The first part of the Data Protection Code for Employers has been published. It covers Recruitment and Selection. Go to the site for the Information Commissioner, and click on “Codes of practice our responses & other papers”, then on “The Employment Practices Data Protection Code: Part 1 Recruitment and Selection Mar02”. The other three parts of the code are Employment Records, Monitoring at Work, and Medical Information.

Diane Sinclair, Adviser on Employee relations at the CIPD commented on the Code: “While we welcome the guidance on the Data Protection Act in relation to recruitment and selection, the code is still not clear about what is necessary to comply with the law and what, in the information commissioner’s view, is good practice. The code is intended to be used by all organisations, both large and small. It is likely that it would have had a bigger impact if it had been more concise, and therefore more user friendly. This is only the first of four parts of the code, so employers have a lot to get to grips with. We urge the Information Commissioner to make the remaining three parts of the code clearer to employers.”

We reproduce the notes on the Code’s implications below.

The Employment Practices Data Protection Code is written primarily for businesses where the employment of staff constitutes a significant activity. Much of the Code, though, will be applicable to any employer. Not every aspect of the code will be relevant to every organisation. This will vary depending on the size and the type of business that is conducted. Particularly for small businesses, some of the issues addressed may arise only rarely. Here the Code is intended to serve as a reference document to be called on when necessary.

Why should you use it?
The Data Protection Act 1998, on which this Code is based, places responsibilities on any organisation to process personal data that it holds in a fair and proper way. Failure to do so can ultimately lead to a criminal offence being committed. The effect of the Act on how an organisation processes its information on workers is generally straightforward, but in some areas it can be complex and difficult to understand, especially if your organisation has only limited experience of dealing with data protection issues. The Code therefore clearly states what you need to check, and what action, if any, you need to take. Implementing it should produce other benefits in terms of the organisation’s relationship with workers, compliance with other legislation and efficiencies in storing and managing data.

What is the legal status of the Code?
The legal requirement on employers is to comply with the Act itself. The benchmarks in the Code are however designed to bring about compliance with the Act. They develop and apply the Act in the context of employment practices. They are the Information Commissioner’s recommendations as to how the legal requirements of the Act can be met. Employers may have alternative ways of meeting these requirements but if they do nothing they risk breaking the law.

Any enforcement action would be based on a failure to meet the requirements of the Act itself. However
– relevant benchmarks in the Code would be cited by the Commissioner in connection with any enforcement action that arises in relation to the processing of personal data in employment
– disregard for the data protection requirements that particular benchmarks are designed to help organisations meet is likely to mean that an employer will not comply with the Act.

And a warning from the EU:
“Staff in charge of or with responsibilities for the processing of the personal data of other workers need to know about data protection and receive proper training. Without an adequate training of the staff handling personal data, there could never be appropriate respect for the
privacy of workers in the workforce” – EU Article 29 Committee