Background Check Privacy

Background Check Privacy

Overview

Pre-employment background checks involve processing personal data that ranges from routine reference verification to highly sensitive criminal record data. Art. 10 GDPR provides specific restrictions on processing data relating to criminal convictions and offences, requiring that such processing be authorised by EU or Member State law providing appropriate safeguards. Beyond criminal data, background checks may involve credit history, educational qualifications, professional registration, social media presence, and right-to-work verification — each carrying distinct proportionality and data minimisation requirements. The principle that governs all background checking is role-based necessity: the scope of a background check must be proportionate to the specific role and its associated risks, not applied uniformly across all positions.

Legal Framework

Art. 10 — Criminal Conviction Data

"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects."

Key requirements:

• Criminal data processing requires specific national law authorisation (not merely a legitimate interest)
• The national law must provide appropriate safeguards
• A comprehensive register of criminal convictions may be kept only under the control of official authority

Art. 6(1) — Lawful Basis for Background Checks Generally

National Criminal Record Check Frameworks

United Kingdom — DBS (Disclosure and Barring Service)

Three levels of disclosure:

Key GDPR compliance requirements:

• The Rehabilitation of Offenders Act 1974 prohibits considering spent convictions for most employment purposes
• DBS certificates belong to the applicant, not the employer
• Employers should not retain a copy of the DBS certificate; they should record only the DBS certificate number, date of issue, and the result (clear/not clear)
• DBS Update Service allows ongoing status checks without requesting new certificates

Germany — Führungszeugnis (Certificate of Good Conduct)

• Belegart N (standard): Shows convictions with sentences exceeding 90 daily rates or 3 months imprisonment (with exceptions)
• Belegart O (extended): Includes all convictions for roles involving minors
• Employers may request a Führungszeugnis only where the role justifies it; routine requests for all positions are disproportionate
• Employers may view the certificate but should not retain a copy; they should record only the confirmation that the check was satisfactory

France — Extrait de Casier Judiciaire

• Bulletin No. 3 (most common for employment): Shows only the most serious convictions (imprisonment over 2 years without suspension)
• Employer may request Bulletin No. 3 only for specific roles justified by the nature of the activity
• For public sector roles, the administration may access Bulletin No. 2 directly

Netherlands — Verklaring Omtrent het Gedrag (VOG)

• The VOG (Certificate of Conduct) is issued by the Ministry of Justice
• The VOG states only whether the individual's judicial record contains relevant information for the specific role — it does not disclose the convictions themselves
• The employer specifies the screening profile (e.g., "persons" for working with vulnerable people, "finances" for financial roles)

Spent Convictions — Rehabilitation Principle

Most European jurisdictions implement the rehabilitation principle: after a specified period, convictions become "spent" and may no longer be considered for employment purposes. Processing spent convictions where they are protected by rehabilitation legislation violates both national law and the GDPR data minimisation principle.

Proportionality Framework

Role-Based Necessity Assessment

Not all roles justify the same level of background checking. The proportionality principle requires that the scope of checks be tailored to the specific risks of the role.

Atlas Manufacturing Group Example: Atlas conducted a proportionality review of its background check programme and found that it was requesting basic DBS checks for all positions including warehouse operatives and canteen staff. Following DPO advice, Atlas implemented a tiered checking framework:

• All roles: right-to-work verification, two professional references
• Roles with financial access (finance, procurement, senior management): credit check + basic DBS
• Roles with access to R&D laboratory: basic DBS (given intellectual property value)
• Roles working with site visitors under 18 (apprenticeship supervisors): enhanced DBS with barred list

Social Media Screening

Social media screening of candidates is one of the most privacy-invasive background check activities. It may reveal:

• Political opinions (Art. 9(1))
• Religious or philosophical beliefs (Art. 9(1))
• Trade union membership (Art. 9(1))
• Health information (Art. 9(1))
• Sexual orientation (Art. 9(1))
• Racial or ethnic origin (Art. 9(1))

When social media screening may be justified:

• Public-facing roles where the candidate's public statements may directly affect the organisation's reputation
• Senior leadership roles with significant public profile
• Roles requiring security clearance where national law authorises screening

Requirements if conducted:

• Limited to publicly available information (no friend requests, no fake profiles)
• Limited to information relevant to the role
• Conducted at the latest possible stage (after shortlisting, before final offer)
• Documented with a clear record of what was reviewed and what was found
• Candidate must be informed that social media screening is part of the process
• Special category data encountered incidentally must not be recorded or used in the employment decision

Data Minimisation and Retention

Data Minimisation in Collection

• Collect only the specific check results relevant to the role, not blanket screening
• Do not retain copies of identity documents beyond the verification point (photograph the document, verify, delete the image — retain only a record that verification was completed)
• Do not retain copies of criminal record certificates — record only the certificate reference number, date, and result
• Do not collect more references than needed (two professional references is standard; personal character references are generally disproportionate)

Retention Limits

Unsuccessful Candidates

Background check data for candidates who are not hired must be:

• Deleted within 6 months of the hiring decision (12 months where a discrimination claim risk is identified)
• Not retained in a general candidate database for future recruitment
• Deleted earlier if the candidate withdraws consent or requests erasure

Candidate Rights

Right to Be Informed — Art. 13

Before conducting any background check, the candidate must be informed of:

• The specific checks that will be conducted
• The lawful basis for each check
• Who will conduct the checks (third-party screening provider, if applicable)
• What data will be obtained
• How the data will be used in the employment decision
• Retention periods
• Their rights under Arts. 15-22

Right to Challenge

• Candidates must be given the opportunity to discuss and challenge adverse check results before a final employment decision is made
• If a criminal record check reveals a conviction, the candidate must be allowed to provide context (rehabilitation evidence, mitigating circumstances)
• An automatic disqualification policy (rejecting any candidate with any criminal record) is unlawful — each case must be assessed individually, considering the nature of the offence, its relevance to the role, and the time elapsed

Third-Party Screening Providers

Where background checks are conducted by a third-party provider:

• A Data Processing Agreement under Art. 28 GDPR must be in place
• The provider is a processor acting on the employer's (controller's) instructions
• The employer must specify what checks may be conducted; the provider must not conduct checks beyond the scope authorised
• The provider must delete check data after transmitting results to the employer, per the agreed retention schedule
• International transfers (common with global screening providers) must comply with Chapter V GDPR

Enforcement Precedents

Integration Points

• Employment Consent Limits: Consent is not the appropriate lawful basis for most background checks (see employment-consent-limits skill).
• Employee DSAR Response: Candidates and employees may request access to background check data (see employee-dsar-response skill).
• HR System Privacy Config: Background check data storage and access must be configured with appropriate restrictions (see hr-system-privacy-config skill).
• Employee Health Data: Pre-employment health screening is governed by separate rules (see employee-health-data skill).