Can Employers Check Applicants’ Public Social Media Accounts?

Introduction

Employers may review an applicant’s public digital footprint during recruitment, but public availability does not automatically mean unrestricted use. Searching social media accounts may involve the collection, recording, evaluation, and sharing of personal information regulated by the Data Privacy Act of 2012.

The proper question is not simply whether an employer can view a public post. It is whether the employer has a lawful basis, legitimate purpose, adequate notice, and proportionate process for collecting and using the information in making a hiring decision.

What Law Governs Social Media Background Checks?

The primary statute is the Data Privacy Act of 2012 or R.A. No. 10173, together with its implementing rules. The law applies to the processing of personal information by private employers, recruitment agencies, and other persons involved in hiring.

The governing principles are transparency, legitimate purpose, and proportionality. These principles require an employer to inform applicants about relevant data processing, identify the purpose for collecting the information, and limit the investigation to information reasonably necessary for that purpose.

The employer should also observe the organizational, physical, and technical safeguards required under the IRR of R.A. No. 10173. Personnel who access applicant information must maintain confidentiality when the information is not intended for public disclosure, and the employer should maintain appropriate access controls, retention periods, and disposal procedures.

Does Public Availability Mean Consent?

No. Information posted publicly on social media may be easier to access, but public availability does not by itself establish consent for every possible use.

The National Privacy Commission has stated that political parties, candidates, and information society service providers collecting information from public sources must still comply with the Data Privacy Act, including the requirements of lawful basis and the general data privacy principles. This position appears in NPC Advisory No. 2021-03.

The same principle is reflected in the National Privacy Commission’s more recent guidance on data scraping. Publicly accessible information remains subject to lawful processing requirements, purpose limitation, notice, and other safeguards. Public access therefore does not eliminate the applicant’s privacy rights.

When May an Employer Conduct a Social Media Search?

An employer may conduct a social media background check when the search is connected to a legitimate and declared employment purpose. Examples include verifying professional qualifications, assessing information directly relevant to a position, or investigating representations made by an applicant in a résumé or application form.

Processing may generally be supported by one or more lawful bases under the Data Privacy Act, including:

• the applicant’s consent, when consent is genuinely voluntary and properly informed;
• necessity for compliance with a legal obligation;
• necessity to protect the lawful rights and interests of the employer or another person; or
• the employer’s legitimate interest, provided that the applicant’s fundamental rights and freedoms are not overridden.

Under Section 12(f) of R.A. No. 10173, legitimate interest requires more than an employer’s general curiosity. The processing must be necessary for a legitimate interest, and that interest must be balanced against the applicant’s constitutionally protected rights and freedoms.

In NPC 19-758 and NPC 19-1846, the National Privacy Commission recognized legitimate-interest processing where the employer had a clear business purpose, the investigation was necessary to verify information, and the processing remained within what employees could reasonably expect. The same reasoning may apply to recruitment, but the employer must still assess necessity, fairness, relevance, and proportionality.

What Information May Be Reviewed?

The search should be confined to information that is relevant to the position and reasonably necessary for the stated purpose. A professional profile, publicly stated qualification, or business-related representation may be relevant in appropriate cases.

By contrast, the following information generally presents heightened privacy risks and should not be collected or used merely because it is visible online:

• religious beliefs, health information, or medical conditions;
• political opinions or affiliations;
• sexual orientation or intimate personal relationships;
• family circumstances unrelated to the job;
• personal addresses, contact numbers, or identity documents; and
• photographs or posts obtained from restricted, private, or deceptive access.

Information may also be sensitive because of how it is used. A photograph or personal statement that appears harmless in isolation may become problematic if it is used to infer a protected characteristic or to exclude an applicant for reasons unrelated to job performance.

What Does Proportionality Require?

Proportionality requires the employer to use no more information than is reasonably necessary for the hiring decision. A broad search of every available platform, followed by indefinite retention of screenshots and personal posts, may be excessive where a limited verification would have achieved the same purpose.

An employer should ask:

• What specific hiring concern justifies the search?
• Is the information relevant to the position?
• Could the concern be addressed through a less intrusive method?
• Was the information obtained from a genuinely public source?
• How long must the information be retained?
• Who may access the information?

The employer should document the purpose and scope of the search. A standardized process is preferable to allowing individual interviewers to browse applicants’ accounts based on personal preferences or unrecorded impressions.

What Notice Should Be Given to Applicants?

A privacy notice should explain that the employer may process applicant information for recruitment and verification purposes. The notice should identify, in understandable terms:

• the categories of personal information that may be reviewed;
• the purpose of the review;
• the lawful basis relied upon;
• the persons who may access or receive the information;
• the period of retention or the applicable retention criteria; and
• the applicant’s rights under the Data Privacy Act.

Consent may be appropriate in some recruitment activities, but consent should not be treated as a cure for an excessive or unrelated search. Where the processing is based on legitimate interest, the employer should not describe consent as the sole basis unless consent is actually being requested and is legally appropriate.

May Employers Require Applicants to Provide Passwords?

An employer should not require an applicant to surrender a social media password or provide access to private accounts as a condition of employment. Such a demand is highly intrusive and is difficult to justify under necessity and proportionality principles.

Employers should not use deception, impersonation, fake accounts, or another person’s private access to obtain information that the applicant has chosen not to make public. A search that circumvents privacy settings is materially different from reviewing information voluntarily placed in a genuinely public profile.

Can Social Media Information Be Used to Reject an Applicant?

