Skip to main content
For people with criminal records
For people with criminal records

Tag: gdpr

Using the General Data Protection Regulation (GDPR) to protect your personal data.

From the outset of the recruitment process, employers will ask you to share a lot of personal data to enable them to contact you and assess your suitability for a role.

It has become common practice for employers to ask prospective employees about their criminal convictions and many will also carry out formal criminal record checks.

If you’re being asked to disclose details of your conviction, then an employer should be able to provide you with details of the lawful basis and condition they rely on when asking. You should also be able to access a copy of or link to their privacy policy which should set out the purpose of processing your data, how it will be used and stored, the data retention periods and who you data could be shared with.

But, what should you do if you’ve given this information to an employer and your application is unsuccessful?

The information you’ve disclosed is extremely sensitive and personal and you should expect that an employer will handle your personal information responsibly and in line with the law and good practice. However, to be sure that an organisation is not holding onto your information unlawfully, you have the right to ask that an organisation deletes all information they hold about you. This is officially referred to as ‘the right to erasure’.

GDPR significantly strengthens the rights you have over the processing of your personal data and we’d recommend that you use it to your advantage by always requesting that an organisation delete your personal data if an application you’ve made for a job is unsuccessful.

For more information

Your right to be forgotten

Think back to the last time you applied for a job. Did the application include a tick box question on criminal convictions?

Last year Unlock published research showing that three quarters of national employers still ask about criminal records on application forms. This can be off-putting to applicants with convictions and we don’t think it’s necessary for employers to ask this question so early on. Employers are responsible for deleting unnecessary information – whether its from applicants who don’t take the job, or employees who have left. This post looks at how you can request that your data is deleted when it’s no longer needed.

Deleting criminal records information

Where an organisation (known as a data controller) wants to process data about criminal convictions, they must have a lawful basis for doing so under Article 6 and a condition of processing under Article 10 of the GDPR. As a result of GDPR, organisations need to consider what information is necessary, and when. Here we’ll focus on employers but the same rules apply to any organisation that collects personal data – housing providers, colleges or universities, insurance companies. If you’re being asked to disclose information about convictions, you should be able to access the employer’s privacy policy which will tell you how long your data will be retained. Employers should delete information within these timescales.

However, a CIPHR survey found that this is not always happening as it should. 137 HR professionals were asked if they had published retention periods, and whether data was being deleted at the right time.  83% had published retention periods for data, but only 69% had actually deleted the information as they should have. More than half used paper notes or calendar reminders rather than automated systems to let them know when data should be deleted.

Where data protection breaches are proven, enforcement action could have serious consequences for organisations. The 30% of HR teams who admitted they had not deleted data as required were exposing their companies to significant financial penalties – the maximum fine now is £17.5 million or 4% of the company’s annual global turnover (whichever is higher).

What can you do?

The GDPR gives individuals rights over their data – we recently published guidance for individuals on this. When your information is no longer necessary, it should be securely destroyed. This is known as the right to erasure or the ‘right to be forgotten’ and means you have more power to hold data controllers to account. Where might you want to use your right to erasure?

If you have:

  • ticked the box on an application form for a job, for housing or a place at college or university
  • disclosed more detailed information during the recruitment process
  • provided your employer with a DBS certificate
  • disclosed an unspent conviction that has become spent
  • left a job where your criminal record information was collected during recruitment.

If any of these apply to you, consider asking the data controller to #deletemydata. You can download a template here.

Already done this? Tell us about it.

If they are unable or unwilling to resolve your concern, you can raise the matter with the Information Commissioners Office within three months of your last meaningful contact with them.

GDPR and data protection – Guidance for individuals

On the 25th May 2018, the General Data Protection Regulation (GDPR) came into force and the Data Protection Act 1998 was replaced by the Data Protection Act 2018 (DPA18) to incorporate the GDPR provisions which are specific to the UK.

We’ve produced some new guidance which deals specifically with the use of GDPR and DPA18 for recruitment purposes and the collection and processing of criminal record data. It sets out what personal data employers are allowed to collect and process, and the steps you can take if you believe an employer has breached GDPR/DPA18.

New guidance published to support employers with GDPR, data protection and processing criminal records in recruitment

Today we have published new guidance to support employers to ensure that their policies and practices on collecting criminal records data during recruitment is compliant with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The guidance makes it clear that collecting criminal records at the initial application stage is unlikely to be necessary and therefore in breach of data protection law.

