As the Facebook generation enters the workforce and competition for jobs increases, employers may be tempted to look into candidates' backgrounds. This is a risky strategy, says Timothy Pitt-Payne

Recruitment decisions are difficult. They are often taken under acute pressure of time. There are a number of legal risks, including the possibility of a discrimination claim from an unsuccessful candidate. If an unsuitable appointment is made, then the consequences can be very expensive, and on occasion disastrous. Employment vetting is about one specific aspect of the recruitment process: namely, identifying potential employees who present an unacceptable risk of serious harm to the organisation, or to its customers or service users. Vetting raises significant problems, not simply for employers, but for society as a whole. For instance, a balance needs to be struck between preventing individuals from having their careers blighted by unproven allegations, and protecting vulnerable groups (such as children, the elderly and disabled people) from the risk of financial, physical or sexual abuse.

The available methods of employment vetting range from the compulsory to the unlawful. Techniques include asking for references, carrying out Criminal Records Bureau (CRB) checks, ensuring that prospective employees are not on any statutory barring list, and the use of employment blacklists. There may also be issues (not dealt with in this article) about checking immigration status and ensuring that a candidate is entitled to work in the UK. The vetting system is currently undergoing fundamental reform, with the phased implementation of the Safeguarding Vulnerable Groups Act 2006.

References are used in recruitment in radically different ways. Some employers use them as a part of the selection process itself, to be considered in conjunction with other evidence in deciding who is the best person for the job. Other employers do not take up references until a provisional appointment decision has already been made. Used in this way, references are a form of vetting; they are a tool for identifying any potential problems with an apparently suitable candidate.

CRB checks will be very familiar to those working in fields such as education or healthcare. The relevant legal framework goes back to the Rehabilitation of Offenders Act 1974. This established a general rule that employers are not entitled to ask candidates about "spent convictions"; the Act defines the time after which a conviction becomes spent, by reference to the seriousness of the offence. However, a 1975 Order made under the 1974 Act sets out a series of exceptional situations where it is permissible to ask about spent convictions. For the most part, the exceptions relate to individuals who are applying for posts working with children or vulnerable adults.

The CRB provides a mechanism for employers to obtain information about spent convictions, if so entitled. The Police Act 1997, which governs its work, provides for three levels of disclosure. There is 'basic' disclosure: this consists of an individual's criminal record, excluding spent convictions. Currently the CRB does not offer basic disclosure (although Disclosure Scotland, its Scottish counterpart, does provide this service). Secondly, there is 'standard' disclosure; this covers all convictions, whether spent or unspent. And finally there is 'enhanced' disclosure, which covers the same information as standard disclosure, together with other information that relevant police forces in the exercise of their discretion consider should be disclosed. About 90% of CRB checks are enhanced disclosures.

Enhanced disclosure is the most problematic of these three options. It involves the disclosure of what is sometimes termed 'soft intelligence' – information about allegations that have not led to a conviction, or possibly that have not even led to a criminal trial. For example, in the 2004 judicial review case of X v West Midlands the Court of Appeal upheld a CRB-enhanced disclosure about allegations of indecent exposure, even though the individual had been acquitted after the prosecution chose not to proceed at trial. An employer who receives soft intelligence as part of an enhanced CRB disclosure has to make an extremely difficult judgement as to how much weight to put on it. The temptation, inevitably, will be to err on the side of caution and not employ the applicant. An individual about whom such information is disclosed is placed in an unenviable position. There is no statutory right of appeal against the decision to include the information, and the courts have been reluctant to interfere with the police exercise of their discretion by way of judicial review (as illustrated by the outcome of the West Midlands case). It is very hard to see what practical steps an individual in this situation can take in order to clear his name.

Alongside the system of disclosures, a series of statutory lists are maintained of individuals who are banned from particular kinds of employment. There is a list of those prohibited from teaching in schools; this is maintained under the Education Act 2002, and is often known (for historical reasons) as 'list 99′. Secondly, there is a list maintained under the Protection of Children Act 1999 (the POCA list), barring individuals from other work with children. And thirdly, there is the POVA list, maintained under the Care Standards Act 2000, and covering people considered unsuitable to work with vulnerable adults. The CRB does not itself decide who should be included on these lists, but it does provide a 'one-stop shop' whereby employers in these fields can check whether applicants are included on the relevant banned list, at the same time as obtaining standard or enhanced disclosure.

From an individual's point of view, inclusion on a banned list is more serious than having adverse information included in a CRB disclosure; employment in the particular field in question is prohibited, with no room for an employer to exercise its own judgment. On the other hand, inclusion in a banned list does at least give rise to a statutory right of appeal (formerly to the Care Standards Tribunal, and now to the Health, Education and Social Care Chamber of the First Tier Tribunal).

The Safeguarding Vulnerable Groups Act 2006 will make radical changes. The Act will be brought into force in stages over the next five years. It provides for a new body, to be called the Independent Safeguarding Authority (ISA). So far, the ISA has taken over the function of making new decisions as to who should be placed on the three existing banned lists. With effect from October 2009 those lists will be replaced by two new lists, for those working with children and with vulnerable adults respectively.

There will also be a requirement for those who carry out specified work with these groups (whether for payment or as volunteers) to register for monitoring with the ISA, enabling the ISA to keep their status under regular review; this requirement will be implemented in stages, and will cover the whole of the relevant workforce by 2015. According to the Government's own figures, when the ISA scheme is fully operational it will have about 11 million members, amounting to some 25% of the adult population. Clearly, the impact of the scheme will be very widespread indeed. It is often suggested that the requirement to undergo CRB checks is a deterrent to various forms of voluntary work; to the extent that this is the case, the ISA scheme is unlikely to improve matters.

Consulting statutory barring lists is mandatory for the relevant employers. By contrast, some methods of employment vetting are not only voluntary, but also potentially unlawful. There was considerable publicity in March, when the Information Commissioner's Office (ICO) took enforcement action against a company operating a blacklist in the construction industry, effectively shutting down its operations. The business had apparently been in existence for some 15 years, and its blacklist included about 3,000 individuals. Entries included information about personal relationships, union activities and previous employment. The ICO took action on the basis that maintaining the list was a breach of the Data Protection Act 1998. It is highly inadvisable for employers to make use of a service of this nature. Besides the obvious unfairness to job applicants, there is also the potential for significant reputational damage to users of the service. Indeed, if maintaining the blacklist is unlawful as being in breach of the Data Protection Act, then there is a serious risk that its users are themselves breaching the Act.

Finally, modern methods of employment vetting can be rather more informal than any of the above. As the Facebook generation enters the workforce, we will doubtless see employers searching the internet for evidence of drug or alcohol abuse, political extremism, or even an intention to start a family in the near future. This is a risky approach. An employer who trawls the internet as part of his due diligence on job applicants may find himself faced with a mass of information, the value of which is very difficult to assess, and some of which will amount to nothing more than gossip. If personal information is discovered and taken into account, then – depending on the nature of the information – there could potentially be grounds for a discrimination claim by a rejected applicant. Any employer who goes down this route should proceed with very great caution.

Timothy Pitt-Payne is a barrister at 11KBW, specialising in employment and public law.

Click here to comment on this article.