The new law preventing the practice of requiring an employee or potential employee to make a subject access request into their own criminal records and then disclose the results to the employer was originally due to be implemented on 1 December 2014 but was delayed due to a “technical” issue. It is now due to come into force on 10 March 2015.
The criminalisation of this practice has been a long time coming for members of the ICO who have fought for the ban of enforced subject access requests since the introduction of the Data Protection Bill.
Typically, enforced subject access requests were used to force potential employees to reveal criminal convictions, however, the practice has spread far wider than ever expected and now employers are using this vetting method without restraint.
What can’t you do?
The introduction of Section 56 will prevent any person or organisation making an offer of employment, or continued employment conditional upon an employee, worker or contractor making a subject access request for a copy of personal information about them on their criminal convictions and requiring them to share the results with the employer.
The ICO are determined to enforce this new rule when implemented on 10 March and have warned that they will strongly pursue prosecutions if employers are found to be in breach of Section 56.
What can you do?
The criminalisation of enforced subject access requests does not prevent employers from applying to the Disclosure and Barring Service (“DBS”) for background checks against potential or current employees. DBS checks are the most appropriate way for employers to access information to assist in assessing an employee’s suitability. Employers are able to make a request for a basic, standard or enhanced DBS check. Basic checks contain details of unspent criminal convictions, conditional and unconditional cautions. Standard and enhanced DBS checks reveal both spent and unspent convictions and cautions and can only be applied for in respect of certain posts, which are detailed in the Exceptions Order of the Rehabilitation of Offenders Act 1974.
What should employers do?
Employers should take the time to review their recruitment and vetting practices and identify if enforced subject access requests are used. If they are, consider alternatives by asking for voluntary disclosure of criminal convictions and linking inaccurate disclosures to your disciplinary policy. Alternatively, depending on the post, consider using basic and/or standard DBS checks to find out the information you need.