Quoted from Article 20 Working Party (“WP29”) Opinion 2/2017 :
“Use of social media by individuals is widespread and it is relatively common for user profiles to be publicly viewable depending on the settings chosen by the account holder. As a result, employers may believe that inspecting the social profiles of prospective candidates can be justified during their recruitment processes. This may also be the case for other publicly available information about the potential employee.
However, employers should not assume that merely because an individual’s social media profile is publicly available they are then allowed to process those data for their own purposes. A legal ground is required for this processing, such as legitimate interest. In this context the employer should—prior to the inspection of a social media profile—take into account whether the social media profile of the applicant is related to business or private purposes, as this can be an important indication for the legal admissibility of the data inspection. In addition, employers are only allowed to collect and process personal data relating to job applicants to the extent that the collection of that data is necessary and relevant to the performance of the job which is being applied for.
Data collected during the recruitment process should generally be deleted as soon as it becomes clear that an offer of employment will not be made or is not accepted by the individual concerned15. The individual must also be correctly informed of any such processing before they engage with the recruitment process.
There is no legal ground for an employer to require potential employees to “friend” the potential employer, or in other ways provide access to the contents of their profiles.”
Furthermore, if you manually search for candidates on LinkedIn, of if you enter a candidate’s information based on a referral, you must inform the candidate within a month about the fact that you are now processing their data, for example by providing them with your privacy policy that covers this processing.