BC Privacy Commissioner Curbs Use of Criminal Record Checks

Articles

Criminal record checks and police information checks are often used by employers as a screening tool for new employees, and are even used when employees move to new positions. However, the collection and use of such checks is subject to both privacy and human rights considerations. In an investigation report released on July 25, 2012 by the Office of the Privacy Commissioner for British Columbia (the “OPIC Report”), the use of employment-related criminal record checks and police information checks by the Government of British Columbia was criticised by the Privacy Commissioner.

The BC government and other public bodies are subject to the Freedom of Information and Protection of Privacy Act (“FIPPA”). FIPPA defines “personal information” as “recorded information about an identifiable individual other than contact information“. The collection, notification, use and retention of personal information by a public body must comply with FIPPA. The Privacy Commissioner’s concerns over the use of criminal record checks were articulated as follows:

I am concerned about the societal trend towards increased employment-related criminal record checks without clear evidence as to their benefit. Criminal record checks are among the most privacy invasive of pre-employment screening measures and, where used inappropriately, can result in employers unfairly denying an individual employment. Where employers decide to put in place such a process, it is essential that they respect the privacy rights of the employees subjected to these checks.

While acknowledging that the government may, in some circumstances, have a legitimate basis for requesting criminal record checks and police information checks, the OPIC Report affirmed the position that such checks are highly invasive:

[t]hey stand to reveal sensitive personal information about a person’s past activities, including prior convictions, penalties or outstanding charges – and in the case of police information checks, details about adverse contact with police, including investigations that do not result in charges or charges approved by Crown Counsel that do not result in convictions.

The ever-increasing capacity of information systems to collect and store personal information about individuals compounds these concerns.

The OPIC Report made a number of recommendations and identified best practices for employment-based criminal record checks for the government and other public bodies, including the following:

  • Public bodies should conduct criminal record checks only and not police information checks. A criminal record check involves a search of the federal Canadian Police Information Centre’s central database to determine whether an individual has prior criminal convictions, penalties or outstanding charges. A police information check (or police record check) also includes a search of local police databases (i.e. Police Records Information Management Environment or PRIME) for adverse contact of an individual with the police. The Privacy Commissioner noted that because police information checks extend to adverse police contact (such as charges approved by Crown Counsel that do not result in convictions and investigations that do not result in charges), such checks are substantially more privacy-invasive than criminal record checks, and therefore can rarely be justified.
  • Public bodies should collect only the minimum amount of information necessary to conduct criminal record checks and should not retain a copy of an individual’s identification. Information required to conduct a criminal record check typically consists of an individual’s surname, given name, date of birth, gender and any aliases or previous names. While a public body may examine identification to confirm identity, it should not record any of the information or retain a copy of the identification.
  • Public bodies should not require criminal record checks for all positions – only those with unique access to valuable resources and sensitive information.
  • Public bodies should use criminal record checks as only one minor element of an employer’s screening process. Instead, employers should rely more on other screening methods to confirm an individual’s suitability for a position, such as interviews, oral and/or written examinations and reference checks.
  • Public bodies should ensure that an individual is given proper notification about the criminal record check process before the check occurs. In that regard, the public body is required to advise the individual of the purpose for collecting the criminal record history, the legal authority for collecting this information and the business contact information of the person within the public body who can answer the individual’s questions about the collection.
  • Public bodies should only conduct a criminal record check on a prospective employee after making a conditional offer of employment.
  • Public bodies should only see the results of the criminal record check after the results have first been disclosed to the affected individual. This ensures that the individual has an opportunity to review the results for accuracy and, where a potential error may exist, to challenge the results of the check before they are disclosed to the public body.
  • Public bodies should consider the relevance of an individual’s criminal record history in relation to the specific requirements of a position. If a criminal record check reveals a previous conviction or outstanding charge, the employer must assess whether this has any effect on the decision to hire a particular individual by considering the characteristics of the position that the individual has applied for.
  • Public bodies should allow an individual the opportunity to request a review of a decision not to hire them based on the results of a criminal record check. The review process should be conducted by someone who was not involved in the initial decision.
  • Public bodies should not use the results of employment-related criminal record checks for any purpose other than the hiring decision.
  • Public bodies should establish retention periods for criminal record check information. Based on Section 31 of the FIPPA, a public body is required to retain any personal information in its custody or control that is used to make a decision about an individual for a minimum of one year from the date of the decision. At the same time, personal information, such as criminal record history, should not be kept indefinitely. Where an individual with a criminal record is hired as an employee, the Privacy Commissioner recommends that once the one-year retention period has expired, the public body only retain a document noting when the criminal record check was performed and a brief summary of the individual’s criminal record.
  • Public bodies should not undertake additional criminal record checks simply because an employee has changed his or her position within the public body. An additional criminal record check by the public body may be justified when an existing employee is hired into a position with substantially different responsibilities and risk factors.
  • Public bodies should not automatically undertake ongoing criminal record checks even where an initial criminal record check can be justified. Ongoing checks should only be undertaken where an employee exercises a particularly sensitive function that requires scrutiny on an ongoing basis.
  • Where possible, public bodies should ensure that responsibility for the criminal record check process is assigned to a central agency, such as a human resources department, rather than with the prospective employee’s supervisor.
  • Public bodies should prepare privacy impact assessments to assess and mitigate any privacy implications of any new or revised usage of criminal record checks. Once a public body prepares a privacy impact assessment, the assessment should be reviewed and updated on a regular basis as required.

The OPIC Report was intended to address criminal record check practices with respect to employees appointed under the BC Public Service Act but specifically excluded persons who were working or volunteering with children and adults (such persons are subject to the requirements of the Criminal Records Review Act).

The collection, use and retention of personal information by private sector employers in BC is subject to the Personal Information Protection Act. The Privacy Commissioner has advised that it intends to issue best practices for criminal record checks by private sector employers at a future date.