Aim of this guidance

This guidance explores the role of self-disclosure and looks at when it could (and when it probably shouldn’t) play a role in the recruitment process.

‘Self-disclosure’ in this context means individuals providing an employer with details about their criminal record. This is in contrast to official disclosure, which means carrying out criminal record checks using the appropriate government agency – in England & Wales, the Disclosure and Barring Service (DBS).

Whether a tick box on the application form or part of pre-employment checks, asking has become the norm, often without employers questioning why they ask, or whether the information is relevant to the role.

Employers are accountable for ensuring they comply with data protection law – The General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The penalties for failure to comply can include an enforcement notice, or a fine of up to €20 million, or 4% of annual revenue for breaches related to the basic principles or lawfulness of processing.

It is hard to envisage how asking all applicants to self-disclose criminals record is both necessary and proportionate. Doing so could be considered excessive data collection. Most applicants will not be successful, and employers will then be responsible for managing a large amount of sensitive data.

If it is necessary to ask about criminal records at all, employers should only ask the preferred candidate/s, or simply carry out a DBS check (at the appropriate level) ahead of a formal offer of employment. Employers should hold an open discussion with the candidate about any relevant criminal records, before a final decision is made. Whatever approach employers take, the purpose of asking for self-disclosure must be made clear from the start.

Things to consider

When asking whether self-disclosure is necessary and proportionate, there are a few things to consider.

Will applicants undergo a DBS check?

If the applicant will undergo a DBS check before appointment, what is the purpose of self-disclosure? It can be an opportunity to have an open and frank discussion, allowing employers to ask questions and applicants to provide context. However, advice from the ICO indicated:

‘In general, an organisation asking people to self-declare criminal offence data when it is going to be undertaking DBS checks can be deemed excessive and due to the complexity of the legislation, it could potentially receive inaccurate information. Good practice would be undertaking checks when individuals have a conditional offer rather than at the interview stage.’

Though this advice is case specific, it illustrates that employers must demonstrate how asking for self-disclosure is necessary if carrying out a DBS check. If you are unable to demonstrate necessity, you should not ask for self-disclosure.

How will you use the self-disclosure?

Employers sometimes use self-disclosure as a test of an applicant’s integrity, comparing their self-disclosure with the DBS certificate and taking discrepancies as evidence of dishonesty. Comparing data this way can be problematic and unfair for a number of reasons.

The law regarding disclosure of criminal records is complex and can be confusing. Many people with criminal records do not know precisely what their criminal record contains, or what might be disclosed in certain levels of DBS check. Some people are unaware that they have a criminal record at all. Discrepancies between DBS check data and self-disclosure should not be considered indicative of dishonesty. In our experience, applicants make honest mistakes in disclosing, either because what was being asked was unclear, or because they are unsure of the details of their criminal record. Examples include:

• Disclosing something that is not required:
  • Ajit disclosed a spent conviction when applying for a job in a supermarket. It is a job covered by the ROA and so a spent conviction shouldn’t have been taken into account.
• Not disclosing something that is required:
  • Esther did not disclose a childhood caution when applying for a promotion that was eligible for a standard DBS check because she mistakenly believed childhood criminal records were automatically deleted at 18.
  • Nadeem disclosed a conviction for benefit fraud but his DBS check showed he was convicted of two counts, dealt with in the same proceedings on the same day and by way of the same penalty.
  • Laura needed to disclose a caution on her application for a hospital receptionist role but couldn’t remember the name of the offence. Requesting this information could take weeks, by which time the application deadline had passed.

How will you verify the information?

If the purpose of asking about criminal records is to assess risk to your staff or business, unverified self-disclosure is unlikely to fulfil that purpose. As described above, people may make mistakes when disclosing. It will be difficult to demonstrate the necessity of asking for self-disclosure if the information will not be verified.

Roles covered by the Rehabilitation of Offenders Act 1974 (ROA)

Employers recruiting for roles covered by the ROA should question whether to ask about criminal records at all. If the role is covered by the ROA, employers can request a basic DBS check if they can demonstrate that it is necessary and proportionate to do so.

