• Find us on:

Personal information about criminal convictions and offences

In Re an application by Lorraine Gallagher for Judicial Review, the Supreme Court has ruled that the Disclosure and Barring Service (DBS) rules are  disproportionate because they require disclosure for multiple offences, even if they were minor, and fail to distinguish between warnings or reprimands given to juveniles and convictions. Read more ….

[see  How to survive a criminal charge, conviction or police caution at work, Personal information about criminal convictions and offences, Working or finding a job with a criminal record, The Disclosure and Barring Service, Is it fair to dismiss an employee who has been charged with a criminal offence, but not convicted?]

Special Types of Data

Schedule 1 DPA 2018 deals with the special categories of data and criminal convictions. Criminal convictions data is a special type of data under DPA 2018. It includes personal data about committing the alleged  offence, proceedings for the offence and sentencing.

Article 9(1) GDPR prohibits processing of special categories of personal data except in the circumstances set out in Article 9(2). Article 10 only allows processing of criminal convictions and offences data if it is under the control of official authority or it is authorised by member state law.

Criminal Convictions or Offences

Article 10 GDPR says:

“Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.”

Article 10 of the GDPR provides that data relating to criminal convictions or offences must be processed on one of the lawful grounds for processing under Article 6.  The grounds for processing such information are in Section 10(5) and Schedule 1 (Part 3) DPA 2018.

An employer must take the following steps in order to access information about a persons criminal convictions or offences.
  1. Obtain the consent of the employee GDPR Article 6(a).
  2. The processing must be necessary because of the employers legal obligations GDPR Article 6(c).
  3. The employer must have a Data Protection Policy which sets out their  procedures for complying with the data protection principles, retention and erasure of personal data and how long the personal data will be kept for.
  4. The employer must adhere to the additional safeguards in Schedule 1(Part 4) DPA 2018.
  5. DPA 2018 implements the provisions of GDPR by allowing processing of special categories of personal data and criminal conviction data in the following circumstances;
  • Where employers have to obtain the information for employment law reasons.
  • Where journalists have to expose wrongdoing.
  • To prevention and detect unlawful acts.
  • To protect the public from dishonesty or prevent fraudulent activity.
  • Where a financial services firm suspects money laundering or terrorist financing.
  • To identify or eliminate doping in professional sports.
  1. Special Categories of Data
  2. Section 10(1) to (3) DPA 2018 allows processing of special categories of personal data in the following circumstances:
  • Employment, social security and social protection.
  • Substantial public interest.
  • Health and social care.
  • Public health.
  • Archiving, research and statistics.
  1. Under Section 10(2) one of the additional conditions in Part 1 of Schedule 1 DPA 2018 must also be met before such processing would be considered lawful. Under Section 10(3) personal data processing will only be necessary for reasons of substantial public interests if it meets one of the public interest conditions in  Schedule 1 (Part 2) DPA 2018.

Updated: 07/04/2020


The information and content on this website is provided for general information purposes only and is not intended to constitute legal or other professional advice. Legal information or content on this website relates only to the laws of England and Wales. You should not take any actions based on information found on this website without first seeking appropriate legal advice with respect to your specific matter. No representations or warranties are made about the suitability, currentness, comprehensiveness and/or accuracy of the information and other content contained on this website. It should be noted that legal information and content can rapidly become out of date and we give no undertaking to keep this website up to date. All liability for any loss or damage of any kind which may be suffered as a result of accessing and using the information and/or content of this website is hereby excluded to the full extent permitted by law.