieuwe-functie-t...


Hey. Also Dutch. Most of the things being asked are pretty normal to me (but it's more than I would expect a company to ask for...). I only find the IBAN weird to ask. Did you ask the company why they want your IBAN already? If it's a valid company, I'm pretty sure they're able to answer you.


No clue about NL specifically, but I would think a bunch of those should be illegal under GDPR?


Frankly, this is the kind of email that makes me reach out to them over some other means of communication to tell them that I've received a suspicious email which makes me believe their email server has been hacked.

At least two of these questions are risky (if not outright illegal) to ask almost everywhere in the civilized world. Worse: there are countries where the phone number, address and the information on a passport may be enough to convince a bank that you've "signed" a sponsorship deal with an NGO, agreeing to deposit a (small) sum of money from an account with a known IBAN account every month.

If this is real and legit, whoever is managing the hiring process there has screwed up big time...


Looks phishy. Too much information, some of those really should be irrelevant, and others at least have a reason given why they need them. (I.e. there's cases where I could see why they want a proof of citizenship early, but they'd need to say that then. I guess many CVs have phone number and address normally, but those also can be queried once needed. etc.).

Can't comment on the legal situation, especially not without knowing the country.


Thanks for reply !

The country is Netherlands.


I never saw an employer asking for IBAN. Feels shady to me.


This is identity theft. If it were real they wouldn't need your passport, date of birth or IBAN until they'd already hired you.


I think it's just a test, knowing that the company is summitto . Are you able to say no and reply properly?


>> may I ask you how you found us and what peaks your interest in XXXXXX ?

May be they should of proof read there copy.


I edited the message and put the XXXX in place to not expose that info, but someone here already got it, yes it's summitto.com and I was looking for the link here on HN and it seems that it was removed, probably after this post.


No they mean you don't 'peak interest', you 'pique interest'. What would 'peak your interest' even mean?


You left it in farther down in the post, in case you wanted to edit it.


Thank you for reply !

I can not edit anymore, it seems that the software disable that option after some time or other event has passed.


I think the GP is referring to the “peaks” spelling which should have been spelled “piques”.


Maybe they should have proofread their comment.


Please don't ever give a person a copy of your passport as part of a job application. You are being scammed.


So many red flags there. Run away.


I concur with the others. I'd be shocked if this wasn't some kind of identity theft scheme.


You left the company name above BTW.


IANAL. In EU it is too much information upfront which puts this possibly legit company in a dark area of GDPR and equality laws. Phone number and eligibility to work in EU is fine. The company may eventually ask remaining once you accept an offer. Still scanning a passport is a fishy practice if they can verify it when you visit them on site.


This is a scam. Don't do this.


This is not how we wanted to be featured on Hacker News but here it is. First of all let me start by saying: yes, we are legally required to ask all those questions in the Netherlands at a certain point, and to delete all of the data if we don't hire you. Do we have to ask all of this information in the first mail? No! In fact, our only goal was to have an efficient hiring process. Improving privacy is our company's mission, so we took the author of this post very serious, even before we came across this. Although we always made clear this information is optional and can be shared at later stages as well, we did not realize that it could be interpreted by our candidates as if he/she might get rejected if they refuse to share information. We do not want anyone to feel pressured. We therefore went back to the drawing board and changed our procedure.

Fortunately we only sent this mail to a handful of people before we realized that this is not the right approach. In the end, what we really wanted to know was: "Are you allowed to work in the EU?" But then we realized why stop there? We improved our process to ensure candidates are only asked to share a minimum amount of data! Feel free to check it out: https://summitto.com/hiringprocess

As other commenters have already stated, most information we ask is standard and in ~70% of the cases already answered in CVs we receive anyway because most of our applicants come from Germany, the Netherlands or Belgium. We learned now that as we target a global audience those "standard" questions are not a worldwide standard.

Some of you were suspicious that we base our hiring decisions on this information.

Let me state this very clearly: this requested information was never used to evaluate applicants. Summitto evaluates you only on your coding skills, and nothing else. We point to the fact in our first mail to the author of this post: "Please note that if there is some personal information which you prefer not to share yet, that is ok!" Moreover, we clearly stated this again in a second mail to the author of this post as well.

Regarding the IBAN account number: this information is essential to reimburse any flight expenses and of course to pay your salary. For the US citizens in this thread: no, sharing your bank account number in the EU is not comparable to how it works in the US banking system. IBAN numbers are not private or easily exploitable data. Still, we have now scrapped this question from our first email.

Although we truly appreciate the author's criticism in this post regarding the threat of theoretically losing his/her privacy, we would like to point out the irony that by complaining without properly anonymizing the data he/she actually violated ours.

We value the privacy of all of our candidates. We encourage them to protect the data they send using PGP, so it is encrypted in transit and at rest. Any data which belongs to applicants which were not hired is deleted within 30 days after the last contact.


what a fucking joke. jeez some people have zero scruples


Can a company ask for this info? Yes they can ask for almost anything they want to. What would stop them asking? If you don't want to give them the information then don't.


The problem with this attitude is that withholding that information could be seen as a sign that you’re a problematic employee. Even if the company really doesn’t care, an applicant has no way of knowing that. So by not answering the questions you could be eliminating yourself from the job right away.

It’s easy to be pithy and say “well that’s not a place you want to work anyway”, but that’s counter to the reality that many places don’t have a lot of employment options, and people simply need every chance they can get to find a job on merits as opposed to artificial elimination criteria that some incompetent low level HR person came up with.


I thought the original poster was asking if it was legal for the company to ask this - 'some countries have laws regulating some issues like what a company can ask for a job applicant' - yes they can there's only a few protected categories they can't ask you.

One of them was 'physical address'. I can't think what law someone would think would mean it was illegal to ask this.

It's not an attitude it was an answer to the question.


There's a ton of places to work. If you don't like how they treat you up front then don't bother applying. If it's not web design usually it's the engineer coding the company not the other way around.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: