Background Check Privacy

Overview

Pre-employment background checks involve processing personal data that ranges from routine reference verification to highly sensitive criminal record data. Art. 10 GDPR provides specific restrictions on processing data relating to criminal convictions and offences, requiring that such processing be authorised by EU or Member State law providing appropriate safeguards. Beyond criminal data, background checks may involve credit history, educational qualifications, professional registration, social media presence, and right-to-work verification — each carrying distinct proportionality and data minimisation requirements. The principle that governs all background checking is role-based necessity: the scope of a background check must be proportionate to the specific role and its associated risks, not applied uniformly across all positions.

Legal Framework

Art. 10 — Criminal Conviction Data

"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects."

Key requirements:

• Criminal data processing requires specific national law authorisation (not merely a legitimate interest)
• The national law must provide appropriate safeguards
• A comprehensive register of criminal convictions may be kept only under the control of official authority

Art. 6(1) — Lawful Basis for Background Checks Generally