Buying a franchise: protect your personal data during the application process

Joining a franchise network often starts with an application, interviews and an assessment of your financial position. Sometimes the process also includes aptitude tests or questions about your health. Before sending any personal data, find out why it is needed and who will use it. A responsible franchisor should be able to explain its assessment process without asking you to hand over your entire personal history just in case.

1. Distinguish necessary assessment from unnecessary data collection

It is reasonable for a franchisor to establish whether your experience, goals and financial circumstances are suited to the proposed business venture. Finland’s Suomi.fi public service portal describes the application process as an opportunity for both sides to get to know each other: each should feel sufficiently confident about entering a long-term partnership. This does not, however, give the franchisor an unlimited right to collect an applicant’s personal data.

Ask for the privacy notice before completing the application form. Among other things, it should identify the data controller, the purposes and legal bases for processing, the recipients of the data, and the retention period or the criteria used to determine it. Also check which information is compulsory and what happens if you do not provide it.

Consider each request in light of the stage you have reached in the application process. An initial discussion may require an outline of your work experience and available funding. Detailed documents may only become relevant later. Ask whether a summary would be sufficient initially, with supporting documents supplied only if negotiations progress.

For example, a full personal bank statement may reveal a great deal that has no bearing on franchisee selection. Where appropriate, suggest more limited evidence. Do not, however, withhold relevant information unilaterally: agree in advance what kind of document will adequately demonstrate the point in question.

2. Understand Finland’s rules and your rights

Finland has no specific franchising act, no statutory franchise disclosure document and no separate procedure for registering franchise agreements. General legislation governs franchisee selection and contract negotiations. The Contracts Act covers the formation and validity of contracts, while the Unfair Business Practices Act prohibits, among other things, misleading commercial communications. The prohibitions on discrimination under the Non-Discrimination Act must also be taken into account.

The processing of applicants’ personal data is subject to the EU General Data Protection Regulation, or GDPR, and Finland’s supplementary Data Protection Act. Interview notes, assessments and test results relating to a prospective franchisee also count as personal data. Planning to start a business does not remove their data protection safeguards.

There must be a legal basis for processing. Depending on the circumstances, this could be, for example, the necessity of taking pre-contractual steps at the applicant’s request, legitimate interests or consent. Simply submitting an application does not give the franchisor blanket permission to use the data for any purpose. The data must be necessary for its intended purpose and must not be retained without justification.

As a general rule, you have the right to be informed about the processing, to access your personal data and to request the correction of inaccurate information. Rights to erasure, restriction of processing and objection depend on the circumstances and the legal basis for processing. The right to erasure therefore does not mean that all material must always be destroyed immediately on request. If necessary, you can refer the matter to Finland’s Data Protection Ombudsman.

3. Check separately how tests and health data are handled

An aptitude test may help assess the prospects for a successful working relationship, but before taking part, ask for an explanation of what is being tested and how the result will be used. Discussing your readiness to run a business is one thing; drawing far-reaching conclusions about your personality without giving you a chance to comment is another.

Ask at least the following questions about any test:

• Who conducts the test and is responsible for processing the associated personal data?
• Will the franchisor receive all your responses or only a limited summary?
• Who within the franchise organisation will see the results, and how long will they be kept?
• Can you discuss the result and correct any inaccurate information used in the assessment?
• Will the selection decision be based on human assessment or made automatically?

The GDPR places specific restrictions on decisions based solely on automated processing that produce legal effects or similarly significant effects. Not every scoring system falls into this category, but it is still useful to clarify how the assessment works.

Health data falls within the special categories of personal data, whose processing is generally prohibited unless an applicable exception allows it. If the franchisor asks for a medical examination or health information, request a precise explanation of why it is needed and the legal basis for processing it. Also ask whether a limited statement of fitness would be sufficient instead of diagnoses or medical records. Do not attach health information to an ordinary application just in case.

4. Agree how data will be handled, including when the application process ends

Besides the franchisor, the application process may involve a recruitment partner, a testing provider or a finance provider. Find out whether data will be passed to these parties, what each will receive, and whether the recipient acts as an independent data controller or on the franchisor’s behalf. Membership of a franchise network does not in itself justify sharing applicant data with all its franchisees.

Ask for a secure way to submit sensitive documents or confidential financial information. Verify the recipient before sending anything, and keep a record of what you have supplied. If a document also contains personal data about your spouse or another third party, check separately whether that information is necessary.

Ask at the outset what will happen to your data if you withdraw your application or are not selected. Keeping an unfinished application for future application rounds is a different purpose from processing the current application, and it too must have an appropriate legal basis. If necessary, ask for written confirmation of the retention period and deletion policy.

Practical checklist: before sending personal data, confirm the purpose, legal basis, recipients and retention period. Supply only the necessary material, using a secure channel. Transparent data protection practices are also a useful indicator of how the franchisor will manage your future working relationship.