Recruitment can often feel like a daunting task, involving multiple steps, from reviewing resumes to conducting interviews. To ensure the right candidate is selected, background checks are commonly employed. However, these checks must be conducted with respect to privacy laws and in compliance with legal standards, such as Kenya’s Data Protection Act, 2019.
The ODPC Decision in Complaint No. 0586 of 2023, Harrison Kisaka vs. Faulu Microfinance Bank Limited, highlights the crucial role of compliance during background checks in recruitment. Kisaka’s complaint against Faulu Microfinance Bank brought to light concerns about the improper handling of personal data during the hiring process.
The case underscores that while background checks are essential for minimizing risks and ensuring candidate suitability, they must be carried out in accordance with data protection regulations. Effective recruitment practices not only involve thorough checks but also strict adherence to privacy laws to protect candidates’ personal information.
In this article, we’ll explore the world of background checks, their importance, and their role in the hiring process, emphasizing the need for compliance with legal standards to foster a trustworthy and lawful recruitment framework.
Table of Contents
What Is A Background Check in the Recruitment Process?
A background check is a pre-employment screening process that verifies the information provided on a candidate’s CV, including their work and education history. In Kenya, the Data Protection Act of 2019 (DPA) governs the proper handling of personal data obtained through such checks.
Why Are Background Checks Important?
Background Checks ensure that the information provided by the candidate is accurate, assess their suitability for the role, and identify any potential risks associated with hiring them. They are essential as they help employers make informed hiring decisions by providing a clearer picture of a candidate’s qualifications and character.
Steps to Take Regarding Background Checks in Hiring and Recruitment
1. Obtain Explicit Consent
Before initiating a background check, it is crucial to obtain explicit and informed consent from the candidate. The Data Protection Act mandates that personal data must be processed lawfully, fairly, and transparently. This involves explaining to candidates why their data is being collected, how it will be used, and ensuring they understand their right to withdraw consent at any time.
2. Define Scope and Purpose
It is important to clearly define the scope and purpose of the background checks. According to the DPA, personal data should only be collected for specific, legitimate purposes. Employers need to specify what types of checks will be conducted—such as criminal record checks or verification of employment history—and ensure that the data collected is relevant and necessary.
3. Process Data Lawfully
Employers should avoid collecting excessive or irrelevant information and use the data strictly for the recruitment process. If background checks reveal adverse information that might affect the hiring decision, employers must handle it transparently. Candidates should be informed of any adverse findings and given a chance to address or explain these issues.
4. Ensure Data Security
Employers should use secure systems and protocols for storing and transferring data and restrict access to authorized personnel only.
5. Facilitate Data Access
Candidates also have the right to access their personal information, If a candidate requests access, employers must provide copies of any data collected about them. This involves responding promptly to such requests and ensuring compliance with the DPA’s requirements.
6. Establish Data Retention Policies
Data should not be kept longer than necessary for its intended purpose, so employers should set retention periods based on legal and operational needs and ensure that data is securely deleted or anonymized when no longer required.
7. Comply with Regulations
Employers should be prepared for potential oversight by the Office of the Data Protection Commissioner (ODPC) and ensure they can demonstrate compliance with data protection laws by keeping detailed records of data processing activities and responding promptly to any regulatory inquiries.
8. Train and Educate Staff
Finally, educating and training staff involved in the recruitment and background check processes is vital. Proper training ensures that all personnel understand data protection principles and adhere to best practices in handling personal data.
Conclusion
In summary, by complying with the data protection Act, organisations can avoid legal penalties, protect themselves from reputational damage, and foster trust with employees and clients. Compliance ensures that background checks are conducted ethically, with respect to privacy laws, preventing data misuse and ensuring only necessary information is obtained and processed lawfully.
Happy learning!
Written by: Nicole Mballa
