Since 10 March 2015 it has been unlawful for an employer to require job applicants or employees to make a data subject access request to obtain a copy of their criminal records and provide that information to their employer.  

Under section 7 of the Data Protection Act 1998 employees and other individuals have the right to make a data subject access request to find out what personal data an organisation holds about them.  A subject access request simply has to be made in writing and be accompanied by a fee of £10 (if the organisation requires it).   

The appropriate way of accessing an individual’s criminal records is set out under statute.  An employer can only ask the Disclosure and Barring Service (“DBS”) in England to undertake a criminal records check for employees who are to undertake certain specified roles, duties and activities, for example, teachers, nurses and midwives, and it is a criminal offence for an employer to ask for a check where the statutory regime does not apply.  The legislation sets boundaries regarding what employers can ask for since there are different levels of checks depending on the type of role that the employee undertakes.  

Before this new legislation came into force, an employer could circumvent the statutory regime by requiring an applicant or employee to obtain a copy of their criminal records by means of a data subject access request, as a condition of employment or continued employment.  This could result in greater disclosure than under the statutory regime since the response to a data subject access request would not distinguish between spent and unspent convictions, whereas, for example, a basic DBS check would not contain details of spent convictions.      

Section 56 of the Data Protection Act 1998 now makes it a criminal offence to require an individual to exercise their right to gain access to information about their convictions and cautions and provide that information to another person.  In England the penalty for this offence is an unlimited fine.  If, for instance, a job applicant applies for a position as a waitress but is told that she cannot be offered the position until she provides a copy of her full criminal record by making a subject access request, then this will amount to a criminal offence.   

Employers therefore need to ensure that, where appropriate, they follow the statutory regime in obtaining the correct level of official criminal record check from the DBS.  It is important to carry out such checks where a job applicant will be carrying out one of the types of roles, activities and duties set out in the legislation as there is no guarantee that asking for voluntary disclosure will result in the applicant giving an honest answer. 

Employers should note that there is no prohibition on them asking job applicants or employees for voluntary disclosure about their criminal records (as opposed to requiring them to make subject access requests to gain this information) but applicants and employees are not obliged to disclose spent convictions if their role is not one of the types set out in the statutory regime.