Written by JMW Solicitors LLP
The Information Commissioner’s Office (‘ICO’) has launched consultations following its publication of two sets of draft guidance on data protection compliance for employers and recruiters. The guidance is aimed at assisting employers and recruiters in understanding their obligations under data protection law, specifically UK GDPR and the Data Protection Act 2018. Both sets of guidance will be subject to public consultation until 5 March 2024.
The guidance has been drafted based on feedback that the ICO has received from business stakeholders and professional bodies, and focuses specifically on the following areas:
- Keeping Employment Records
The collection of employee data is a fundamental requirement for all employment organisations. There are numerous types of records which employers may be required to keep about their employees. A non-exhaustive list of these records are:
- Personnel files;
- Performance and Training records;
- Payroll details; and
- Equality and Diversity Information.
Data protection law applies at any point where these forms of data are processed. The ICO’s guidance is therefore aimed at ensuring employers are aware of their obligations in accordance with the law.
- Recruitment and Selection
The ICO has also produced draft guidance tailored towards organisations such as recruitment agencies and consultancy businesses that carry out recruitment services on behalf of other employers. The guidance addresses data protection practices across various aspects of the recruitment process, including advertising vacancies, verification of candidates and the retention and deletion of recruitment records. The guidance further applies to recruitment relating to all employment relationships, such as employees, contractors and gig workers.
The rationale behind the ICO’s guidance is to address the challenges which arise within the labour market supply chain where end-to-end recruitment processes involve an increased volume of data collection and processing. To this end, the ICO has proposed that the overall aim of its guidance is to:
- Provide greater regulatory clarity;
- Protect the data protection rights of candidates; and
- Assist employers and recruiters in carrying out effective and compliant recruitment exercises.
Important Considerations for Employers and Recruiters
In accordance with UK GDPR and the Data Protection Act 2018, employers and recruiters are required to ensure that the use of employee and candidate data is:
- Fair – the use of an individual’s personal information must be done in a way that they could reasonably expect, and must not have an adverse effect on them;
- Lawful – you must be able to demonstrate a lawful and legitimate basis for using personal information and you must not use this is a way that would be deemed unlawful; and
- Transparent – you are required to be open and honest about the way you intend to use personal information and must inform people of this.
Whilst the law does not prevent employers and recruiters from collecting and retaining data from workers, this information must not be kept for any longer than is necessary. Further, as highlighted by the ICO, it is important for employers to consider striking a balance between the requirement to retain employment records and the right that workers have to private life.
What’s Next?
The consultations on the ICO’s draft guidance will remain open to the public until 5 March 2024. The ICO has also announced its intention to release practical tool and checklists for employers in due course aimed at promoting best practice amongst employment organisations and recruiters in relation to data protection.
Both consultations can be found by following the relevant links on this webpage: Two new employment guidance pieces out for consultation | ICO
This article is for general guidance only and should not be used for any other purpose. It does not constitute and should not be relied upon as legal advice.
If you would like to discuss this article or any recruitment issue in more detail, please contact Simon Bloch of JMW Solicitors LLP either by email at simon.bloch@jmw.co.uk or by telephone on 0161 838 2628.
