Employers who force prospective employees to obtain a Subject Access Request (SAR) from the police detailing criminal investigations or history will be committing a criminal offence following changes to UK data protection legislation.

The Ministry of Justice recently announced that Section 56 of the Data Protection Act 1998 (DPA) will come into force across the UK. It will make it a criminal offence for employers to demand prospective employees obtain SAR reports.

The correct procedure to obtain criminal records of prospective employees is via the disclosure service provided by Disclosure Barring Service (DBS), the new name for the Criminal Records Bureau, or the Scottish equivalent, Disclosure Scotland (DS). Whilst these services were in the process of being developed, employers could demand that applicants made SARs directly to the police and pass on the report.

The purpose of Section 56 was to close this loophole once the DBS/DS system had become fully operational. For that reason, Section 56 was inserted into the DPA but not enacted with the rest of the provisions. It applies only to records obtained by the individual from the police using their Section 7 SAR rights.

SAR reports contain far more information than would be revealed under a DBS/DS check, such as police intelligence and spent convictions. As a result, the practice is frowned upon by the authorities; the police SAR form states enforced SARs are exploitative and contrary to the spirit of the DPA, and the Information Commissioner’s Office guidance on employment has long advised against it.

Some employers have been concerned that Section 56 will make it an offence to undertake DBS checks on prospective employees; however, it is designed to encourage their use and prevent enforced SARs.

The only exemptions to Section 56 are situations where the report is justified as being in the public interest or where required by law; the Section 28 national security exemption does not apply.

At the time of writing this article, it's understood that there has been a delay to the implementation of this provision, which were originally due to be introduced on December 1.