Online recruitment: Legal issues

Steps to take to avoid problems

As an employer, when you recruit directly from your organisation's website you need to make candidates aware of their rights and duties.

When you use an external online recruiter, they take on this responsibility. However, you do need to be aware of the kinds of legal and ethical issues that might arise during the online recruitment process, so that you select a responsible third party even if you are not directly involved. Find out if the online recruiter is a member of the Association of Online Recruiters as this will ensure they adhere to certain minimum standards.

There are a range of potential problems when using your web site to attract job candidates. Among the issues worth reviewing are the danger of unscrupulous agencies copying details of vacancies to re-advertise them, fictitious job applicants posing as candidates to find out which vacancies exist, liability to candidates suffering loss due to unscrupulous use of their CVs by third parties or otherwise, the malicious or unscrupulous sending of information including offensive information of any kind which clogs up the website, and the use of copyright materials (belonging to third parties to you).

So what do you need to do to avoid legal liability or damage to your organisation caused by any of these issues?

If you are recruiting through your own website, when you set it up, make sure you include statements making applicants fully aware of the terms on which they submit their details before they do so.

Make it clear that job applicants must be genuine jobseekers applying in person and that, while safety mechanisms (such as encryption) should ensure supplied material is not misused by third parties, you will not be responsible to candidates if this happens.

Also make it clear that the removal or unauthorised use of copyright material and clogging up and/or the use of offensive materials on the website are prohibited.

Contract of employment issues

The same rules apply to online recruitment as to other forms of recruitment when you make a formal offer of employment. An employer becomes bound by contract as soon as the candidate accepts an unconditional offer. The offer need not be in writing to be valid - for example, the verbal acceptance of a verbal job offer also leads to the formation of a contract.

Once someone accepts a job offer, they have legal remedies against you, as the employer, if the offer is subsequently withdrawn. These include wrongful dismissal, and possibly unfair dismissal and discrimination claims.

Practical steps

Take as much care with online recruitment as with the non-electronic method.

When using an online recruiter, you should clearly identify who in your organisation is authorised to make job offers and how any offers will be made (in writing, via e-mail, on the telephone), and ensure the online recruiter is not authorised to make verbal job offers or unauthorised representations. And remember to always keep a paper record of any job offers, as well as acceptance and rejection letters.

The Data Protection Act

The Data Protection Act (DPA) sets out rules for processing personal information and covers both manual and automated information, including information held on computer and any other automatically processed information. The DPA is relevant to data which employers might keep about workers, employees and job applicants for jobs of any kind, whether or not successful.

The key issues covered by the DPA in relation to recruitment and in particular online recruitment are: security of information and the privacy of candidate information; the requirement to get consent to process sensitive personal information; passing information to third parties and outside the EU, automated processing and retention of records.

The role of the 'data controller'

The DPA introduced the concept of a data controller. This the person or organisation which determines why and how any personal data are to be processed. In the case of online recruitment, the identity of the data controller can change. It could be the online recruiter until the information is passed to the employer and become the employer after that. It depends on who is doing what with the information and what you agree with the online recruiter about the allocation of responsibilities.

If you don't have an agreement, you, as the employer, will be the data controller even if the online recruiter processes information on your behalf. So it is sensible to agree who has data controller responsibilities and to ensure that these are properly addressed in any contract.

The DPA Code of Practice

In March 2002, the Information Commissioner published a Code of Practice in relation to recruitment and selection, which sets out benchmarks to help employers to comply with the DPA. This is Part I of the Employment Practices Data Protection Code.

The Code of Practice covers eight areas:

This code is not legally enforceable, but a breach of the code implies a breach of the DPA. It is always open to an employer though to demonstrate compliance with the DPA by other means. However, it is important to be fully aware of the benchmarks, because if you should fail to comply with the DPA, you are leaving your organisation open to enforcement action by the Information Commissioner and, potentially, civil and/or criminal liability.

The section of the code which deals with job applications specifically states that this applies to paper and online applications.

What are the Code of Practice benchmarks for compliance?

First, job advertisements and any application forms should clearly state the name of the organisation to which applicants will be providing their details. (The DPA requires that generally details should not be passed to third parties or outside the EU without consent.) And if you intend to use the applicant's information for any non-obvious purposes, for example to market goods or services, you should specify this at the outset.

Questions on application forms must be limited to only those necessary to recruit for that vacancy.

You must not ask any questions relating to sensitive personal data (which include those relating to criminal convictions, health or trade union membership), unless they are fully justified. In the case of criminal convictions, you must make it clear that spent convictions do not have to be disclosed (unless a statutory exception applies).

If any checks to verify information are to be carried out, this should be explained to the candidate along with details of any sources you will approach.

