Enforced Subject Access Requests

Certain employers and organisations, such as recruitment agencies, may attempt to exploit the subject access process by requiring individuals to use it to obtain a copy of their criminal convictions (or evidence that there is nothing held) as part of recruitment or continuing employment processes.

This practice is known as enforced subject access as covered by Section 177 of the Data Protection Act 2018. It is a criminal offence for a current or prospective employer or recruitment agency to require an individual to make a subject access request as a condition of employment or for the provision of goods or services.  They should instead be using the existing formal criminal records check arrangements operated by the Disclosure and Barring Service, Disclosure Scotland or Access Northern Ireland.

Where a subject access request is made and the applicant clearly states that the information is for employment purposes, the request will be rejected and the data subject will be redirected to the appropriate agency; the Information Commissioner may also be notified of the request.