 

Christopher Stacey, co-director of Unlock, said:

“Too often, employers overlook skills, experience and qualifications if an applicant declares they have a criminal record. Yet over 11 million people in the UK have a criminal record. The GDPR and the Data Protection Act 2018 make it clear that asking about criminal records must be necessary – if it isn’t necessary, it isn’t compliant.

 

“This guidance makes it clear that the current common practice of many large employers of asking about criminal records at the initial application stage needs to change to ensure compliance with data protection law. That’s why we’re strongly encouraging employers to no longer ask about criminal records at application stage. However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we recommend employers to use this as an opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions.

 

“Proactive recruiters report that employees with convictions are more productive and more loyal than average. We hope that this guidance helps employers to review their approach towards criminal records and ensure that if information is collected, it is used fairly and only where necessary.”

 

Jessica Rose, Ban the Box campaign manager at Business in the Community, said:

“Unlock’s straightforward and practical guide for employers collecting criminal records data makes it clear that Ban the Box is the right approach for recruitment under GDPR. We urge employers to read the guide and to move any necessary questions about criminal convictions to later in the recruitment process. Once you’ve made the change we’d be delighted to have you join the growing movement of employers demonstrating their fair approach to the recruitment of people with criminal records through signing up to Ban the Box.”

 

The Information Commissioner’s Office, who Unlock worked closely with to produce the guidance, said:

“This is useful guidance that will help employers to review their policies and practices when requesting information about criminal records in recruitment. It is crucial that employers understand their obligations to data protection law and this guidance will help them to do this.”

 

The guidance sets out a three-stage process for employers to follow in determining if, when and how they should ask about criminal records. Key points of the guidance are that:

  1. Collecting criminal records at application stage is unlikely to be necessary and therefore in breach of the GDPR and the DPA18
  2. Collecting at any stage must be justified by a link between purpose and processing.
  3. You must identify a lawful basis for processing AND meet a condition of processing
  4. Applicants have data subject rights that must be upheld
  5. Explaining how you’ll uphold applicants’ rights is key to meeting the condition of processing

The full implications of the GDPR are still being embedded, but it is clear that data controllers must comply with data protection law. This guidance makes it clear what employers should be doing, and it is likely that individuals will look to challenge those organisations that operate policies and practices that do not comply.

This guidance is part of the practical guidance we provide via Recruit! – a website providing advice and support for employers on recruiting people with convictions and dealing with criminal records fairly. Employers looking for further advice about this guidance can contact recruit@unlock.org.uk.

We will shortly be publishing separate guidance for applicants on their data subject rights and how to challenge unfair or unlawful practice where they encounter it.

 

Notes

  1. Unlock is an independent, award-winning national charity that provides a voice and support for people with convictions who are facing stigma and obstacles because of their criminal record, often long after they have served their sentence.
  2. There are over 11 million people in the UK that have a criminal record.
  3. Unlock’s website is unlock.devchd.com.
  4. The guidance is available to download at recruit.unlock.org.uk/dataprotection
  5. The guidance is for employers and voluntary organisations in England & Wales who collect, or plan to collect, criminal records data for recruitment purposes.
  6. For more information on becoming a Ban the Box employer, please see bitc.org.uk/banthebox
  7. Unlock are grateful for the advice and support received from the Information Commissioner’s Office in producing this guidance. Links to their guidance are embedded in the document and more information is available on their website. There is also a useful briefing produced by Nacro on data protection and the use of criminal offence data.

Criminal record requests on application forms could be breaching GDPR

People Management has published an article that looks at a briefing recently published by Nacro that looks at data protection and the use of criminal offence data for employment and education purposes. We very much welcome the briefing by Nacro, which raises some important issues for employers. 

Speaking to People Management, Christopher Stacey, Co-director of Unlock, said:

“GDPR and the new Data Protection Act 2018 means employers that choose to ask applicants about criminal records will need to provide clear reasons and explain their legal basis for doing so. It is likely that asking about criminal records at application stage would be very difficult to justify in light of the recent enhancements in data protection. As one of the founding members of the Ban the Box campaign in the UK, Unlock encourages employers of all sizes and in every sector to sign up and remove criminal record questions from application forms.

 

“However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we encourage employers to use this opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions. Proactive recruiters report that employees with convictions are more productive and more loyal than average. We have developed 10 principles of fair recruitment, in collaboration with business and government, and we will be publishing practical guidance for employers on data protection, GDPR and criminal records in the coming weeks.” 

We want to make sure that our website is as helpful as possible.

Letting us know if you easily found what you were looking for or not enables us to continue to improve our service for you and others.

Was it easy to find what you were looking for?

Thank you for your feedback.

12.5 million people have criminal records in the UK. We need your help to help them.

Help support us now