It may be used only when the information is lawfully obtained, reliable, relevant to the position, and evaluated through a fair process. A single post, unattributed image, or unverified online allegation should not automatically determine an applicant’s suitability.

The applicant should ordinarily be given an opportunity to explain information that may materially affect the hiring decision, particularly where the information is disputed, ambiguous, outdated, or obtained from a third-party account.

Employers should distinguish between conduct that directly affects the position and lawful private activity that does not. Hiring decisions based on protected or highly sensitive personal information may expose the employer to privacy, employment, discrimination, or other legal risks.

What If the Information Is Incorrect?

Public information may be inaccurate, altered, misattributed, or posted by someone other than the applicant. The National Privacy Commission ordered the cessation of processing in a case involving a website that scraped government business-registration information and allowed users to edit or add details without adequate verification. The decision emphasized the risks of false disclosure, lack of a privacy notice, and failure to observe data privacy principles in NPC CDO 22-001.

The same concern applies to recruitment searches. Employers should verify the source, date, context, and authenticity of material before relying on it. They should avoid treating search-engine results, anonymous posts, or unverified accusations as established facts.

How Should Employers Handle Sensitive Personal Information?

Sensitive personal information is subject to stricter protection. Section 13(f) of R.A. No. 10173 permits processing when the information is necessary for the protection of lawful rights and interests in court proceedings, the establishment, exercise, or defense of legal claims, or when provided to a government or public authority.

That provision does not create a general license to collect sensitive information during recruitment. Processing must remain connected to a lawful purpose and must comply with transparency, legitimate purpose, and proportionality.

In Yonzon v. Coca-Cola Bottlers Philippines, Inc., G.R. No. 226244, 2021, the Supreme Court discussed the processing of employee salary information in connection with the protection of lawful rights and interests in legal proceedings. The case illustrates that the legal-claims exception is purpose-specific and should not be expanded into unrestricted disclosure or use.

Who May Conduct the Search?

Access should be limited to human-resources personnel, authorized investigators, or hiring decision-makers who need the information for a defined purpose. Employers should prohibit informal searches by interviewers who are not trained in privacy requirements.

Under the IRR of R.A. No. 10173, organizations must supervise personnel who access personal data and ensure that confidential information is handled securely. Access should be logged where appropriate, and copies of social media content should not be circulated through unrestricted messaging groups or personal devices.

Where a third-party recruitment agency conducts the search, the employer should establish the agency’s responsibilities through appropriate contractual and privacy arrangements. The employer should also verify that the agency follows the same limitations on purpose, access, retention, and disclosure.

How Long May Employers Keep Search Results?

Employers should retain social media information only for as long as necessary for the stated recruitment, compliance, or dispute-related purpose. Information relating to unsuccessful applicants should not be preserved indefinitely without a documented reason.

A retention schedule should identify when search notes, screenshots, links, and verification records will be deleted or anonymized. The employer should also ensure that discarded records cannot be reconstructed or accessed by unauthorized persons.

What Rights May Applicants Exercise?

Applicants may generally invoke their rights under the Data Privacy Act, subject to statutory limitations. Depending on the circumstances, these may include the right to be informed, the right to access, the right to object, the right to correct inaccurate information, the right to suspend or withdraw processing in appropriate cases, and the right to file a complaint with the National Privacy Commission.

An applicant may ask the employer what information was collected, why it was collected, and how it was used. The employer should have a process for responding to such requests and for correcting inaccurate or misleading recruitment records.

Illustrative Examples

Example 1: Professional verification. An employer hiring a communications officer reviews the applicant’s public professional profile to confirm employment history and published qualifications. This is more likely to be lawful when the applicant receives notice and the review is limited to professional information relevant to the position.

Example 2: Private-account access. An interviewer creates a false account to join a private applicant group and obtain personal photographs. This is highly intrusive and may violate transparency, legitimate-purpose, and proportionality requirements.

Example 3: Unverified accusation. An employer finds an anonymous post accusing an applicant of misconduct and rejects the application without verification or giving the applicant an opportunity to respond. This creates substantial risks because the information may be false, incomplete, or attributed to the wrong person.

Example 4: Sensitive information. An applicant’s public post reveals a medical condition unrelated to the job. The employer should not use that information as a hiring criterion merely because it was visible online.

Recommended Employer Policy

An employer conducting social media checks should adopt a written policy that:

• defines the legitimate recruitment purposes for which searches may be conducted;
• identifies authorized personnel and approved search methods;
• prohibits password requests, deception, and circumvention of privacy settings;
• limits searches to publicly available and job-relevant information;
• requires verification and an opportunity to respond to adverse information;
• restricts the collection and use of sensitive personal information;
• sets retention, deletion, and access rules; and
• provides a channel for privacy inquiries and complaints.

The employer should also train human-resources staff and hiring managers. A policy is ineffective if interviewers independently search applicants, retain screenshots on personal devices, or disclose findings to persons who have no role in the hiring decision.

Conclusion

Employers may review an applicant’s public social media presence in appropriate circumstances, but the search must have a lawful basis and a clear employment-related purpose. Public visibility does not equal unrestricted consent, and an employer must still comply with transparency, legitimate purpose, proportionality, security, accuracy, and retention requirements.

The safest approach is to use a documented and limited process: notify applicants, search only relevant public information, avoid sensitive personal data, verify adverse findings, allow a response, restrict access, and delete information when it is no longer needed.

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.