Alex contacted us for advice, and we contacted TfL. They were unable to explain why the information had been collected or why it needed to be shared. They did not have a lawful basis for collecting the information. They agreed that they should not have collected criminal records information and that this had been collected in error. However, they refused to let applicants who had disclosed criminal records information know of the error or to reassure them that the information would not be shared. We contacted the ICO for advice.
The ICO confirmed that collection of criminal records is unlikely to be necessary for registering to attend an apprenticeship fair. They wrote to TfL to remind them of their obligations regarding the processing of criminal offence data under the UK GDPR and DPA 2018 and ask them to review their procedures.
Only ask applicants for information that is necessary
Data minimisation requires organisations to ensure that the personal data they are processing is adequate, relevant and limited to what is necessary. Organisations should periodically review the personal data held and delete anything they no longer need they. If an organisation has collected more personal data than they need for the specified purpose, this should be identified and the data deleted. Individuals are also able to exercise their right to erasure. This is not an absolute right, but organisations have to consider each request they receive and be able to justify their decision.
TfL may continue to collect information from job applicants but are required to comply with the principles of data minimisation and storage limitation. All organisations must make sure they collect and retain only the minimum amount of criminal offence data. The appropriate policy document should include information on how the organisation’s meet their obligations under the data minimisation and storage limitation principles.
For more on complying with the GDPR/DPA18 see our guidance for employers
Do you really need to ask about criminal records? See our practical guidance for employers