Background Check Privacy

Background Check Privacy

Overview

Pre-employment background checks involve processing personal data that ranges from routine reference verification to highly sensitive criminal record data. Art. 10 GDPR provides specific restrictions on processing data relating to criminal convictions and offences, requiring that such processing be authorised by EU or Member State law providing appropriate safeguards. Beyond criminal data, background checks may involve credit history, educational qualifications, professional registration, social media presence, and right-to-work verification — each carrying distinct proportionality and data minimisation requirements. The principle that governs all background checking is role-based necessity: the scope of a background check must be proportionate to the specific role and its associated risks, not applied uniformly across all positions.

Legal Framework

Art. 10 — Criminal Conviction Data

"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects."

Key requirements:

• Criminal data processing requires specific national law authorisation (not merely a legitimate interest)
• The national law must provide appropriate safeguards
• A comprehensive register of criminal convictions may be kept only under the control of official authority

Art. 6(1) — Lawful Basis for Background Checks Generally

National Criminal Record Check Frameworks

United Kingdom — DBS (Disclosure and Barring Service)

Three levels of disclosure:

Key GDPR compliance requirements:

• The Rehabilitation of Offenders Act 1974 prohibits considering spent convictions for most employment purposes
• DBS certificates belong to the applicant, not the employer
• Employers should not retain a copy of the DBS certificate; they should record only the DBS certificate number, date of issue, and the result (clear/not clear)
• DBS Update Service allows ongoing status checks without requesting new certificates

Germany — Führungszeugnis (Certificate of Good Conduct)

• Belegart N (standard): Shows convictions with sentences exceeding 90 daily rates or 3 months imprisonment (with exceptions)
• Belegart O (extended): Includes all convictions for roles involving minors
• Employers may request a Führungszeugnis only where the role justifies it; routine requests for all positions are disproportionate
• Employers may view the certificate but should not retain a copy; they should record only the confirmation that the check was satisfactory

France — Extrait de Casier Judiciaire

• Bulletin No. 3 (most common for employment): Shows only the most serious convictions (imprisonment over 2 years without suspension)
• Employer may request Bulletin No. 3 only for specific roles justified by the nature of the activity
• For public sector roles, the administration may access Bulletin No. 2 directly

Netherlands — Verklaring Omtrent het Gedrag (VOG)

• The VOG (Certificate of Conduct) is issued by the Ministry of Justice
• The VOG states only whether the individual's judicial record contains relevant information for the specific role — it does not disclose the convictions themselves
• The employer specifies the screening profile (e.g., "persons" for working with vulnerable people, "finances" for financial roles)

Spent Convictions — Rehabilitation Principle

Most European jurisdictions implement the rehabilitation principle: after a specified period, convictions become "spent" and may no longer be considered for employment purposes. Processing spent convictions where they are protected by rehabilitation legislation violates both national law and the GDPR data minimisation principle.

Proportionality Framework

Role-Based Necessity Assessment

Not all roles justify the same level of background checking. The proportionality principle requires that the scope of checks be tailored to the specific risks of the role.

Atlas Manufacturing Group Example: Atlas conducted a proportionality review of its background check programme and found that it was requesting basic DBS checks for all positions including warehouse operatives and canteen staff. Following DPO advice, Atlas implemented a tiered checking framework:

• All roles: right-to-work verification, two professional references
• Roles with financial access (finance, procurement, senior management): credit check + basic DBS
• Roles with access to R&D laboratory: basic DBS (given intellectual property value)
• Roles working with site visitors under 18 (apprenticeship supervisors): enhanced DBS with barred list

Social Media Screening

Social media screening of candidates is one of the most privacy-invasive background check activities. It may reveal:

• Political opinions (Art. 9(1))
• Religious or philosophical beliefs (Art. 9(1))
• Trade union membership (Art. 9(1))
• Health information (Art. 9(1))
• Sexual orientation (Art. 9(1))
• Racial or ethnic origin (Art. 9(1))

When social media screening may be justified:

• Public-facing roles where the candidate's public statements may directly affect the organisation's reputation
• Senior leadership roles with significant public profile
• Roles requiring security clearance where national law authorises screening

Requirements if conducted:

• Limited to publicly available information (no friend requests, no fake profiles)
• Limited to information relevant to the role
• Conducted at the latest possible stage (after shortlisting, before final offer)
• Documented with a clear record of what was reviewed and what was found
• Candidate must be informed that social media screening is part of the process
• Special category data encountered incidentally must not be recorded or used in the employment decision