Employers, especially those that are part of foreign groups, sometimes wish to carry out background checks, to analyse information concerning the circumstances or status of job candidates or employees beyond the extent of their legal right to do so. As this involves the processing of candidates’ or employees’ personal data, employers should make sure that what they do complies with the legislation before undertaking any activities in this respect.

This article focuses on issues relating to background checks carried out by employers in relation to candidates and employees. We do not refer to situations that are similar but materially different in terms of regulatory implications, such as:

• Background checks carried out in respect of persons providing services on a basis other than an employment contract
• An employer's processing of publicly available information (such as that published on social media)
• Situations where an employer carries out background checks on its employees not on its own behalf, but on behalf of a client with whom the employee in question would be engaged to carry out a specific assignment.

Can employers carry out background checks on employees?

Conducting most types of background checks can be problematic from the point of view of Polish regulations, especially if the information was not to be collected directly from the job candidate or employee. However, even where information is collected directly from them, Polish employment and data protection laws significantly limit the scope of personal data and documents that employers may request, effectively limiting their ability to carry out background checks.

Whether a particular type of background check will be permissible under Polish law depends on the type of activities to be performed as part of that check. In practice, background checks may have very different forms. Some may take this term to mean verification of references from previous employers, verification of a university diploma or checking a person's identity, while others may mean verification of a criminal record, family situation or credit history. Different restrictions will apply to each of these background checks.

Background checks and the Labour Code

As regards information collected directly from the job candidate/employee, the Labour Code contains a closed catalogue of personal data that an employer can request. This list does not include credit history, financial condition or family situation. Therefore, an employer's request for this type of information from a candidate or employee may be considered a breach of the law and, in principle, may only be allowed in exceptional cases. Importantly, even obtaining the candidate or employee's consent to carry out a verification that involves the processing of personal data that goes beyond the catalogue under the Labour Code does not eliminate legal risks for the employer, as this type of consent can easily be considered as having been given involuntarily, therefore making it invalid under data-protection legislation.

Personal data, to the extent that the Labour Code allows it to be obtained, shall be made available to the employer in the form of candidate/employee statement. The employer may request documents necessary to corroborate the statement in question (in principle, this is the only permissible check on the veracity of the information provided).

According to the President of the Personal Data Protection Office (PUODO), an employer cannot independently contact a previous employer to obtain information about a candidate (references). This would only be permissible if the candidate has voluntarily consented to this (and the employer should be able to prove that consent was voluntarily given). Even if the candidate provides the reference on their own initiative, the employer is not entitled to contact the previous employer for additional information. According to PUODO, the employer is also not entitled to contact educational institutions to confirm the authenticity of the education data provided

Indeed, this limits the ability of employers to carry out background checks on their own, without the candidate's involvement, even with regard to personal data that the employer may obtain under the Labour Code. Even if the candidate agrees to certain background checks (such as contacting the university or former employer), unless the employee independently and on their initiative provides certain information, the carrying out of background checks by the employer is not without risks from a regulatory perspective, as there is a risk that the candidate's consent to the processing of personal data in connection with the background check may be deemed involuntary and, therefore, invalid under data protection legislation.

Background checks on criminal records

One of the most popular background checks that employers would like to carry out is the verification of a person's criminal record. Importantly, due to data protection legislation, an employer cannot process personal data of candidates/employees regarding their criminal records unless there is separate legislation that permits such processing (in the absence of such legislation, the prohibition of processing such personal data even on the basis of consent derives from the Labour Code), and only to the extent that such legislation permits such processing. Few provisions allow for criminal record verification.

An important exception is the Act of 12 April 2018 on the principles of obtaining information on the criminal record of job applicants and persons employed by entities operating in the financial sector. Under this law, it is possible, under certain conditions, to request criminal record information from candidates/employees. However, the employer should make a prior analysis to determine whether the provisions of this Act will apply to a particular employer at all (given the wording of the Act, this analysis may be relatively complex). Even if the provisions do apply in a particular case, they contain a number of restrictions on the criminal record verification process. An employer that is an entity operating in the financial sector may check the criminal record of candidates or employees if those persons are to work or are already employed in managing the entity's or a third parties' property, access to legally protected information, making decisions with a high risk of losing the entity's or third parties' property or causing other significant damage to the entity or third parties. In addition, employers may only verify criminal records for the offences specified in the Act.

***

As can be seen, the possibility for employers in Poland to legally carry out background checks is very limited. Before starting such checks, it is advisable to analyse whether and to what extent doing so will be legally permissible. In some cases, specific regulations may apply, such as work with children or work in the financial sector – which may result in some background checks being allowed (and in some cases even required), but only to the extent permitted by these regulations.

Karolina Romanowska

Łukasz Rutkowski