PREFIT logo
Don’t use “the Data Protection Duck Out” to avoid appropriate staff vetting
Amid tight security, The Met Police and SOCA (The Serious Organised Crime Agency) joined forces with PREFIT and some of the UK’s key employers for talks on continuous and retrospective staff screening.

In the first event of its kind, Assistant Information Commissioner, Jonathan Bamford, told SOCA’s packed briefing room: “Employers sometimes mistakenly use the Data Protection Act as an excuse to not screen staff when they could do, as long as they do it properly. I call that ‘the Data Protection Duck Out’.”

A long standing obstacle to staff vetting
Security and vetting professionals have always had to deal with a lack of knowledge and even misquoting of the Data Protection Act (DPA) amongst employers. David Chernick, Chair of PREFIT, welcomed the Assistant Information Commissioner’s guidance. “All too often, recruiters wrongly cite data privacy, employment, and even human rights law as reasons why they can’t screen staff. Thankfully, we now know for sure that employers can screen during recruitment, and again during employees’ tenure, as long they do it in the right way. That's good to know because when we investigate employee fraud, we find that 87% is perpetrated after the first two years of service.”

Staff screening is an obligation, not a right
But the talks didn’t end there. Richard Smith, PREFIT’s head of events also called on legal advice from Stewart Room, a partner with London City Law firm Field Fisher Waterhouse, and author of Data Security Law and Practice. Stewart, whose data protection and privacy prowess is recognised as being at the forefront of the field (Legal 500), went further. “Vetting staff is an obligation, not just a right.

The Seventh Principle of the DPA, on information security, requires organisations to ensure the reliability of staff who process or control data.”

Reducing harm caused by insiders
Detective Chief Superintendent, Nigel Mawer, who devised Operation Sterling, the Met Police’s strategy for combating economic crime, said of the talks “The PREFIT forum has overcome a long standing hurdle in the fight against insider crime by informing employers that the Data Protection Act does not prevent vetting.

“Poor screening is a key enabler of economic crime and I strongly encourage all employers to carry out appropriate and lawful pre-employment, retrospective and continuous screening of all their staff so that all threats to company and personal data from internal sources are eradicated”

The future
Commenting on the success of this event, Richard Smith said “We’re delighted that today’s talks attracted such overwhelming interest and support, and that feedback from participants was unanimously positive. In the coming weeks we’ll announce further plans, for example, to tackle more legal issues, temporary and contract worker security, staff criminality and probity.”

November 2009

About Operation Sterling
Sterling is the Metropolitan Police initiative to tackle Economic Crime. By working together with individuals and organisations, from all levels of the private and public sectors, Sterling aims to reduce the harm caused by Economic Crime. Innovative new techniques are being developed to prevent, disrupt, and prosecute fraud related offences.

The Sterling prevention unit is part of the Economic and Specialist Crime OCU (SCD6).

www.met.police.uk/fraudalert

About SOCA
SOCA is an intelligence-led agency with law enforcement powers and harm reduction responsibilities. Harm in this context is the damage caused to people and communities by serious organised crime.

Two of SOCA’s aims are:

www.soca.gov.uk

 

 

 

 

 

Data Protection staff screening guidance
The Information Commissioner’s Office gave
employers eleven key questions about screening
to check that policies comply with the DPA:
  1. Is it justified?
  2. Are you open about it?
  3. Are the sources reliable?
  4. Is the information itself reliable?
  5. Is it the minimum information necessary?
  6. Can information be challenged by the individual?
  7. Is it recorded properly?
  8. Is it used only for a limited purpose?
  9. Is it not disclosed inappropriately?
  10. Is it not retained longer than necessary?
  11. Is the information held securely?