The practice of employers forcing current employees (applying for new positions internally) or prospective employees to obtain and disclose the results of a data access request from the police will be a criminal offence in the UK from 1 December 2014.
It has been increasingly common for employers to ask employees to make a data access request since the rules on background checks were changed. This change to the law seeks to temper the power of employers to demand to see criminal records and force candidates to disclose old or irrelevant convictions. It was always an arbitrary power. It struck fear into the hearts of some candidates because they may have thought that, for example, a disorderly behaviour conviction from Fresher’s week way back in the University days could cast a shadow over their future employment prospects.
In the UK, an employer conducting background checks will process a significant amount of personal data, which will likely include checking whether a job candidate has a criminal record, notably for certain positions such as in financial services or working with children. The request by an employer of someone for any prior convictions is lawful, subject to a person’s consent, but only where relevant for the position in question. To date, employers may have been tempted to access data as part of this check beyond what they could usually access such as for spent convictions (where a person has not reoffended and is rehabilitated) or cautions (a formal warning where an adult has admitted an offence, used by the police to resolve a case where full prosecution is not considered appropriate). Forcing a person to obtain this information by making an official “subject access request” (under UK data protection law) is now outlawed. Ireland also now has a similar provision in place.
If an employer does need disclosure of any relevant employee convictions, it will have to obtain this by going through the so-called “disclosure and barring service process” with the governmental body the Disclosure and Barring Service (https://www.gov.uk/government/organisations/disclosure-and-barring-service). The body in charge of the process in Scotland is Disclosure Scotland. (http://www.disclosurescotland.co.uk/)
The new change comes under an amendment to the Data Protection Act 1998. Section 56 says that any employer or recruiter who does demand such a record as a condition of employment will be guilty of an offence. So employers could find themselves in the dock if they do breach this powerful new provision.
The sanction for this offence is a fine of up to £5,000 in the Magistrate’s Court (the lower criminal court in England & Wales) or an unlimited fine in the Crown Court (the higher criminal court). The Information Commissioner’s Office in the UK has been keen to stress that it will enforce this offence.
Employers should therefore ensure that they have adapted their recruitment policies accordingly.
Gayle McFarlane, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH
Office: +44 (0)207 118 2700
André Bywater, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH
Office: +44 (0)207 075 1785
andre.bywater@corderycompliance.com