Unlock, the national charity for people with convictions, has today published guidance to support employers to ensure that their policies and practices on collecting criminal records data during recruitment is compliant with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The guidance makes it clear that collecting criminal records at the initial application stage is unlikely to be necessary and therefore in breach of data protection law.

Christopher Stacey, co-director of Unlock, said:

“Too often, employers overlook skills, experience and qualifications if an applicant declares they have a criminal record. Yet over 11 million people in the UK have a criminal record. The GDPR and the Data Protection Act 2018 make it clear that asking about criminal records must be necessary – if it isn’t necessary, it isn’t compliant.

“This guidance makes it clear that the current common practice of many large employers of asking about criminal records at the initial application stage needs to change to ensure compliance with data protection law. That’s why we’re strongly encouraging employers to no longer ask about criminal records at application stage. However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we recommend employers to use this as an opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions.

“Proactive recruiters report that employees with convictions are more productive and more loyal than average. We hope that this guidance helps employers to review their approach towards criminal records and ensure that if information is collected, it is used fairly and only where necessary.”

Jessica Rose, Ban the Box campaign manager at Business in the Community, said:

“Unlock’s straightforward and practical guide for employers collecting criminal records data makes it clear that Ban the Box is the right approach for recruitment under GDPR. We urge employers to read the guide and to move any necessary questions about criminal convictions to later in the recruitment process. Once you’ve made the change we’d be delighted to have you join the growing movement of employers demonstrating their fair approach to the recruitment of people with criminal records through signing up to Ban the Box.”

The Information Commissioner’s Office, who Unlock worked closely with to produce the guidance, said:

“This is useful guidance that will help employers to review their policies and practices when requesting information about criminal records in recruitment. It is crucial that employers understand their obligations to data protection law and this guidance will help them to do this.”

The guidance sets out a three-stage process for employers to follow in determining if, when and how they should ask about criminal records. Key points of the guidance are that:

  1. Collecting criminal records at application stage is unlikely to be necessary and therefore in breach of the GDPR and the DPA18
  2. Collecting at any stage must be justified by a link between purpose and processing.
  3. You must identify a lawful basis for processing AND meet a condition of processing
  4. Applicants have data subject rights that must be upheld
  5. Explaining how you’ll uphold applicants’ rights is key to meeting the condition of processing

The full implications of the GDPR are still being embedded, but it is clear that data controllers must comply with data protection law. This guidance makes it clear what employers should be doing, and it is likely that individuals will look to challenge those organisations that operate policies and practices that do not comply.

This guidance is part of the practical guidance Unlock provide via Recruit! – a website providing advice and support for employers on recruiting people with convictions and dealing with criminal records fairly. Employers looking for further advice about this guidance can contact recruit@unlock.org.uk.

Unlock will shortly be publishing separate guidance for applicants on their data subject rights and how to challenge unfair or unlawful practice where they encounter it.