Sarah Lamont, a partner at Bevan Ashford, examines what the Code of Practice
on Recruitment and Selection, issued under the Data Protection Act, will mean
The long-awaited Code of Practice on Recruitment and Selection was published
on 14 March 2002. It is issued under the Data Protection Act 1998 as guidance
to employers to ensure compliance with data protection principles in the Act
during the recruitment and selection process.
These require that any data gathered in the recruitment process must be
processed fairly and lawfully; be processed for limited purposes; be adequate,
relevant and not excessive; accurate; not kept for longer than is necessary; be
processed in line with the data subject’s rights; be secure and not be transferred
to countries that don’t protect personal data adequately.
It sets ‘benchmarks’ in seven stages of the recruitment process and gives
some practical guidance in relation to how these might apply in practice.
Employers must notify individuals replying to adverts of the name of the
organisation to which they will be providing information and how it will be
used. Recruitment agencies must identify themselves and explain how personal
data will be used. When an employer receives details from an agency it must
ensure the applicant knows it is holding that information. If an employer
wishes to remain anonymous by using a recruitment agency it may do so in the
early stages but must either then disclose its details to the applicant or
ensure the applicant’s details are supplied on an anonymous basis until the
employer is willing to disclose its own identity.
This refers to all written responses to advertisements. The application
process should only ask for data that is relevant to the recruitment decision
to be made and explain any verification checks that will be carried out as part
of the process. Information on criminal convictions should only be sought if
relevant to the job’s requirements.
This includes the checking of details supplied by applicants to ensure
accuracy and completeness, the checking of qualifications and financial
information and the taking up of references. Applicants should be told what the
verification process will consist of and be given an opportunity to make
representations if any discrepancies are revealed as a result of the process.
The Code concentrates on the need to apply shortlisting criteria
consistently and fairly rather than with the criteria itself. If automated
shortlisting is used as the sole basis for making a decision, applicants are
entitled to be informed of this, be told of the logic behind the process and be
given an opportunity to challenge any decision made under it. If these decisions
are made on the basis of analysis of evidence from psychological tests or
handwriting, the employer must ensure those conducting the analysis are
The Code covers interviews irrespective of whether they are conducted face
to face, on the telephone or by video link. It addresses the data collected at
the interview. It recommends that only data which is relevant to and necessary
for the recruitment process (or for defending it against challenge) should be
recorded and retained. Job applicants will be entitled to have access to all
interview notes retained as a record.
– Pre-employment vetting
The Code recognises vetting may be necessary but seeks to limit its use due
to the intrusive nature of the process. It recommends employers to be very
clear about why they are vetting and should only vet at an appropriate point in
the process. Applicants should be told if vetting will take place and be given
the opportunity to make representation on information gathered.
– Retention of records
The Code does not specify how long recruitment records should be kept, only
that retention should be no longer than necessary. Employers must address this
question on the basis of its particular business needs. All employers should
develop a policy on retention of records and keep a note on each recruitment
round and when records have been destroyed. Employers must ensure they can
properly defend themselves in any claim, particularly one for discrimination,
arising from the process. As claims to the Employment Tribunal must be brought
within three months this is probably a minimum period of retention.
– Keep the data protection principles in mind in managing a recruitment
– Only seek and use information that is relevant to the particular job
– Ensure that information is kept secure and only used in the recruitment
– Be rigorous in weeding old recruitment records, develop a policy and stick