Today we have published new guidance to support employers to ensure that their policies and practices on collecting criminal records data during recruitment is compliant with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The guidance makes it clear that collecting criminal records at the initial application stage is unlikely to be necessary and therefore in breach of data protection law.

Christopher Stacey, co-director of Unlock, said:

“Too often, employers overlook skills, experience and qualifications if an applicant declares they have a criminal record. Yet over 11 million people in the UK have a criminal record. The GDPR and the Data Protection Act 2018 make it clear that asking about criminal records must be necessary – if it isn’t necessary, it isn’t compliant.

 

“This guidance makes it clear that the current common practice of many large employers of asking about criminal records at the initial application stage needs to change to ensure compliance with data protection law. That’s why we’re strongly encouraging employers to no longer ask about criminal records at application stage. However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we recommend employers to use this as an opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions.

 

“Proactive recruiters report that employees with convictions are more productive and more loyal than average. We hope that this guidance helps employers to review their approach towards criminal records and ensure that if information is collected, it is used fairly and only where necessary.”

Jessica Rose, Ban the Box campaign manager at Business in the Community, said:

“Unlock’s straightforward and practical guide for employers collecting criminal records data makes it clear that Ban the Box is the right approach for recruitment under GDPR. We urge employers to read the guide and to move any necessary questions about criminal convictions to later in the recruitment process. Once you’ve made the change we’d be delighted to have you join the growing movement of employers demonstrating their fair approach to the recruitment of people with criminal records through signing up to Ban the Box.”

The Information Commissioner’s Office, who Unlock worked closely with to produce the guidance, said:

“This is useful guidance that will help employers to review their policies and practices when requesting information about criminal records in recruitment. It is crucial that employers understand their obligations to data protection law and this guidance will help them to do this.”

The guidance sets out a three-stage process for employers to follow in determining if, when and how they should ask about criminal records. Key points of the guidance are that:

1. Collecting criminal records at application stage is unlikely to be necessary and therefore in breach of the GDPR and the DPA18
2. Collecting at any stage must be justified by a link between purpose and processing.
3. You must identify a lawful basis for processing AND meet a condition of processing
4. Applicants have data subject rights that must be upheld
5. Explaining how you’ll uphold applicants’ rights is key to meeting the condition of processing

The full implications of the GDPR are still being embedded, but it is clear that data controllers must comply with data protection law. This guidance makes it clear what employers should be doing, and it is likely that individuals will look to challenge those organisations that operate policies and practices that do not comply.

This guidance is part of the practical guidance we provide via Recruit! – a website providing advice and support for employers on recruiting people with convictions and dealing with criminal records fairly. Employers looking for further advice about this guidance can contact recruit@unlock.org.uk.

We will shortly be publishing separate guidance for applicants on their data subject rights and how to challenge unfair or unlawful practice where they encounter it.

Notes

1. Unlock is an independent, award-winning national charity that provides a voice and support for people with convictions who are facing stigma and obstacles because of their criminal record, often long after they have served their sentence.
2. There are over 11 million people in the UK that have a criminal record.
3. Unlock’s website is unlock.devchd.com.
4. The guidance is available to download at recruit.unlock.org.uk/dataprotection
5. The guidance is for employers and voluntary organisations in England & Wales who collect, or plan to collect, criminal records data for recruitment purposes.
6. For more information on becoming a Ban the Box employer, please see bitc.org.uk/banthebox
7. Unlock are grateful for the advice and support received from the Information Commissioner’s Office in producing this guidance. Links to their guidance are embedded in the document and more information is available on their website. There is also a useful briefing produced by Nacro on data protection and the use of criminal offence data.