european-union gdpr
Can background screening companies be forced to remove stored personal data under GDPR?
<p>I understand that a background screening company requires a certain set of personal data to deliver a service. One typically consents for this data to be processed when completing associated paperwork. </p>

<p>Once the check has concluded, would the company be obliged (if requested by the subject of the check) to purge all personal data that was gathered prior to and during the check? Furthermore, upon receiving the request, would any third parties with which the screening company shares the data also be obliged to purge it?</p>

<h1>Intro</h1>

<p>I assume that the background screening you are referring to is made in connection with applying for a job. If so, it would generally be the applicant's (prospect) employer that is primarily responsible for the processing of the personal data in relation to the applicant. The employer outsources the background screening to a service provider, which in GDPR terms is considered a controller-processor relationship (the service provider processes personal data about the applicant on behalf of the employer/the controller). </p>

<p>The same principles generally apply irrespective of whether the data is collected prior to or during the screening. However, depending on the content of such data, different safeguarding requirements may apply.</p>

<h1>Consent possibly not reliable</h1>

<p>The employer must identify legal grounds for processing the data that a background screening collects (see <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6 GDPR</a>). It could be argued whether consent is valid ground for background screening considering the imbalance between the parties. In many jurisdictions within the EU, consent in an employment context has generally been very difficult to rely on. If consent could not be relied on, the employer would typically have to argue for that there is a legitimate interest to process the data. (See also <a href="https://gdpr-info.eu/art-88-gdpr/" rel="nofollow noreferrer">Article 88 GDPR</a>.)</p>

<h1>Storage time</h1>

<p>A general principle in GDPR is storage limitation (<a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">Article 5(1)(e)</a>). It means that a controller (or a processor) may not store personal data for a longer period than necessary. Hence, once the background screening is completed, the employer is not likely allowed to store the data for a longer period than is necessary for completion of the recruitment process. The background screening company should likely not have any use of the data after having provided the background screening report to the employer. The employer may however argue that the information must be stored for some time to be able to manage the recruitment.</p>

<h1>Deletion upon request</h1>

<p>The applicant has no absolute right to request a deletion of data (which is a common misunderstanding of GDPR). The "right to be forgotten" is a bit different depending on the context of the processing (see <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Article 17 GDPR</a>):</p>

<ul>
<li>If the processing is based on <strong>consent</strong>, the applicant may request a deletion, which in general must be complied with, but the employer might find other grounds for keeping the data. </li>
<li>If the processing is based on <strong>legitimate interest</strong>, the applicant may request a deletion, and the employer will have to re-assess its grounds for keeping the data. If the grounds are still valid, the employer is not obliged to remove the data.</li>
</ul>

<h1>Sharing with third parties</h1>

<p>Your question touches upon the issue of parties with which the screening company would share the screening information. Except for with the employer (which has a direct relationship with the applicant), it should be noted that there is very little room in GDPR for the screening company (or the employer) to share the data with any other party, unless the applicant has explicitly consented thereto. Such a third party would then likely be a controller in itself, and the third party would then have a direct responsibility and liability towards the applicant. It would then likely be possible to withdraw the consent, which triggers an obligation to purge the data.</p>

<h1>Third party deletion</h1>

<p>If the employer is obliged to purge the data (e.g. if consent is withdrawn or there is no remaining legal ground for continuing the processing/storing of data), the background screening service provider should also delete the data. Although also the service provider is bound by GDPR, some responsibility falls upon the employer to stipulate the conditions for such deletion in a contract between the parties (see <a href="https://gdpr-info.eu/art-28-gdpr/" rel="nofollow noreferrer">Article 28(3)(e) GDPR</a>).</p>

<h1>Concluding remarks</h1>

<p>This area is a bit tricky and disputed, see for instance <a href="https://www.sterlingtalentsolutions.com/blog/2018/04/gdpr-impact-background-screening-program/" rel="nofollow noreferrer">here</a>, <a href="https://www.linkedin.com/pulse/pre-employment-background-screening-under-gdpr-frivaldszky-dr-llm-/" rel="nofollow noreferrer">here</a> and <a href="http://www.scesolicitors.co.uk/news/background-screening-and-gdpr#.Wz3V19UzaUk" rel="nofollow noreferrer">here</a>. A good advice is therefore to review the privacy notices that the employer must provide along with any request to provide information for a background check. </p>

<p>It could also be worth mentioning that a background screening company is generally prohibited from dealing with data relating to criminal convictions and offences (<a href="https://gdpr-info.eu/art-10-gdpr/" rel="nofollow noreferrer">Article 10 GDPR</a>), which to my experience is quite common.</p>
