This Month's Challenge
Outside the U.S., getting a routine pre-employment background check is anything but routine.

Best Practice Tip of the Month
Investigate local laws and practices before you ask applicants to sign consent forms.  U.S. practices may not work abroad.

Fundamental Differences in Legal Framework Mean Employers Should Think Twice Before Conducting Background Checks Abroad

 

In the United States, pre-employment background checks are common—almost everyone confirms prior employment and education, and many employers check criminal history and credit reports.  According to one recent survey, more than 85% of employers conduct pre-employment background checks and more than 2,000 companies have sprung up to meet this growing need.  Indeed, some U.S. employers have faced lawsuits from injured third parties claiming that an employer was negligent in hiring a dangerous employee whose predisposition to misconduct would have been revealed by a background check.

Outside of the United States, however, the laws and the practices vary widely.  In many countries, information that U.S. employers routinely obtain is not legally accessible or, even if it can be requested lawfully, it is not readily available or easily usable.  As with many HR issues, the U.S. employer engaging workers abroad cannot assume that U.S. laws and practices apply, and the prudent HR executive will inquire about local laws and practices.

Notably, the U.S. has no broad-based data privacy law—unlike every European country.  The federal Fair Credit Reporting Act permits employers to obtain credit and other personal records, provided certain procedures are followed.  Although fears of defamation and discrimination suits have made employers increasingly reluctant to give detailed references for former employees, confirmation of dates of employment and positions held is commonly provided.  Records of military service, education and criminal convictions are also readily available.

Other countries, however, generally do not have laws like the FCRA.  Instead, other countries regulate background checks via a completely different framework—mostly data privacy laws and laws prohibiting or regulating the government's ability to release criminal records.

Abroad, the legal issues regarding pre-employment background checks are, for the most part, the same as with credit checks and other personal data:  Data privacy laws regulate employers' ability to obtain information about prospective employees, as well as the use to which information obtained for employment purposes can be put.  Once a prospective employer receives background check data, privacy laws are triggered.

In many contexts, a way around data privacy laws is with a consent form signed by the applicant.  However, in the employment context, in some data privacy countries, even applicant consent forms can be of limited use, because the data privacy laws are so strict that they assume consents collected in the employment-application context are not freely given (because applicants know that if they do not give consent, their applications will be rejected) and are therefore invalid.

European interpretations of data privacy law on the validity of applicant consents vary widely.  In Germany, Belgium, France, and the Netherlands, especially, data privacy laws are seen as making background checks all but illegal, and applicant consents all but void.  In other European countries though, interpretations are
not so severe. 

In all EU countries, data privacy laws limit the information respondents can legally give the employer.   For this reason, even if an employer engages a third-party vendor to conduct a background check, in many countries, the type and amount of information available will not be meaningful and useful to the employer in assessing a candidate.  In those countries where applicant consents are void, it is generally acceptable to require the applicant him/herself to provide certified background data.  In many countries, procedures are set up for the applicant to visit the local police station and obtain a copy of his or her criminal record (or lack thereof) to provide to the prospective employer.

Employers should also remember that where data privacy laws apply, sending protected data  out of the country—including data obtained from a pre-employment background check—is generally prohibited, even if the data are being sent to the company's headquarters in the U.S.  Even inputting the data into a computerized data base that could be accessed from the U.S. may violate data privacy laws, unless a "model contractual clauses" agreement, "safe harbor self-certification," or a "binding corporate rules" code of conduct has been approved, or "unambiguous" consents to sending data outside of Europe is "freely given"
by every affected applicant.

In Asia, employers often engage the services of agencies to conduct background checks, although the categories of information these agencies can obtain varies—as well as the legality of the search.  For instance, in Japan, commercial services are often able to use informal channels to obtain information about criminal convictions, even though these records are generally off-limits to third parties.  Therefore, a prudent multinational employer will take care in selecting a reputable agency and require the agency to remain within the bounds of the law.   In the Philippines, background checks by private investigation companies for employment purposes are common, and criminal records are easily obtainable if the background check company has connections with the government agencies that keep the records.  In India, where law enforcement agencies do not yet have a centralized database where all information about an applicant's criminal background would be available, most outside agencies possess the resources and the ability to verify criminal histories.  

In South Korea, however, formalized background checks are unusual.  Background checks and verification of employment history are essentially prohibited.  There are, nevertheless, "consultancies" that will perform background checks; multinationals operating in Korea are more likely to engage these services to conduct checks than local Korean employers.  Similarly, in China, although criminal conviction records are generally reliable, access to them is strictly limited, and outside agencies are rarely used to obtain criminal histories or other records in China.  An employer can easily verify a Chinese applicant's educational history, however—any degree can be verified on a centralized Web Site.  In Singapore, employers typically require an applicant to disclose all requested information and provide supporting documentation (although supplementary background checks are usually performed by a commercial service).  Taiwan has a similar practice—there, the local practice for obtaining background information is to ask the applicant to obtain a criminal record certificate (though this practice is not common), a "certificate of employment" from past employers, and copies of any diplomas. 

As to any background data an employer does collect, the following guidelines are generally advisable (and in some cases legally mandated):

• "Process" background data received "fairly and lawfully," for a legitimate business purpose, and only process/store data "adequate and relevant" to business needs
• Ensure background data are stored securely
• Refrain from giving background data to others (no "onward transfer")
• Tell applicants what background data about them are being collected
• Make background data collected available to an applicant who requests them, pursuant to established procedures
• Offer a dispute-resolution mechanism in case a dispute arises over handling the background data
• Purge background data after the employer no longer has a business need to retain them
• Disclose background-check data systems, along with other personal data processing, in annual bureaucratic data-systems filings in countries that require filings (including, for example, France, Germany, Netherlands, U.K., Spain)

Besides data privacy laws and prohibitions on the release of criminal records, other legal barriers to pre-employment background checks include laws that require an employer to notify the "works councils" (worker representatives) about pre-employment background check procedures.  Usually this notice need only be given once.  It will also be necessary to discuss procedures with the works council, if requested.

Conclusion

It is imperative that employers develop a global strategy in conducting background checks and recognize that the common U.S. practice of having a background check agency obtain detailed information on each applicant is more the exception than the rule.