The GDPR in NI – Differences in Employment Record Retention Periods

The General Data Protection Regulations (GDPR) and the Data Protection Bill covers the UK as a whole.  The GDPR Principles require that personal data is kept for specified purposes.  The data should be limited and kept for no longer than necessary for the purposes for which the data was processed.  Determining the retention periods for employment-related data is central to compliance with GDPR. 

In due course, we are likely to see a new Employment Practices Code issued by the ICO which will likely provide guidance about retention periods.  However, when making decisions about retention periods it is important to have regard to some specific legislative requirements and guidance in Northern Ireland.  There are a number of important areas where there are differences with the rest of the UK.  These differences must be borne in mind when dealing with GDPR and in particular when determining the legal basis for processing under Article 6. 

There is a statutory obligation to monitor community background and gender in Northern Ireland. Thus, it is likely to fall within Article 6(1)(c) of GDPR (processing necessary for compliance with legal obligations).  Where additional monitoring is carried out, for example, disability and race; employers are likely to seek to rely on Article 6(1)(e) (processing necessary for the performance of a task carried out in the public interest) and/or in the private sector 6(1)(f) (processing necessary for the purposes of the legitimate interests of the data controller). 

Equality monitoring is specifically addressed in Schedule 1 paragraph 8 of the latest version of the Data Protection Bill which specifies “substantial public interest conditions”.  These include a “specified category of personal data which is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained”.  The categories specified are contained within paragraph 8(2) of Schedule 1.  It will be important to review the final version of the Bill when it has received Royal Assent. 

The following specific monitoring issues and retention periods should be borne in mind for GDPR purposes.

1. Fair Employment and Treatment Order

The Fair Employment and Treatment (Northern Ireland) Order 1998 (FETO) is unique to Northern Ireland.  All employers who employ 11 or more full-time employees (i.e. employees working 16 hours or more per week) must register with the Equality Commission.  Specified public authorities must also register with the Equality Commission. 

Registered concerns must monitor their workforce and submit an annual monitoring return to the Equality Commission covering employees, applicants, appointees and apprentices.  Public authorities and those who employ more than 250 employees must also monitor promotees and leavers. The Equality Commission recommends that all employers should monitor promotees and leavers.  Failure to submit a monitoring return is a criminal offence.  Employers must keep a record of community background i.e. whether the person is from the Protestant Community or the Roman Catholic Community in Northern Ireland or neither. 

Regulation 17 of the Fair Employment (Monitoring) Regulations (NI) 1999 requires an employer in a registered concern to retain the following:-

a. Written information obtained for making a determination and a record of the determination made by him respect of any such person until the expiration of 3 years from the date on which the person to whom the information of determination relates ceases to be employed in the concern.  Failure to comply is a criminal offence.  This means the monitoring form completed by the individual must be retained as well as the determination made about the person.

b. A similar 3 year period is required in relation to monitoring information about applicants and this is for a period of 3 years from the date of the application. 

The Monitoring Regulations specify the monitoring questions that must be asked.  If the person does not respond to the monitoring question they are recorded on the basis that their community cannot be determined.  However, the employer may then apply the “residuary method” which enables the employer to use information it holds about the person to make a determination of community background.  The information is specified in Regulations and includes surname; address; schools attended; sporting or other leisure preferences and clubs/societies. 

In order to utilise the residuary method, many employers use application forms and/or CV information.  Because this is the information which has been used to make a determination under the residuary method it must be retained for the 3 year periods specified above. 

2. General Monitoring

The Equality Commission also recommends monitoring by age, disability, racial group, marital status, civil partnership status, sexual orientation, and those with dependants/caring responsibilities.  Clearly, this data is both personal data and special category data. Therefore, requests for monitoring information will require privacy notices which explain clearly how the data will be used, how long it will be retained and all the data subject’s rights. 

3. Gender Pay Gap Reporting

Section 19 of the Employment (Northern Ireland) Act 2016 introduces the principle of gender pay gap reporting but unlike GB it also covers reporting by ethnicity and disability.  Furthermore, unlike GB it also covers workers, not just employees.  It will be a criminal offence to fail to report or to report inaccurately, punishable by fines of up to £5,000 per employee. No Regulations have been issued yet to bring the provisions into operation in Northern Ireland. It is unclear whether the number of employees/workers which will trigger a reporting obligation will be 250 -there is some suggestion it may be a lower figure - which can be set out in the Regulations when they are published and passed. It is uncertain how the reporting obligations in relation to ethnicity and disability will be specified, but clearly, it will be important to retain the information on which the reporting is based for a reasonable period, in case of prosecution. Privacy Notices may need to be amended to deal with the new regulations when issued. 

4.  Recommended Practice on Equality Retention Periods

The Fair Employment Code of Practice and the Equality Commission’s Unified Code recommend retaining shortlisting and interview records for at least 12 months.  Many employers, however, retain their information for longer periods in order to comply with their review obligations under Article 55 of FETO. 

Under Article 55 each registered concern must at least every 3 years review the composition of its employees and leavers, together with its employment practices, for the purposes of determining whether members of each community are enjoying and are likely to continue enjoying, fair participation in employment.  Therefore, many employers retain selection information to assess fair participation particularly if they are concerned about success rates.  Under GDPR this practice will need to be reviewed.

5. Safeguarding and Vetting

The Safeguarding regime in Northern Ireland is quite different to that which applies in England and Wales.  Records checks and appropriate disclosure of criminal records information is handled by Access NI while the Disclosure and Barring Service (DBS) maintains the barred lists, in contrast to England and Wales, where the DBS carries out both functions. 

Privacy Notices will have to explain how records information from Access NI will be used and stored.  Access NI and the DBS have issued new guidance on checking ID for records checks and they are slightly different in content.  The portable disclosure service that applies in England and Wales does not yet apply in Northern Ireland. 

6. Criminal Records Information

Obtaining and retaining criminal records information is sensitive in Northern Ireland, not just for GDPR reasons but also due to the political issues which may arise.  The Equality Commission in its publication Support for Businesses Recruitment and Selection Policy and Procedure provides has guidance on seeking criminal record information on application forms: 
http://www.equalityni.org/Publications

It suggests text which is appropriate where an employer has discretion to employ individuals who have criminal records.  However the Commission stresses the need to change the text if the business is a regulated activity for the purposes of Safeguarding. 

Rehabilitation periods in Northern Ireland are considerably longer than those which apply in England and Wales.  For example in Northern Ireland  for a custodial sentence of between 6 and 30 months the rehabilitation period after which a conviction is considered spent is 10 years, whereas in England and Wales it is 4 years.  A sentence of imprisonment of up to 6 months is 7 years in Northern Ireland, whereas in England and Wales it is 2 years.

It is important for employers to be aware of these and other differences when making commitments to remove any details of spent convictions from employment records.