From 1 December 2014, it will be a criminal offence for institutions to require prospective employees (or existing employees applying for new positions) to seek and disclose the results of a data access request from the Police as a means of checking their criminal records. In the past, this practice has been adopted by some employers as a means of accessing criminal data in excess of that to which they would otherwise have access. For example, spent convictions or mere cautions would be revealed through this route. In future, however, enforced subject access requests will attract a potential penalty of up to £5000 on summary conviction in the Magistrate’s Court or unlimited fine on indictment before the Crown Court. Accordingly, going forwards, institutions needing disclosure of any relevant employee convictions will need to do so through the disclosure and barring service process.
These changes are being brought into force by Section 56 of the Data Protection Act 1998. Bringing section 56 into force is the last stage of a “package of reforms” in the context of disclosure of criminal offences, the first of which saw a reduction in rehabilitation periods on 10th March 2014. Although, when drafted, the Data Protection Act 1998 included express provision outlawing prospective employers from seeking the results of data access requests, that provision was not enacted. Both the Information Commissioner and Disclosure and Barring Service had expressed concern that this left employees open to potential data protection abuse, particularly where job offers were conditional upon their compliance. The Information Commissioner’s Office has confirmed it will issue Guidance upon the implications of section 56 now that its calls for implementation have been answered.
In R (on behalf of T & anor) v SOS, the Supreme Court found that the requirement to disclose all convictions and cautions irrespective of their relevance for the purposes of criminal records checks is incompatible with an individual's right to respect for private life under Article 8 of the European Convention on Human Rights. That decision was, however, of limited significance, as two new orders were introduced in 2013, prior to the hearing, which meant that certain old and minor cautions and convictions could no longer be disclosed and that the content of a criminal records certificate and enhanced criminal records certificate was narrowed.