11 July 2005
The Chartered Institute of Personal Development (CIPD) has warned UK firms that they are a "soft touch" for CV fraudsters (Source: CIPD Annual Survey Report 2005: Recruitment, Retention and Turnover). Nearly half the firms interviewed by the CIPD said they rarely or never checked candidate’s academic qualifications, with 20% rarely or never checking absenteeism from previous jobs. Yet, bosses at 1 in 4 firms have withdrawn a job offer after discovering that the prospective employee lied on their application form or CV. With so few basic checks being carried out, how many more fraudsters are getting away with it undetected? The CIPD has alerted employers that they must check out CVs and applications. How should this be achieved without breaching data protection laws?
Code of Practice - The Information Commissioner has recently published the revised consolidated version of The Employment Practices Data Protection Code, which provides guidance to help employers comply with the Data Protection Act 1998 and encourage them to adopt good practice. Part 1 of the Code covers recruitment and selection and contains guidance on gathering information on job applicants. It aims to strike a balance between the employer’s need for information and the applicant’s right to respect for their private life.
Information-gathering methods - It is less intrusive to obtain relevant information directly from the applicant and then verify it (verification) than it is to obtain information about the applicant directly from third parties (vetting).
Verification - Verification should be the primary form of checks carried out. If it is necessary to verify information by securing the release of documents or information from another organisation or person, the employer should obtain a signed consent form from the applicant unless consent to their release has been indicated in some other way. For example, this applies to taking up references provided by the applicant or checking qualifications. Be aware: misleading another person or organisation into giving personal information about an applicant can be a criminal offence.
If it is necessary to verify criminal conviction information (for example, to protect the business, customers, clients or others) an employer should only do this by getting a disclosure from the Criminal Records Bureau (CRB) or Disclosure Scotland (DS). The Supplementary Guidance to the Code provides further information about the CRB and DS at pages 17 to 18.
Employers should not force applicants to use their subject access rights to obtain information from another organisation (i.e. by making such a requirement a condition of getting the job).
Vetting - Vetting should only be used where there are particular and significant risks involved to the employer, customers, clients or others and where there is no less intrusive and reasonable practicable alternative.
It should not be used as a means of general intelligence gathering. Employers should only seek to obtain clearly focused information that will have a significant bearing on the employment decision.
Sources that are used should be carefully considered. Employers should only seek information from sources where it is likely that relevant information will be revealed and should not place reliance on information collected from sources that may be unreliable. Again, if employers need to secure the release of documents or information from a third party, they should obtain signed consent from the applicant beforehand.
Timings, feedback and records - Irrespective of the type of checks, employers should explain clearly to candidates early in the recruitment process, that checks will be carried out and how they will be conducted. The checks themselves, however, should be carried out as late as possible in the recruitment process to avoid unnecessarily obtaining information about candidates who later turn out not to be suitable. Ideally, vetting and verification checks should be confined to the candidate the employer intends to appoint.
Applicants should be given an opportunity to make representations should any of the checks produce discrepancies.
Information obtained by a verification or vetting exercise should be destroyed as soon as possible or in any case within 6 months. Employers must ensure that personal information received during the recruitment process is securely stored or destroyed. Records of the result of verification or vetting can be retained.
The Code, along with Supplementary Guidance and a guide for small businesses can be found on the Information Commissioner’s website at www.informationcommissioner.gov.uk