Info zone – Data protection
Brian Rogers owns a large hotel in Devon. The hotel employs approximately 50 permanent employees, taking on casual staff during busy periods.
As the summer season approaches, Rogers has started his seasonal recruitment drive with an advert in the local paper. This invites individuals to complete the hotel's standard application form in respect of a range of general vacancies.
Rogers needs to employ several additional workers, including waiting staff and cleaners. One of the reception workers has also just left and must be replaced.
The application form was designed for catering staff and includes questions about medical conditions, lifting and mobility. A few applicants have refused to complete these sections and Rogers has discarded their applications.
Over the years, Rogers has also accumulated huge numbers of application forms from both successful and unsuccessful applicants. He recently contacted some of these former applicants to see if they would be interested in working another season. A few individuals were surprised to hear from him after so long.
One individual even wrote to complain and asked him to remove her details from his files immediately.
This case study is a work of fiction and consequently the names, characters and incidents portrayed in the article are fictitious. Any resemblance to actual persons, living or dead, events or localities is coincidental.
Employers must obtain applicants' consent to use data or keep it on file for future vacancies
What the expert advises
Kate Gater is a solicitor in the Employment Services Group at Berwin Leighton Paisner
Generally, applicants should not be asked to provide information which is not necessary to make the recruitment decision.
Although it may be appropriate to ask applicants for waiting duties to give details of any medical conditions which will affect their mobility, this will not be necessary for the clerical vacancies. It should be made clear to these applicants that they need not complete these sections.
In addition, this information would be classified as "sensitive personal data". Accordingly, if it is necessary to ask applicants about their health, the applicant's explicit consent would be required to obtain the information.
Rogers's application form check list
• Are the questions relevant to the vacancy?
• Has he obtained the applicant's consent to use the data or keep the data on file for future vacancies?
• Has he obtained the applicant's explicit consent to obtain sensitive personal data?
• Does the form explain who will receive the information and how it will be used?
If (as in the past) Rogers intends to keep details of applicants on file, this should be explained to them. The applicants should also give their informed consent to this practice.
What the law says
The Data Protection Act 1998 regulates the way in which data controllers (employers) process personal data about data subject.
Processing is a wide concept including obtaining, holding and using. Importantly, data subjects will include employees and prospective candidates.
Employers must ensure that they process data in accordance with the eight Data Protection Principles. This has a number of implications for Rogers's existing recruitment practice.
Be aware
Both individuals and the data protection commissioner can take legal action against employers who breach the Data Protection Act 1998. Where the commissioner becomes aware of contraventions, employers may be served with enforcement notices which prohibit processing or specify action, which must be taken to comply.
Ultimately, criminal liability may arise either for non-compliance with a notice or for the unlawful disclosure or obtaining of personal data. Further, individuals who have suffered damage or distress as a result of a breach of the act may be awarded compensation by the courts.
Contacts
Berwin Leighton Paisner & Co
020 7760 1000
Employment Law and Industrial Relations Helpline 020 7396 5100
