The background screening industry is blooming. Whether it is the mainstream adoption of background checks triggered by compliance awareness, the development of major corporations partnering with independent contractors, or the globalization of the practice, the market is keen to find the right fit and ensure a safe environment.
It is not uncommon to find a situation where an employer located in California hires a background screening company located in New York to perform a background check on a candidate who is a Japanese citizen, and resident of Spain. Which data protection regulation should be applied in this scenario?
In some circumstances, the job posting or the employer’s consent form to the candidate establishes the law applicable to the recruitment process and the candidate has accepted it as is. If the job posting and/or the consent form is silent, the background screening companies have two options: (i) hire a multinational law firm with attorneys in California, New York, Japan, and Spain to provide the level of counsel – and comfort – needed in performing the background check, or (ii) ensure that the screening company is developing a sufficient level of accessible knowledge and thorough procedures to make a balanced decision for a state-of-the-art check.
Global Screening
The United States and the European Union have different cultural norms and, therefore, set different standards that a company must identify and must abide by when performing background checks. For instance, two restrictive principles in the context of background screening are the European Union data minimization principle and the United States accuracy principle. Both principles go hand-in-hand and can be found in the overwhelming majority of data protection laws around the globe. The key differentiator is that the United States places an emphasis on the accuracy principle while the European Union is sensitive to data minimization. Another example is found in the legal basis for lawful processing; consent is a must-have in the context of background screening in the United States, meanwhile European companies should rely on a legal ground different than consent in the context of employment. The Hellenic Data Protection Authority decision No 26/2019 recently reminded that consent may not be deemed as freely given due to the clear imbalance between the parties. The cultural gap may explain the different standards found in data privacy, but it will not justify the lack of accountability in the processing of personal data.Reconciling Data Privacy Regulations
While doing a background check on the global scene, all standards should be taken into consideration and weighed against one another in order to make a balanced decision. The European Court of Justice recently said that: “(…) the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (…)”. [1] All things must be taken into consideration – balanced decision and detailed documentation surrounding the management of personal data might be more powerful than ever in the context of global screening. A relationship with a partner, a client, a data protection authority or a candidate could become litigious where a prejudice is suffered, notably upon the occurrence of a data protection law violation. This is likely to happen, for example, if the job candidate feels he or she has been prejudiced or the company has violated a data protection law. Despite differences in standards across the world, a company can take steps to mitigate issues arising out of situations involving multinational jurisdictions. One can assume that hiring a multinational law firm with attorneys in many different states and countries in the world does not appear to be the most expedient way to provide a check. Thus, a company faced with a situation as described above should identify, assess, and mitigate any risks in performing background checks. The risks commonly associated in collecting and processing data are:- lack of accuracy;
- over-processing;
- security breach; or
- leak of data.
