Sharing of CV

I submitted my CV to a recruitment firm in October 2024 for a legal assistant position. Shortly thereafter, I was invited for an interview, but nothing materialised from that process. A few weeks later, I received a call from a different entity stating that they had received my CV and were considering me for a position. This came as a surprise, as I had not applied to that entity. It later emerged that my CV had been shared by the recruitment firm. Is such sharing of a CV permissible under Tanzanian law?

IK, Mwanza

This is a very practical concern, particularly in the current employment environment where the use of digital recruitment platforms and third-party engagements is increasingly common. Under the Personal Data Protection Act [Cap. 44 R.E 2023] (the Act), a data controller is required to ensure that personal data is processed lawfully, fairly and transparently, and that it is collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes. In the context of employment, where a CV is submitted for a particular job application, the purpose of collection is ordinarily limited to that specific recruitment process. The Act further places limitations on the disclosure of personal data, and restricts a data controller from disclosing such data to third parties without a lawful basis. Accordingly, sharing a CV with a third party for a different opportunity, without informing the data subject or establishing a proper legal basis, is likely to amount to unlawful disclosure of personal data.

In addition, the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023) reinforce the principles of lawfulness and purpose limitation, requiring that personal data be processed only for the purpose for which it was collected and in a lawful manner. While there might be instances where such sharing could be justified, for example, where the data subject has provided prior consent or where the terms governing submission of the CV expressly allow broader circulation, this must be clearly established. It cannot be presumed. In the circumstances described, where there is no indication of consent, disclosure, or any lawful basis, there is a strong basis to argue that the data subject’s rights have been infringed. The law further provides a remedy, where a person may lodge a complaint with the Personal Data Protection Commission which is empowered to investigate and take appropriate enforcement action in case there is a violation of personal data protection principles.