Navigating the legal basis for employment background screening: Global compliance challenges and best practices

This paper concentrates on the legal basis of processing personal data in the context of the employment background screening role. Although this is a specialised task, it serves as a useful exercise for any enterprise evaluating the legal basis of processing personal information, especially when third parties are involved. When conducting employment background screening, the roles of the parties involved need to be clearly outlined. If a third party screening company is used, they may be a data processor, which requires specific contractual language. If they are a data controller, then joint controller language will need to be completed, as the employer and background screener have entirely separate roles in the data processing. Determining the legal basis of processing is primarily completed by the hiring organisation, as only they know who they are screening and why. Although the term ‘consent’ is commonly used in the background screening process, it is rarely allowable in General Data Protection Regulation (GDPR) or GDPR-like privacy regulations but may be the primary legal basis of processing in other countries. This can set up a conflict of laws for the hiring organisation, which they will have to navigate through. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.