The processing of criminal records in the context of an employment relationship
Published on 26th Jul 2021
It is very common for companies to check the criminal record of candidates in the selection process as a requirement to be able to access the job. This is a very common practice in the United States and other English-speaking countries, as their legal system allows it. However, in Spain, this practice is highly controversial and raises doubts.
The first processing of an employee's personal data by the company usually occurs during the recruitment process. It often happens that companies try to obtain as much information as possible about the candidates participating in the recruitment process, including the existence (or not) of a possible criminal record.
Criminal records are data that affect the employees' privacy, as it is deduced from the definition in Article 4.1 of Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter "GDPR"). These data are specially protected, so processing them without respecting the corresponding guarantees would entail a breach of the employee´s right to privacy.
When the processing of data takes place as part of an employment relationship, the processing can only be considered lawful if it meets a twofold requirement: (i) the existence of a legal obligation that requires the company to collect such information (article 6 c) GDPR) and; (ii) that such information is necessary for the execution of the employment contract (article 6 b) GDPR).
Furthermore, Article 10.1 of the Organic Law, of December 5, on Personal Data Protection and Guarantee of Digital Rights, regulates the processing of data of a criminal individual. The article states that when the purpose of the processing of data relating to convictions and criminal offences, is other than the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, the processing may only be carried out when it is authorised by Union or Member State law (or other legal provisions enforceable in Spain).
Consequently, it is not legally possible to require a criminal record certificate from job applicants, except in those cases in which it is authorised bylaw with due guarantees then such information is necessary for the execution of the employment contract. For example, the Organic Law 1/1996, of 15 January 1996, on the legal protection of minors requires employees who provide services that involve direct contact with minors must prove that they do not have a criminal history by providing their employees with a criminal record certificate.
The courts of Labour Jurisdiction have ruled on the processing of personal data as affecting the professional relationship between the employer and the employees. In particular, on 10 February 2020 (Judgment 14/2020), the Social Chamber of the National High Court declared to be unlawful the practice of a private security company of asking security guards –prior to their recruitment process– to provide a criminal record certificate for the last five years.
The National High Court, after analysing data protection regulations and private security regulations, stated that companies, which do not comply with the twofold requirement, are not entitled to collect data concerning the criminal convictions of security guards. The High court concludes that none of these requirements are met in the present case.
The National High Court also held that, although security guards are required to have a clean criminal record, security companies are not legally entitled to collect such information, because these competence lies with the Ministry for Home Affairs.
In short, the request for a criminal record certificate by companies will only comply with data protection regulations in those cases where there is a legal provision entitling them to make such a request and to process the associated personal data. Otherwise, the request would breach the individual's right to data protection, even in those sectors in which, due to the type of activity, it is required that their employees do not have a criminal record. Therefore, it is very important to ask for expert advice before requiring job applicants to provide a criminal record certificate.
