Criminal Records Information – Asking Smarter Questions

Introduction

Many employers routinely conduct criminal records checks on prospective and existing employees, either through official checks conducted by the Disclosure and Barring Service (“DBS”) or Disclosure Scotland, or by asking employees to disclose criminal convictions directly. However, new legislation, together with the requirements of the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”) may force employers to rethink standard practices of enquiring about criminal records information.

In Scotland, on 30 November 2020, new legislation came into force to amend the Rehabilitation of Offenders Act 1974 (“ROA 1974”) and change the rules on the disclosure of certain criminal convictions. Broadly, the changes reduce the length of time for which many convictions need to be disclosed.

On 28 November 2020, new legislation came into force in England and Wales, amending the criminal records disclosure regime. Under the new regime, there will no longer be a requirement for youth cautions, reprimands and warnings to be automatically disclosed on standard and enhanced DBS certificates. In addition, the "multiple conviction" rule, which requires the automatic disclosure of all convictions where an individual has more than one conviction (regardless of the nature of the offence or sentence), will be removed. The DBS also recently published new guidance on the new filtering rules for criminal records certificates in advance of the new legislation coming into effect. As a result of these changes, employers may need to review their application forms to ensure that, if requesting disclosure of spent convictions (in respect of posts that are exempt from the ROA 1974), this is limited to all spent convictions and adult cautions that are not protected (i.e. not filtered out), in order to ensure compliance with the new legislation.

Earlier, in September 2020, the Ministry of Justice also published a paper, “A Smarter Approach to Sentencing”, which included proposals for new legislation to reduce the time periods for disclosure of certain spent convictions.

These reforms are intended to support those with historic criminal convictions in obtaining new employment and redress the balance between protecting the public and the rehabilitation of ex-offenders.

The changes are likely to be welcomed by social justice charities such as Unlock and Nacro, that continue to campaign against employers’ widespread practices of requiring criminal records information. According to Unlock, there are more than 11 million people in the UK who have a criminal record. They argue that requiring disclosure of criminal records on a widespread basis unfairly disadvantages those who have long served their sentence by preventing them from having fair access to employment and it reinforces the stigma around having a criminal record.

We consider some of the questions which may arise below and offer some practical advice on how to navigate this complex area.

Criminal records Q &A

1. What is the legal position around criminal records checks?

In some cases, obtaining criminal records information will be important and necessary for the role being performed or applied for; for example, in sectors where a candidate’s honesty and integrity are key to their suitability for a role, or where it is a legal or regulatory requirement. However, adopting a blanket approach of requiring criminal records checks is unlikely to be lawful.

In general, the ROA 1974 prohibits employers from requesting disclosure of an individual’s “spent” convictions. Subject to certain exceptions, a conviction will be “spent” when the individual does not re-offend during a specified period of time (the length of which will vary according to the sentence imposed).

Employers can only request details of an applicant’s or employee’s spent convictions where the employee is carrying out one of the excepted occupations, offices and professions as identified by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975/1023 (“Exceptions Order”), and provided they are requesting these details for the purpose of assessing the applicant’s suitability for the occupation, office or profession. Excepted occupations under the Exceptions Order include certain professions (doctors, dentists, solicitors), officers of the court and those who work with children or vulnerable adults.

The GDPR and the DPA 2018 have meant that stricter limits have been imposed on employers’ ability to process criminal records data together with higher sanctions. Employers need to be able to justify why obtaining criminal records data is necessary to its recruitment decision and/or the ongoing employment relationship.

In addition to data protection legislation, other legal rights and obligations may be called into play, including human rights legislation (in particular, Article 8 and the right to privacy), and the implied duty of trust and confidence between employer and employee.

2. How do criminal records checks work in the UK?

The criminal records checking regime, which in England and Wales is administered by the DBS, enables employers and other organisations to access criminal records information in the form of certificates. In Scotland, Disclosure Scotland administers the criminal records checking scheme.

The following types of certificates are available from the DBS or Disclosure Scotland:

• A basic certificate – this can only be applied for by the individual and includes details of their unspent convictions and conditional cautions.
• A standard certificate – this contains details of convictions and cautions (spent and unspent) and police reprimands and warnings.
• An enhanced certificate – this contains the same details as a standard certificate in addition to any information that the police reasonably believe to be relevant. It is also possible to obtain information where relevant to the post applied for, about whether the person is barred from undertaking a particular role.

Employers can only obtain standard or enhanced checks (including details of spent and unspent convictions) where the employee is carrying out one of the excepted occupations under the Exceptions Order.

3. What’s the impact of data protection legislation in this area?

Under the GDPR there is far greater emphasis on accountability, meaning that as a data controller, an employer must be able to demonstrate compliance with the various data protection principles.

There are essentially two stages to demonstrating compliance in relation to processing criminal records data. An employer will need to have identified and recorded:

• a lawful basis for processing for criminal records data; and
• which of the conditions permitting processing of such data is satisfied (these are set out in the DPA 2018).

In light of the concerns around relying on consent in an employment context (due to the imbalance in bargaining power between employer and employee), it is unlikely that consent will be a valid reason for processing criminal records data. In practice, the lawful bases most relevant to processing criminal records data in an employment context are that the processing is necessary:

• for the performance of a contract to which an employer or individual is party;
• to comply with a legal obligation; or
• for the purposes of an employer’s legitimate interests where these are not outweighed by the rights and freedoms of the individual.

