Employers in the UK who now carry out criminal record checks on job applicants, or existing employees, by forcing that person to make a request for information to the law enforcement authorities or the court and reveal the results to the employer will be committing a criminal offence.
The right of an individual to access data held about himself or herself has been a key protection afforded since the Data Protection Act 1998 (DPA) came into force in the UK. However, it is thought that some employers have been compelling individuals to exercise this right as a way of obtaining information on their criminal history "by the back door" rather than in accordance with the existing statutory regime. This is commonly known as "enforced subject access requests."
The UK Information Commissioner's Office (ICO) makes clear in its Data Protection Employment Practices Code that this practice is unacceptable. Employers who need to check an employee's or prospective employee's criminal history should do so in accordance with the statutory regime – that is, by requesting one of three levels of check from the Disclosure and Barring Service in England and Wales; Disclosure Scotland in Scotland; and Access Northern Ireland in Northern Ireland. The type of information and amount of detail disclosed will depend on the nature of the position being filled and level of check required. The principle behind this regime is that people should be allowed to be rehabilitated and, therefore in relation to some roles, certain convictions and cautions need not be disclosed to a potential or actual employer.
Despite this being a long held view, the new criminal offence, set out in section 56 of the DPA, only came into force on 10 March 2015. As a result, an organization (or individual person) will now commit an offence if, in connection with (a) the recruitment of an employee, (b) the continued employment of an employee or (c) any contract for the provision of goods, facilities or services to it by another person, the employer requires that person or a third party to supply details of his or her criminal record history by requiring the individual to request the information and provide it to the employer. Employers found guilty of the offence can be subjected to an unlimited fine.
The new offence is not limited to the employment and recruitment of employees. People or organizations providing goods, facilities or services are also prohibited from requiring an individual to make a request for the information and provide it to the company as a condition of providing goods or services.
The ICO has published guidance in relation to the new offence.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Morrison & Foerster LLP. All rights reserved
