With input from the ICO, Unlock, a charity aimed at supporting the rehabilitation of ex-offenders, published guidance for employers on the processing of criminal record data.
Asking the question: Guidance for employers on the GDPR, data protection and the processing of criminal records data in recruitment (the "Guidance") provides a helpful starting point for employers when considering criminal record checks as part of the recruitment process, both in respect of the General Data Protection Regulation ("GDPR") and the Data Protection Act 2018 ("DPA 2018").
After first reviewing the GDPR's data protection principles, the Guidance explores both the data protection and employment law considerations employers must bear in mind to compliantly process criminal record data, such as automated decision making, the Rehabilitation of Offenders Act 1974, and the requirement under the DPA 2018 for an appropriate policy document. The Guidance concludes with some practical points about the timing of such checks, with an encouragement for employers to join the U.S.-originating 'Ban the Box' campaign, aimed at removing questions from application forms about previous criminal history and thereby creating a fair opportunity for candidates with previous convictions to access employment.
The Guidance is balanced and successfully hones in on some key considerations for employers based in England and Wales, where criminal record disclosures are processed by the Disclosure and Barring Service ("DBS"). Unfortunately, the Guidance does not pick up on some substantive and procedural nuances for employers located in Scotland and Northern Ireland, where the DBS's counterparts – Disclosure Scotland and Access Northern Ireland – can have varying requirements. More importantly, and despite repeating the need for employers to consider the necessity of processing as a cornerstone for compliance, the Guidance falls short in exploring necessity in more than just theoretical terms.