As always, only the minimum amount of necessary data should be collected. For compliance with the data protection principle of data minimisation, we advise employers not to request self-disclosure. Over-disclosure can be especially likely for roles covered by the ROA, as applicants only need to supply details of unspent convictions for these roles, if asked. Requesting self-disclosure can mean that applicants disclose spent/protected criminal records that cannot be considered for roles covered by the ROA. This is unfair for applicants, who don’t need to share this data for these roles, and means that employers are collecting data they are not entitled to.

If it is necessary to collect criminal record information, a basic DBS check will reveal only unspent criminal records. Employers should provide an opportunity for applicants to discuss any relevant information that appears on the basic DBS certificate in their own words.

Employers who ask for self-disclosure and do not conduct a DBS check for these roles should ensure any questions are clear, proportionate and in line with the ROA. There should also be guidance provided if applicants are unsure whether their criminal record is spent/ protected. For clarity, it is better to direct applicants to specialist sources of advice (e.g. the Unlock disclosure calculator) than explaining spent/unspent in detail in the question itself.

Roles exempt from the Rehabilitation of Offenders Act 1974

Where the role is exempt from the Rehabilitation of Offenders Act 1974, it will be eligible for a standard, enhanced or enhanced with barring list DBS check.

For exempt roles, self-disclosure can give preferred candidates the chance to provide detail and context around their criminal record. However, employers must still demonstrate that it is necessary to ask for self-disclosure. Requesting self-disclosure prior to offer stage is likely to be excessive.

Considering criminal records in context is a key principle of fair recruitment. The need to minimise data collection must be balanced alongside other data protection principles. For exempt roles, we consider the principles of fairness and accuracy are best met by allowing candidates the opportunity to discuss their criminal record before a decision is made.

It is possible to have this discussion with a candidate once the DBS certificate is received. So, employers who request self-disclosure before a DBS check comes back must be confident that this is necessary and proportionate. The timing of any self-disclosure, how it is carried out and how information is managed are important factors to consider in whether it is necessary and proportionate. Bear in mind the ICO’s advice – self-disclosure is likely to be excessive if carrying out a DBS check, unless an employer can demonstrate that it is necessary. If it is necessary, make sure the question asked elicits only the necessary, relevant information. Employers, as controllers, are accountable for all processing.

If you need to ask for self-disclosure

If, having considered the above, you decide you need to ask for self-disclosure, bear in mind that the timing of self-disclosure is an important part of demonstrating necessity and proportionality. We recommend it be from the preferred candidate/s only and in person. This ensures that:

• Applicants are considered on merit
• You collect only necessary data
• Recruiters have the opportunity to ask questions and understand context.

The purpose and lawful basis for asking applicants to self-disclose should be set out in your recruitment policy, which will need to include privacy information for applicants.

Staff should have appropriate training so they can properly assess any information disclosed.

Keep written records to a minimum. If you do use paper forms for self-disclosure you will need to demonstrate that these are necessary. They will also need to be included in data retention schedules to ensure that they are stored/destroyed appropriately. To avoid collecting more information than is permitted, ensure that any forms have clear questions and direct applicants to expert guidance.

Our recommended practice

For ROA exempt roles and organisations with statutory safeguarding duties:

• Bear in mind, safeguarding responsibilities are not compromised by asking applicants later in the recruitment process
• Consider whether self-disclosure is both necessary and proportionate
• Be clear that self-disclosure is the applicant’s chance to provide context, not an opportunity to compare with the DBS disclosure as a test of their honesty or memory.

For roles covered by the ROA:

• Consider whether asking about criminal records is necessary at all
• If you are carrying out a basic check, self-disclosure is potentially excessive
• If you don’t plan to carry out a basic check, self-disclosure is not being verified and the purpose is therefore unclear

For all roles:

• Consider if and when self disclosure is necessary
• Understand compliance requirements relating to data collection, retention and security
• Provide applicants with guidance on disclosure legislation and your policy
• Staff handling criminal records information should have appropriate training
• Ensure your policy is GDPR compliant
• Only use paper forms if necessary
• Have a clear framework for assessing criminal records disclosure, and keep records of decisions made
• Remember that you are accountable for any processing that takes place