May an employer Google applicants or check their social media?

Employers want to check applicants — Google, LinkedIn, sometimes Instagram or Facebook. Not unrestricted: Dutch NVP Application Code (Dutch HR Association) + GDPR set limits. What is allowed? (1) Public sources — LinkedIn profile, personal website, publicly shown social media. (2) Job-relevant info — work experience, education, professional references. (3) Prior disclosure: applicant must know from the job posting (or confirmation email) that social media will be checked. (4) Applicant's right to know: you can ask what they found — GDPR Art. 15. What is NOT allowed? (a) Logging in or "friending" to see hidden content. (b) Searching for special category data — religion, political view, health, sexual orientation (Art. 9). (c) Checking family member or partner data. (d) Using photos for profile analysis without legal basis. Discrimination risk: if via social media you see things that lead to decisions based on ethnicity, religion, or pregnancy — direct discrimination + complaint to NL Institute for Human Rights. What to do as applicant? On rejection: request access (Art. 15) — all data collected about you. No disclosure of research? AP complaint. Suspect discrimination? Institute for Human Rights.