Can Employers Use Public Social Media Profiles in Hiring?
Introduction
Employers commonly review applicants’ publicly visible social media profiles before making hiring decisions. Although information appears openly accessible, public visibility does not automatically authorize unrestricted collection, evaluation, retention, or sharing of that information.
In the Philippines, recruitment screening must comply with the Data Privacy Act of 2012 (DPA). The central questions are whether the employer has a lawful purpose, whether the screening is necessary and proportionate, whether applicants receive adequate privacy information, and whether the employer avoids discriminatory or excessive use of personal data.
What Laws Govern Social Media Screening?
The DPA applies to the processing of personal information by private entities. “Processing” broadly includes collection, recording, organization, storage, updating, retrieval, consultation, use, blocking, erasure, or destruction of personal information. Thus, viewing an applicant’s profile for recruitment purposes may constitute processing when the employer collects, records, evaluates, or uses information from that profile.
Section 11 of R.A. No. 10173 requires processing to observe transparency, legitimate purpose, and proportionality. These principles apply even when the information is obtained from an open social media account.
The National Privacy Commission has emphasized that public availability does not remove personal information from the DPA’s coverage. Publicly accessible information remains subject to the DPA when it is collected, used, stored, or otherwise processed ([NPC 21-054 (2022)](#I4.17)).
Does Public Availability Mean the Employer May Use the Information Freely?
No. Public availability is relevant, but it is not an unrestricted license to collect or use information for any purpose.
The Supreme Court has recognized that privacy protection in online social networks depends partly on whether the user manifested an intention to restrict access through available privacy tools. Where no reasonable expectation of privacy exists, a privacy claim may fail; however, that conclusion does not eliminate the separate obligations imposed by the DPA on the organization processing the information ([Vivares, et al. v. St. Theresa’s College, et al. (2014)](#J6.1)).
Accordingly, an employer should distinguish between two separate issues: whether the applicant expected the information to remain private, and whether the employer’s collection and use of that information complies with the DPA.
What Lawful Basis May Support Screening?
Consent is not the only possible lawful basis for processing. Depending on the circumstances, an employer may rely on a lawful basis under Sections 12 or 13 of R.A. No. 10173, including legitimate interests, compliance with a legal obligation, or processing necessary for the protection of lawful rights and interests.
Legitimate-interest processing requires more than an employer’s assertion that the information is useful. The employer should be able to show that:
- the screening serves a genuine and lawful recruitment purpose;
- the information is reasonably necessary for evaluating the applicant;
- the processing is proportionate to that purpose; and
- the applicant’s fundamental rights and freedoms are not overridden.
The National Privacy Commission has recognized legitimate interest as a possible basis for processing where the activity is necessary, proportionate, transparent, and does not override the data subject’s rights ([NPC 19-1411 (2025)](#I7.29)).
For ordinary hiring, the employer should be cautious when claiming that broad social media surveillance is necessary. Reviewing information directly related to qualifications, professional experience, or stated work history may be easier to justify than examining an applicant’s political views, family relationships, religious affiliations, health information, or private conduct.
What Is the Role of Transparency?
Transparency requires the employer to inform applicants, in a clear and reasonably accessible manner, about the processing of their personal information. A privacy notice or recruitment privacy policy should explain, at minimum:
- that publicly available online information may be reviewed;
- the purposes of the review;
- the categories of information that may be collected;
- the lawful basis relied upon;
- who may access the information;
- how long screening records will be retained; and
- how applicants may exercise their data subject rights.
Silently conducting extensive searches through an applicant’s personal accounts creates greater privacy risk, particularly where the employer retains screenshots, copies profile information, or shares adverse findings with decision-makers who do not need the information.
What Information Should Employers Avoid Using?
Employers should avoid collecting or relying on information unrelated to the position. This includes data that may reveal an applicant’s health, marital status, religion, political affiliation, sexual life, ethnic origin, or other sensitive personal information.
Information appearing in a social media profile may qualify as sensitive personal information depending on its nature. The Supreme Court has explained that personal information obtained from official records, including information relating to marital status, may fall within the category of sensitive personal information. Processing such information requires a valid basis under Section 13 of R.A. No. 10173 ([Azarraga v. Jalbuna (2023)](#J4.20)).
