Earlier this year Alex registered with Transport for London’s National Apprenticeship Fair, hoping for the chance to meet with 15 employers offering vacancies across London. She was surprised to be asked about unspent convictions for a recruitment fair, but ticked the box and looked for the privacy policy to understand how it would be used.
When she couldn’t find a privacy policy, she contacted TfL to find out more. They told her the information would shared with employers if she was offered a job following the fair. Alex was unhappy about this – she felt she should have control of how her information was shared with an employer. TfL had no details on the circumstances and so could not put into context. Most companies ask applicants anyway so it wasn’t clear why TfL needed to share the information.
Alex contacted us for advice, and we contacted TfL. They were unable to explain why the information had been collected or why it needed to be shared. They did not have a lawful basis for collecting the information. They agreed that they should not have collected criminal records information and that this had been collected in error. However, they refused to let applicants who had disclosed criminal records information know of the error or to reassure them that the information would not be shared. We contacted the ICO for advice.
The ICO confirmed that collection of criminal records is unlikely to be necessary for registering to attend an apprenticeship fair. They wrote to TfL to remind them of their obligations regarding the processing of criminal offence data under the UK GDPR and DPA 2018 and ask them to review their procedures.
Only ask applicants for information that is necessary
Data minimisation requires organisations to ensure that the personal data they are processing is adequate, relevant and limited to what is necessary. Organisations should periodically review the personal data held and delete anything they no longer need they. If an organisation has collected more personal data than they need for the specified purpose, this should be identified and the data deleted. Individuals are also able to exercise their right to erasure. This is not an absolute right, but organisations have to consider each request they receive and be able to justify their decision.
TfL may continue to collect information from job applicants but are required to comply with the principles of data minimisation and storage limitation. All organisations must make sure they collect and retain only the minimum amount of criminal offence data. The appropriate policy document should include information on how the organisation’s meet their obligations under the data minimisation and storage limitation principles.
More information
For more on complying with the GDPR/DPA18 see our guidance for employers
Do you really need to ask about criminal records? See our practical guidance for employers
