The collection of information for screening purposes in the UK is likely to engage the Data Protection Act 1998 (DPA), placing a number of obligations on any company collecting an employee's 'personal data'. Companies that operate across the EEA should note that although data protection law is based on an EU Directive (from which the DPA is itself derived), there is considerable variation in the way it is applied and screening is likely to be more difficult in many other countries.

The DPA requires companies to notify individuals before a screening exercise takes place. This should explain the purpose or purposes for which the employee's data are intended to be processed as part of the screening and any further information which is considered necessary in the circumstances.

It is unlikely that UK companies will require the consent of employees as there are other data processing conditions which the companies could rely on under the DPA. There are stricter conditions imposed on companies, however, if 'sensitive personal data' are collected (for example, health data, or information on religious or philosophical beliefs). Employee consent is likely to be required for such data and could be sought by incorporating suitable wording in the individual's employment contract.

Companies should be diligent in checking the accuracy of any information they receive through the screening process and be aware of restrictions placed on the use of automated decision-taking technology. The DPA also requires companies to ensure that they don't process excessive or irrelevant data; consideration should be given, therefore, to the amount of data that is considered necessary to effectively screen individuals. It would be important to understand whether the screening lists could be limited to an employee's basic identification (for example, name and address) before a potential match was made and additional data collection was required. 

Companies will also need to be aware of DPA rules concerning the export of data to the US (and any other countries outside the EEA). For example, where the importing organisation is not 'Safe Harbor' certified, standard contractual clauses may need to be agreed between the companies to ensure that there are adequate protections in place for the data.

There is no requirement in the UK for companies to submit to the local data protection authority (the ICO) for approval prior to implementation of the screening process but companies would need to ensure that their ICO notification is up-to-date.

There are notable sanctions for data protection breaches in the UK; under new ICO powers, a serious breach of the DPA can attract fines of up to £500,000.

From an employment law perspective, the main area of concern in the UK is that compliance with ITAR exemptions under 126.18 may fall foul of the anti-discrimination provisions contained in the Equality Act 2010.

Although it is made clear that nationality of itself will not of itself prohibit access to defence articles, an employee who has substantive contacts with prohibited countries may be denied access.  The requirement that employees do not have substantive contact with certain countries could amount to indirect race discrimination, even in circumstances where employees are prepared to sign a contract of employment accepting such a limitation.

Discrimination on the basis of race may be legally justified if it can be shown that such discrimination is a proportionate way of achieving a legitimate aim. However, making out such a case will depend on the particular circumstances of each case.

There are in addition certain exceptions to the application of the Equality Act.  For example, exceptions may be available on the grounds of national security or pursuant to a ministerial order. The ability for employers to rely on such exceptions is likely to be limited and ministerial orders may not be forthcoming in this area.

b.  France

In France, the same data protection restrictions apply as in the UK and processing should be notified to the French data protection authority (CNIL). Transfers to the US where the importer is not "safe Harbor" certified are subject to a prior authorisation of the French data protection authority (CNIL) even when standard contractual clauses have been concluded with the importer.

It is uncertain whether employee consent, even inserted in employment contracts, could permit the processing of sensitive data, since employee consent is generally considered as invalid by the French data protection authority (CNIL) based on the presumption that it cannot be freely given. Whereas  nationality is not considered under French data protection law as sensitive data (unlike under  employment law, see below), processing of other types of information that might reveal, even indirectly, existing or presumed ethnic origin or political opinions or other sensitive data would be subject to caution.

Companies should be particularly diligent in ensuring the objectivity and relevance of questionnaires. The wording of questionnaires and the adequacy of answers should be strictly defined. Furthermore, collection of information from other persons than employees themselves could be considered as unfair or disproportionate in case employees are not adequately informed and are not given a right to raise legitimate objections to the processing of their data. In addition, companies should pay close attention to measures for maintaining confidentiality and security of data and they should strictly limit the categories of personnel authorised to access data.  Keeping data up to 5 years will also trigger the necessity to put in place an adequate archiving process in compliance with CNIL's guidelines. 

In case of a data protection breach, the French DP act gives the CNIL powers of sanctions, including fines up to 300,000€ and powers to stop the processing, all of which may be made public and result in adverse publicity. In addition, processing of personal data without prior filing with the CNIL, or  unfair collection of personal data or processing of sensitive data in breach of data protection law may constitute a criminal offense sanctioned by 5 years of imprisonment and by a fine up to 1,500,000€.

c.  Germany

From a German perspective the new ITAR exemptions raises issues with respect to the German Data Protection Act and the General Equal Treatment Act as well as general employment law.

Employee data collection and transmission in Germany is subject to the German Data Protection Act, which is – like the UK DPA – based on EU Law. Employee data collection and transmission is only legitimate under German law if either the employee has given his or her consent or a statutory regulation permits data collection/transmission in a specific case.

It is questionable whether the employee's consent in this respect could be obtained with suitable wording in the employment contract upfront but most notably such consent can be withdrawn at any time by the employee at his/her sole discretion. Without the employee's consent the screening could yet be justified, if the collection of information and its export is necessary to protect legitimate interests of a third party or for reasons of national and public security. However, this would require an assessment of whether the principle of proportionality is preserved with respect to each piece of information and each step of the screening and exporting procedure. It seems highly doubtful whether collection and/or export of information regarding "substantial contacts" would be deemed generally proportionate and it is therefore unlikely to be permitted. 

The screening is also likely to conflict with the General Equal Treatment Act, which is also derived from EU Directives. The Act prohibits, among other restrictions, discrimination based on race and ethnic origin. The screening of only those employees on the basis of nationality under 126.1 could be deemed indirect discrimination. This could still be justified if the screening and export of data pursues a lawful intention and is proportionate and necessary, which would have to be assessed in each particular case.  A similar check to that required under data protection law would be required.