France and the United Kingdom are close neighbours. These countries are separated by a mere 21 miles of sea and are also connected by the Channel Tunnel. So, you might think that these countries share similar approaches to international employment screening, vetting and verification. Especially since the primary data protection legislation in France is the General Data Protection Regulation (GDPR), while the UK utilised the GDPR as the foundation of its own national privacy law, the Data Protection Act 2018.
But there are major differences in the regulations surrounding what data can be collected – and how.
The Commission Nationale de l’Informatique et des Libertés (CNIL) and the Information Commissioner’s Office (ICO), the respective data protection authorities in France and the UK, have both produced guidance relating to the recruitment process. It’s recommended that employers operating in these locations refer to these guidance documents when considering what information can be requested from an individual as part of employment screening.
What does employment screening look like in France?
France strictly observes the principle of data minimisation. Over and above French data protection legislation, both the Labour Code (Art. L1121-1 & Art. L1221-6[PJ1]) and the Civil Code (Article 9) are important to framing the approach that employers should take when considering what personal information can be requested as part of the recruitment process. CNIL states in its guidance:
“Thus, only adequate, relevant and strictly necessary data for the selection of the candidate for a given position and for the conduct of the job interview may be collected.”
The Commission Nationale de l’Informatique et des Libertés
Employers would need to explain to candidates what information is being requested, why it is necessary, and they should have a lawful basis for requesting such information.
What data can you collect during the screening process?
You can usually gather employment references or review a candidate’s qualifications if they are relevant to an employee’s suitability for a particular role, and the candidate has authorised it. But gathering a candidate’s previous addresses, social security number, and conducting credit checks (even for roles requiring cash handling or financial responsibilities), would likely be considered irrelevant and therefore excessive – at odds with data protection legislation in France.
While conducting searches of publicly available information such as social media, a prospective employer could review professional networks such as LinkedIn for professional information relating to a candidate. But, in most cases, searches of a candidate’s social media profiles (Facebook, Twitter etc), or Google searches would be difficult to justify, given that they often reveal a lot of private information.
“The employer does not have the right to collect this information, as such a collection is akin to a “morality” investigation.”
The Commission Nationale de l’Informatique et des Libertés
What do Criminal Record Checks look like when you screen employees in France?
CNIL states that criminal record checks should only be conducted in very limited circumstances; and where such records are checked, the employer is not usually permitted to keep, copy, or make notes about what it contains – other than confirmation that they have reviewed it:
“In the absence of a specific text, a recruiter will not in principle be able to obtain an extract from a candidate’s criminal record. However, in the event of a need directly linked to the position to be filled, and provided that it can prove compliance with the Labour Code, the recruiter may request to consult a paper extract from the candidate’s B3 bulletin, without keeping it or making a copy of it.”
The Commission Nationale de l’Informatique et des Libertés
What does employment screening look like in the United Kingdom?
Employers in the UK do have more freedom regarding the information that can be requested, or the checks that can be conducted. There are fewer direct prohibitions while carrying out international employment screening. But businesses still need to observe the general GDPR data minimisation principle and shouldn’t ask for irrelevant or excessive personal information.
“Verification is the process that employers or recruiters use to check the information a candidate provides in support of their job application. It also includes checking references.
This is different from pre-employment vetting which is covered in the section on Pre-employment vetting of candidates, and involves employers actively making their own enquiries, rather than checking the information provided by the candidates themselves.”
Information Commissioner’s Office
How should you conduct employment screening in the UK?
Verification isn’t considered controversial, but employers should be mindful to ensure that the data collected from candidates is relevant and necessary for the purpose that it was collected, and that there is a lawful basis for collecting this information. It’s also important to explain to your candidate what data is being collected and why.
Pre-employment vetting, which is considered more in-depth and intrusive than verification, needs more justification. The ICO indicates that pre-employment vetting should be reserved for instances whereby there is a “legal requirement (for the employer to perform vetting), or the employer can identify significant and particular risks to the employer, clients, customers, or others. Such risk factors might include:
- breaches of national security;
- employing unsuitable people to work with children or adults at risk of harm;
- there is a danger to others;
- risk of theft; or
- disclosure of trade secrets or other commercially sensitive information.”
Balance is key. Employers must be able to justify the information that they request as part of an assessment of an individual’s ability to perform a role, and will require a lawful basis for processing such data. Credit checks, criminal record checks and social media checks of public profiles may be justifiable in certain circumstances, depending on the nature of the role and its responsibilities. And it’s important to explain to individuals what checks are being conducted, and why they are necessary.
Criminal Record Checks in the UK
Employers who want to review criminal record checks would need to meet a specific condition under Schedule 1 of the DPA 2018 (unless they are performing a public function and exercising powers established by law). In most cases employers will only be able to request information about recent ‘unspent’ convictions under a Basic check, however for certain roles (such as those that fall under the Rehabilitation of Offenders Act (Exceptions Order)), an employer may also be required to review ‘spent’ convictions, as well as ‘unspent’ convictions, by way of a Standard or Enhanced check.
How to stay compliant during international employment screening
While there are some similarities in the approach to screening between France and the UK, there are also key differences that apply to screening internationally. It’s of paramount importance that employers adhere to local legislation when considering their approach to recruitment and employment screening. What might be permissible in one location, may not be suitable in the other.
If you want to talk about how to stay compliant and culturally aware while carrying out international employment screening, get in touch at UKEnquiries@accurate.com.