As a general rule, hiring managers should not investigate sensitive personal information merely because it is visible online. If such information is incidentally encountered, it should not be copied, circulated, or used in the hiring decision unless a specific and defensible legal basis exists.
Can Employers Use Social Media Information to Reject an Applicant?
An employer may consider publicly available information when it is genuinely relevant to the position, lawfully obtained, reasonably verified, and evaluated consistently with the employer’s recruitment policy. The decision should not be based on stereotypes, personal dislike, protected characteristics, or unverified allegations.
For example, a public professional profile that materially contradicts an applicant’s stated employment history may warrant verification. By contrast, rejecting an applicant because of lawful political expression, family circumstances, religious activity, or a personal lifestyle choice may create privacy, discrimination, labor, or constitutional concerns, depending on the facts.
Employers should also avoid treating a social media post as conclusive evidence. Public content may be incomplete, misattributed, altered, taken out of context, or posted by someone using the applicant’s name.
What Does Proportionality Require?
Proportionality requires the employer to collect only information reasonably necessary for the stated recruitment purpose. The availability of more information does not justify collecting more information.
| Lower-risk practice | Higher-risk practice |
|---|---|
| Reviewing a public professional profile for work history | Searching an applicant’s relatives, friends, or unrelated accounts |
| Checking information directly relevant to a regulated position | Collecting political, religious, health, or family information |
| Recording only a verified, job-related discrepancy | Saving broad screenshots of an applicant’s personal life |
| Restricting access to authorized HR personnel | Circulating findings through informal messaging groups |
The NPC has ruled that even processing supported by a lawful purpose may violate the DPA when information is disclosed to more personnel than necessary. This illustrates that lawful purpose does not excuse excessive disclosure ([NPC 21-082 (2026)](#I3.24)).
What Procedures Should Human Resources Follow?
A defensible social media screening process should include the following safeguards:
- Adopt a written policy. State whether screening is conducted, at what stage, by whom, and for which positions.
- Define the search scope. Limit searches to publicly available information reasonably related to the position.
- Use authorized personnel. Assign screening to trained HR personnel rather than allowing every hiring manager to conduct informal searches.
- Separate sensitive information. If protected or sensitive information is incidentally viewed, do not include it in the evaluation record unless legally necessary.
- Verify adverse information. Give the applicant a reasonable opportunity to explain significant discrepancies or allegations.
- Document the reason for reliance. Record the job-related basis for using the information, not merely the fact that it was found online.
- Limit retention and access. Keep only what is necessary and securely dispose of records that no longer serve a legitimate purpose.
Are Screenshots and Search Notes Permitted?
They may constitute additional processing and should not be created routinely. An employer should preserve a screenshot or note only when necessary to document a specific, legitimate, and job-related issue.
Records should identify the source, date, relevance to the position, verification steps, persons with access, and retention period. Personal commentary, speculation, and irrelevant observations should not be included.
Does the DPA Prohibit All Social Media Screening?
No. The DPA does not impose an absolute prohibition on reviewing public social media profiles. It regulates the manner, purpose, scope, and consequences of the processing.
Public social media screening is more defensible when it is transparent, limited, consistent, job-related, proportionate, and supported by a lawful basis. It becomes more vulnerable to challenge when it is covert, indiscriminate, based on sensitive information, conducted by unauthorized personnel, or used to make decisions unrelated to the position.
Practical Guidance for Employers and Applicants
Employers should treat online screening as a formal data-processing activity, not as casual internet research. Their privacy notice, recruitment policy, access controls, retention schedule, and employee training should reflect that reality.
Applicants should assume that public posts may be viewed, but they retain rights under the DPA. They may ask how their information was collected and used, request access where appropriate, and raise concerns about inaccurate, excessive, or unauthorized processing.
Neither employers nor applicants should assume that a profile’s public status resolves every legal issue. The decisive questions are purpose, necessity, proportionality, transparency, lawful basis, and the nature of the information involved.
Conclusion
Employers in the Philippines may review public social media profiles during recruitment, but the practice must comply with the Data Privacy Act. Public accessibility does not remove personal information from the law’s protection, and it does not permit unlimited collection or use.
The safest approach is to limit screening to information relevant to the position, disclose the practice through a privacy notice, avoid sensitive personal information, verify material findings, restrict access, and retain only what is necessary. A hiring decision should rest on qualifications and verified job-related facts—not on an applicant’s lawful private life or protected personal characteristics.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
