UK: Can an Employer Check an Applicant's Criminal Record?

​In December 2022, the U.K. Disclosure and Barring Service (DBS) marked its 10-year anniversary of helping make recruitment safer. The DBS processes and issues checks of job applicants' criminal records, along with maintaining records of people who aren't permitted to work with certain vulnerable groups. Since December 2012, the DBS has processed more than 52 million basic, standard and enhanced checks.

Here's a refresher on how to check an applicant's criminal record when you're running a recruitment process.

Yes, you can ask an applicant to get a basic DBS check providing limited information about any unspent convictions for any role, or apply for it yourself with the consent of the applicant.

You can apply for a more thorough criminal record check (a standard or enhanced DBS check) only for specific types of role. You may be required to carry out a standard or enhanced DBS check either if you are recruiting someone to a regulated profession (for example, law) or because of the nature of the job in question (for example, if it involves working with children or vulnerable adults). You can use the DBS website to find out what type of check is right for the individual.

How Do I Check Whether a Job Applicant Has a Criminal Record?

If you need to carry out a criminal record check and are allowed to do so, you can request a basic check from the DBS online. It costs £18—approximately $22—and shows any convictions that aren't "spent" (for example, some types of cautions will disappear after three months). It usually takes up to 14 days to receive the certificate.

To apply for a basic DBS check, the individual will need to provide their:

• Addresses for the last five years and the dates they lived there.
• National Insurance number.
• Passport.
• Driving license.

If you need a standard or enhanced check, follow the steps set out on the DBS website.

Note that it's a criminal offense to try to circumvent the DBS by requiring a job applicant to make a subject access request for their own criminal records. Your business could face hefty fines if you try to do this.

What Data Protection Obligations Do I Have?

You have specific data protection obligations when requesting and handling criminal records data about an individual.

If you are going to collect information about criminal convictions, you should consider carrying out a data protection impact assessment (DPIA) before you start (see Data protection impact assessments for how to carry one out). A DPIA is mandatory if you will be collecting information about criminal convictions on a large scale.

You should have a written policy document detailing how you ensure your compliance with data protection law, and explaining your approach to retaining and erasing the data about individuals' criminal records, including how long you will keep it; see Staff recruitment privacy notice.

Keep a written record about your use and storage of any data about criminal convictions (note that some of this information may already be found in your privacy policy), including:

• The name and contact details of your business.
• What the criminal records data consists of, who it is about, why you need it and whether you got it with the consent of the applicant or because you are legally required to by the nature of the role.
• How long you will keep the data.
• A brief description of the measures you take to ensure data security.
• If you will share the data with anyone, and if so, who and where they are based if they are outside the U.K., together with details of the safeguards you have to ensure that the data is kept securely by them.
• Whether you are using and storing it in line with your written privacy policy, and if not, why not.

You must be prepared to provide a copy of these records about your use of the criminal records information to the U.K. Information Commissioner's Office on request.

You should record the results of the DBS check (that is, whether it is satisfactory or unsatisfactory, rather than the detail of any convictions), but delete all other information about criminal convictions collected in the course of the recruitment process once it has been verified through the DBS check. You must keep more detailed information only in very exceptional circumstances where it is clearly relevant to your ongoing employment of the individual in question.

© 2023 Sparqa Legal. All rights reserved. Reposted with permission of Lexology.