Under Section 184 of the Data Protection Act 2018 (DPA) it is illegal to require a person to provide a “relevant record” in relation to recruitment for a job, continuing employment, or when providing services to the public.

Relevant records under Schedule 18 of the DPA are the following:

• Health Records: If an individual requests their medical history from a hospital, this would be considered a relevant health record.
• Criminal Records: If someone requests their criminal record from the police, this would be a relevant record relating to a conviction or caution. This includes records obtained by a data subject that contain information about a conviction, caution, or an arrest.
• Statutory Functions: These are records obtained by a data subject that contain information related to statutory functions. The records can be obtained from entities like the Secretary of State, the Department for Communities in Northern Ireland, the Department of Justice in Northern Ireland, the Scottish Ministers, and the Disclosure and Barring Service (DBS).

The law only allows these records to be provided to another person or organisation if the records are required by law or are justified in the public interest.

If someone is required to provide criminal records to obtain a job or keep a job, where there is no legal requirement to do so, it is a criminal offence that can be punished by a fine.

Employers can lawfully request a DBS check as part of their recruitment process to ensure that individuals are suitable for certain roles, especially those involving work with vulnerable groups or sensitive information. These are the different levels of DBS checks and when they can be requested:

What it shows: Unspent convictions and conditional cautions.

When it can be requested: For any role, as there are no specific eligibility criteria.

Example: A retail company hiring a cashier may request a basic DBS check to ensure the applicant has no recent criminal convictions that could affect their suitability for the role.

What it shows: Unprotected convictions and cautions.

Cautions and convictions will become “protected” after certain periods of time, unless they are for “specified” offences. Please see our DBS Calculator for more details.

When it can be requested: For roles specified in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, such as positions in security, legal professions, and certain financial services.

Example: The SRA or BSB will ask for a standard DBS check when admitting a solicitor or barrister to the profession.

What it shows: The same as a standard check, plus any additional information held by local police that is considered relevant to the role.

When it can be requested: Generally for roles involving work with children or vulnerable adults, such as teaching, healthcare, and social work, and other highly regulated roles.

Example: A school hiring a teacher will request an enhanced DBS check to ensure the applicant has no criminal history that would make them unsuitable to work with children.

Employers may also get to know about a criminal record via immigration procedures. If you are being employed outside of the UK, in the US for example, your employer may want to process your immigration application.

When this is done, they will often require you to provide an ACRO Police Certificate. Your Certificate will directly or indirectly reveal a past criminal record – for details about “no live trace” disclosures, then please visit here.

There is a grey area in UK rehabilitation laws when an employer asks to undertake a visa application for their employee. It is debatable whether an employer learning about an employee’s criminal record, where they would otherwise not be able to, by facilitating a visa application, amounts to enforced subject access.

In these circumstances a business will not have specifically requested access to the criminal record for their own purposes, but if a role is contingent on an overseas visa being granted, then the employer will inevitably become aware of the record if they process the employee’s visa application. To avoid this issue arising, a prospective employee could request to process their own visa application, but this is likely to draw suspicion from the employer, and also cause delay.

We have recently become aware that there are third-party background checking companies that, as part of their pre-employment screening checks, insist on employees and new recruits obtaining a copy of their ACRO Subject Access Request.

We are aware that this practice is being undertaken by overseas multinational companies, who will recruit a third-party organisation to undertake their new recruits’ background checks. So far, we have only heard of this being done by companies based in the US, but companies based in other jurisdictions may also be employing similar techniques.

US based companies may feel emboldened to undertake these checks, given the physical distance between the US and UK, but asking for an ACRO Subject Access check in these circumstances is clearly enforced subject access, and is a criminal offence.

If you believe you are the victim of enforced subject access, in the context of being recruited for an overseas role, or when being recruited by an employer based overseas, then please get in touch.

We have extensive success in deleting records from the PNC including police cautions, youth cautions/warnings and reprimands, arrest records, and overseas convictions. We can also assist with complaints to the ICO and/or police, with respect to data breaches, and enforced subject access.