Having identified a lawful basis for processing, an employer will then need to demonstrate that a relevant condition on processing criminal records data is satisfied. These are set out in the DPA 2018 and the conditions most relevant to processing criminal records data in an employment context are where the processing is necessary:

• for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on an employer or the individual;
• for reasons of substantial public interest (for example, where processing is necessary for complying with, or assisting others to comply with, a “regulatory requirement” which involves a person taking steps to establish whether another person has committed an unlawful act or been involved in dishonesty, malpractice or other seriously improper conduct).

As well as identifying the above, an employer must also have in place the additional safeguards required by the DPA 2018 in relation to special category and criminal records data. Broadly this means that an employer must have an “appropriate policy” (that is kept up to date and made available to the Information Commissioner (“ICO”) on request) explaining:

• how it complies with the data protection principles; and
• its policies around retention and erasure of this much more sensitive type of data including giving an indication of how long it is likely to be retained.

Appropriate records of the processing must also be kept including details of whether or not an employer complies with its policies and if not, the reasons for this.

In the absence of a specific legal or regulatory requirement to process criminal records data, employers may find it much more difficult to demonstrate compliance with the GDPR and DPA 2018 and justify why they need to process this information. The stakes for non-compliance are also higher under current data protection legislation, as the ICO has the power to award significant penalties in respect of a breach.

4. How should employers demonstrate compliance with the GDPR and the DPA 2018 if they are processing criminal records data?

Where employers consider that gathering criminal records data is necessary, they should document the rationale for this as well as the relevant legal basis for processing criminal records data and which of the conditions permitting processing of such data is satisfied (these are set out in the DPA 2018).

If criminal records data is gathered as part of a recruitment exercise this should be done as late as possible in the recruitment exercise and only in relation to the successful candidate – collecting at application stage is likely to be unnecessary and excessive.

A privacy notice or other information provided to individuals about what happens to their data should be explicit around what criminal records data is gathered, what happens to it and the individual’s rights in relation to the processing of it.

It may also be necessary to conduct a data protection impact assessment (“DPIA”) in relation to the processing of criminal offence data. A DPIA is required for any type of processing which is likely to be high risk. The ICO recommends that you carry out a DPIA if in doubt, and in particular, if you plan to process criminal offence data on a large scale, or in order to determine access to a product, service, opportunity or benefit.

Finally, any record retained in relation to criminal records data should express a view only whether the information obtained produced a satisfactory or unsatisfactory result. Maintaining a record of specific offences for individuals within a workforce will likely fall foul of the GDPR, which provides that any comprehensive register of criminal convictions shall be kept only under control of official authority.

The ICO has recently published further guidance in relation to the rules on criminal offence data which can be accessed here.

5. Can I ask applicants or employees to voluntarily disclose their criminal records information?

Some employers rely on asking job applicants and employees to voluntarily disclose their criminal records information rather than carrying out official criminal records checks. However, voluntary disclosure should not be relied on where there is a legal or regulatory requirement that individuals with certain convictions should not undertake certain types of work. There is a greater risk that the individual may try to conceal their criminal history, particularly if they fear that disclosing a previous conviction could result in them not being offered the job.

Where the occupation is one of those listed under the Exceptions Order then the employer can ask about spent convictions (in addition to those that are unspent) provided the questions are asked for the purpose of assessing the applicant’s suitability for the occupation, office or profession. In light of the recent changes in legislation in England and Wales, employers should also ensure that, if requesting details of spent convictions, this is limited to spent convictions and adult cautions that are not protected (i.e. not filtered out), as defined by the Exceptions Order.

6. Can I take any action if someone discloses a criminal record or I become aware of their criminal record?

The first step will be to consider whether (i) the conviction is spent or unspent, and (ii) whether the individual is performing a role which is protected by the ROA 1974, or an excepted occupation under the Exceptions Order.

Where convictions can be taken into account it will be important to consider whether disclosure impacts the individual’s suitability for the role (having regard where relevant to any specific legal or regulatory requirements) and/or whether any action is necessary. Unreasonably taking any action and/or dismissing an employee could result in claims for unfair dismissal.

Rather than adopting a blanket approach of dismissing an employee if you discover that they have a criminal record, Nacro recommends that, if a shortlisted applicant who meets the requirements of the role discloses a criminal record that is not related directly to the post, you should conduct a risk assessment. This includes meeting with the applicant to discuss the relevance of their criminal record. On the basis of the information provided, Nacro advises that you should take into account the following:

• Nature of the offence(s).
• Whether the conviction (or other matter revealed) is relevant to the position in question.
• The seriousness of the offence or allegation disclosed.
• The circumstances surrounding the offence and the explanation offered by the individual involved.
• The length of time since the offence was committed.
• Whether there is a pattern of offending or other relevant matters.
• Whether the applicant's circumstances have changed since the offending behaviour.

Further information can be found on Nacro’s website here.

Conclusion

The legalities in this area can be complex and there are a number of different issues and questions to consider before undertaking criminal records checks. It is a developing area of the law with recent new legislation. Accordingly, where employers consider that it is necessary to undertake such checks they should ensure that their approach is fully compliant from a legal perspective, which may involve rethinking standard practices in this area.

Article co-authored by Oliver Bristow.