The Information Commissioner’s Office (ICO) has issued new guidance in conjunction with one of the charities that works with ex-offenders, around the extent to which, employers can ask applicants about their previous criminal records. It needs to be set in the context of recent research, which shows that a lot of employers are asking employees illegally about spent convictions, which they’re not entitled to.
The first thing that any employer is going to have to do is define their purpose for collecting the data and asking the question of the candidate. One thing they’re going to have to do is identify their lawful basis for processing that data, which is unlikely to be consent because the candidate doesn’t really have any freedom. In this case, any consent given would be unlikely to be genuine as a candidate may feel that no consent = no job. This leaves employers with two potential lawful bases:
- A contractual obligation or,
- A legal obligation
For example, an employer that has to vet staff that can attend a particular client site, will have a contractual obligation to fulfil. This would be the case where the client is legitimately concerned about terrorism for example. Or the employer might have legal obligations such as the duty of care towards vulnerable children or adults, which justifies them having a high level of detail around somebody’s criminal past.
What is clear is that it isn’t necessary for the employer to be asking about criminal records at the application stage at all. The ICO’s view is that this would be a breach of the GDPR and the Data Protection Act 2018. Instead it is more than likely to be relevant at the offer stage and you may make your offer of employment subject to satisfactory answers in relation to the criminal records question.
It’s clear that no one size fits all. The employer will need to consider jobs on a job-by-job basis and justify why they’re asking for information about criminal records. If I’m employing somebody in a finance role it is relevant for me to ask about previous dishonesty offences, but it is unlikely to be relevant for me to ask about any offence.
Where an employer is asking questions, they need to do it pursuant to a policy that is shared with job applicants. All employers should be issuing candidates with their tailored recruitment Privacy Notice detailing the individual’s data subject rights (ask us for a copy of such a document), but they’re likely to need to go into the particular lawful purposes the employer is proposing for this particular recruitment exercise and how they are going to be processing the data, the details about how that data is going to be used and to be stored securely etc.
The ICO’s guidance also makes it clear that anybody should have the opportunity to explain their criminal record, and that employers should be focusing on what they’ve done since the offence. Particularly you need to ask yourself ‘is it reasonable to deny employment to an otherwise qualified applicant because of a criminal record that maybe years old, irrelevant to the particular job or have occurred in particular circumstances’? Where you believe the answer to this question is yes, then you’re going to need to document the reasons why you think that is the case.
It’s clear from all of this that the ways in which we have operated in the past no longer apply, and that the traditional approach of ticking a box or two on an application form is no longer enough. Lots of employers are actually going to find that it is much more difficult to justify the questions – doing so based on a hunch that, for example, colleagues might not like working alongside somebody with a history, is simply not good enough.