Organisations have a responsibility to handle all forms of data correctly and in line with legislation and guidance. Criminal records data is treated by the Information Commissioner’s Office (see glossary) as sensitive data and a category of data in its own right. If an organisation is collecting criminal records data, therefore, they need to have a clear and legitimate reason for doing so and to have an appropriate policy in place to account for this. Such information should be collected appropriately by an organisation, in line with their stated policy. An organisation can only collect information they have a right to hold, which for practical purposes means that they can only collect information that they would also be able to have via a DBS check. Employers are only able to then store this information for internal, administrative reasons and should not be sharing it with others, specifically if that information is being used to produce so-called employment ‘blocklists’.
Should data of this kind be collected about you, you have the right to know how and why, so the policy should be accessible. If you are concerned about data protection issues in relation to criminal records, you should check the organisation’s data protection policy; if you can’t find one, you could ask for a copy of it. If this does not address your concerns, you can take a number of approaches:
- You can raise concerns directly with an organisation. The Unlock website has a useful template letter for doing so here. It is worth being mindful about how an organisation might misinterpret this.
- You can seek support from Unlock to raise concerns with an organisation directly – get in touch with our helpline here
- You can make a complaint about bad data protection practice with the ICO, via their online tool here. You need to do this within three months of your last ‘meaningful contact’ with the organisation in question. Beyond this, you could seek legal advice about taking the issue to court.
It is worth noting that any complaint or concern raised with the ICO or otherwise regarding data is unlikely to provide a swift resolution to your concerns.
Another issue regarding data protection concerns automated decision making (where, for example, a job application begins with a computer system making an automatic decision based on information given). Under data protection laws, this is legal, but applicants should be notified, and safeguards be put in place, including the option to request human involvement in the decision making process.
Further guidance on data protection issues can be found on the Unlock website here.
