Employers should be aware of new changes to the law which will have an impact on how you approach asking employees about their criminal records. Employers will also have to be mindful of the General Data Protection Regulations (GDPR) and the Data Protection Act (DPA) 2018 in relation to processing criminal records information.
Criminal Law
In terms of reform to the criminal law the Rehabilitation of Offenders Act 1974 (RoOA) has been amended. From the 30 November 2020, in Scotland the disclosure rules have lessened the period certain criminal convictions have to be disclosed. In England and Wales from the 28 November 2020 the disclosure rules have also been amended. There will no longer be a requirement for mandatory disclosure on the standard and enhanced DBS certificates for youth cautions, warnings, and reprimands. The disclosure of multiple convictions for the same offence will also be removed.
To ensure compliance with the new changes employers are advised to review their recruitment application forms and procedures. Employers should ensure that requests for disclosure of spent convictions for positions exempt from RoOA 1974, are now only directed to all adult cautions, and spent convictions which remain unprotected.
The employer’s ability be able to carry out checks on an employee’s criminal record will remain lawful. The employer must always ensure the potential employee is of good character and fit for the role as well as meeting any legislative demand. The RoOA 1974 does not allow the employer to request or demand information about spent convictions. Such convictions are spent if a person does not reoffend in a stipulated period. The period differs depending on the sentence. Specific periods can be found in the legislation. The RoOA 1974 exceptions order does allow the employer to request disclosure of an applicants or employees spent convictions if the work is an excepted profession, office, or occupation. This can include those who are employed to work with vulnerable adults and children and professions such as solicitor and doctors and dentists.
GDPR
The GDPR will apply to the storing of employee records including any information about criminal convictions. Employers are under a statutory duty to comply with the legislation. Regarding criminal records the employer must demonstrate a lawful basis for processing the data. The legislation states that this can be for the performance of the contract, compliance with the legal responsibility, for legitimate interests of the employer which do not overshadowed the rights and freedoms of the employee.
The employer in addition needs to demonstrate legitimate interest to process the criminal data. This can be for legal obligations and rights imposed by the law on the employer and the employee and for reasons of public interest to ensure compliance with regulatory requirements.
The employer must show compliance with the DPA 2018 and ensure they have the necessary safeguards in the form of a data policy as criminal data is classified as a special category information. This policy will need to be reviewed annually. The Information Commission Office (ICO) can ask to inspect this document. The policy will be required to demonstrate how the company complies with the principals of data protection, how records are processed, retained, and erased and how long information will be retained by the employer. Employers must also keep a record of the information they process. Failure to comply with the law can result in investigation by the ICO and them facing a significant fine for any breaches of the statutory law.
This article serves only as a guide to the law and readers requiring more detailed advice should speak to the Quest advice line on 01455 852028.
