The problem
Employers, insurers, housing associations and others regularly ask for details of criminal records. Depending on the specific situation, they may be able to request a criminal record check (for example, a basic disclosure, or a standard/enhanced disclosure).
However, occasionally they ask for the individual to apply for a copy of their police record. This discloses a significant amount of personal data. It can include spent convictions, as well as cautions and convictions that might have been filtered by the DBS.
This type of practice, known as ‘enforced subject access’, became a criminal offence on the 10th March 2015, through the Government finally bringing s.56 of the Data Protection Act into force.
What we think needs to change
We welcome the introduction of the offence. However, employers and others need to be discouraged from using this route, and so action needs to be taken against those continuing with this practice.
What we're doing
- We’ve long campaigned for ‘enforced subject access’ to become a criminal offence.
- We’ve produced a practical information guide to help people with criminal records understand the practice of enforced subject access.
- We’ve produced a guidance for employers to help ensure that recruitment practices are compliant with the law.
- We’re highlighting the technical guidance that the Information Commissioners Office has published.
- We’re collecting examples and taking action against any practice that might amount to ‘enforced subject access’. If you come across any practices that you think might fall into this category, please get in touch or send us the details (see below).
Share your evidence
You first need to be fairly confident that the situation falls under the remit of an ‘enforced subject access’. To help with this, you should read this guidance, and the guidance of the ICO. If you’re not sure, you can seek advice from our helpline, where we can advise on what to do next.
In practice, the individual/organisation guilty of ‘enforced subject access’ will need to be challenged. This can sometimes be difficult to do as an individual, which is why we’re working closely with the ICO to highlight examples and take action in specific cases. The ICO has indicated that it intends to prosecute those who continue to make enforced subject access requests.
Where there is evidence of enforced subject access, we ask that you send us the details, including any evidence, to policy@unlock.org.uk.
Any personal details that you send us will be entirely confidential and will not be shared outside of Unlock without your express permission.
