If you’re a fan of referral systems, you’d better enjoy the heck out of them over this winter and early spring.
As you’re probably learning more about GDPR for recruiters (and who isn’t, these days), you’ll not doubt be getting a grip on the general gist of things like Consent and Right of Access.
It doesn’t take a genius to realise that a referred party has not consented to your storing their data, or to you contacting them. Although GDPR mentioned both ‘consent’ and ‘explicit consent’, in the case of referrals, consent has not been freely given, unambiguous, informed and specific. As a data controller, you’ll need to demonstrate a consent trail that shows agreement to personal data being processed.
Referrals may have been a good source of growing your talent pool, but sorry to be the bearer of bad news: as of 25th of May 2018 it’s going to have to stop.