Once information has been provided, it must be kept securely. For example, if you send online applications you should use encryption and you should restrict access to returned application forms. If an online recruiter falls foul of these benchmarks, it will be acting unlawfully if it sends any of the information to the employer and an individual could ask the data controller to stop processing the information.

The DPA and automated decisions

Under the DPA, if the employer or online recruiter eliminates applicants on the basis of a computerised scan for certain requirements and there is no comeback on that decision for those eliminated, they must be informed about the automated process before they apply and they will have the right to have any decision reviewed.

Retaining records and the DPA

The other key aspect of the DPA affecting online recruitment is record retention. Essentially the DPA requires a balance between the reasonable requirements of the employer to retain records, balanced against the right to privacy for the individual. All information no longer relevant should be deleted or destroyed.

You may wish to retain records of unsuccessful applications to ensure you can defend the organisation should claims be made against you, for example for discrimination. The time limit for bringing a discrimination claim is three months from the date of the discriminatory act so it is reasonable to retain applicant details for three months from the date the successful candidate is appointed. If you intend to retain applications for review against further vacancies, you should ask candidates first.

If you are going to retain details you must hold them only as long as they will be relevant to future recruitment. Information obtained in the vetting process should be destroyed as soon as possible or within six months in any event. Information that relates to criminal convictions generally should be destroyed as soon as it is verified (by the Criminal Records Bureau). In the case of employees, information on criminal convictions can only be retained if relevant (for example, in the case of people working with children).

Practical steps

Ensure that data controller responsibilities are allocated appropriately and review your online recruitment process against the DPA Code of Practice benchmarks. For candidates who have been rejected by automatic systems, provide a right of review. And set up a housekeeping process to ensure record are not kept any longer than necessary.

Discrimination law

The Sex Discrimination Act 1975 (SDA), Race Relations Act 1976 (RRA), and the Disability Discrimination Act 1995 (DDA) apply to all recruitment processes and employers need to consider potential discrimination which could arise from online processes in the areas of sex or marital status, race and disability.

On top of this, the Government consultation paper Equality and Diversity: Making it Happen was published in October 2002, together with draft regulations to widen the scope of UK equality legislation in line with European directives on race and employment. In particular, the scope of current anti-discrimination legislation will be broadened to include sexual orientation, religion or belief, disability and age.

The proposals on sexual orientation and religion are due to come into force in December 2003. New disability regulations are due to come into force on 1 October 2004, and there will be measures against age discrimination in 2006.

Employers need to bear all these requirements in mind when reviewing their use of online recruitment. For example, all jobs available online should also be available to applicants sending in paper-based applications if they are unable to use online facilities due to disability or another legally protected reason. You should also review job advertisements and the reasoning behind any automated processing for potential discriminatory effects.

There are several ways you could fall foul of the requirements when deselecting candidates.

Practical steps

Applicants should not be penalised for not having English as a first language unless it is an essential job requirement.

Pregnancy cannot be used as a reason for de-selection, even if all the other applicants are female and if the position is short-term and the prospective employee is likely to be absent from work during the employment due to the pregnancy.

Applicants should not be deselected just because they have worked part-time or in short-term positions or because they have had career breaks.

You should review age-related decision-taking to work towards compliance with new legislation in 2006, even though age-related discrimination such as a requirement for a 'young and dynamic‚ new employee' is currently permitted.

You should not use disability (and assumptions about the impact of that disability on a person's ability to do a job) as criteria for de-selection.

If applicants are required to produce evidence of their entitlement to work in the UK, such as a passport, this must be applied to all applicants who reach that level of the recruitment process.

If you recruit from specific racial groups, aiming for cohesion of a team of employees, this may amount to unlawful discrimination on the grounds of race.

It is also unlawful to discriminate on account of membership of a trade union. However, positive action to address imbalances may be permitted in the context of sex discrimination.

The proposed conduct of employment agencies and employment business Regulations

Existing legislation in this area dates from the 1970s and does not affect the current activities of online recruiters unless their activities equate to those of employment agencies (as opposed to little more than job notice board providers). But the Government is proposing new regulations to update the current provisions.

This legislation covers: fees; requirements to be satisfied before services are provided; requirements to be satisfied in relation to the introduction or supply of a work-seeker to a hirer; and the contractual relationship between the agency and the worker.

As drafted, the proposed regulations could catch the operation of online recruiters, even those arguably providing no more than a job notice board. However, the employment relations minister recently suggested that online recruiters could be excluded. This was welcomed by the industry which claimed the need to identify all applicants through face-to-face meetings or passports and birth certificates and the need to have access to copies of all claimed qualifications would have put them out of business.

The current regulation of employment agencies is contained in the Employment Agencies Act 1973 (EAA). It covers the activities of businesses providing temporary workers as well as full-service employment businesses designed to find work for employees or workers for employers.

The EAA and associated regulations set out minimum standards of conduct. These include: ensuring adequate information is obtained from employer and applicant; non-disclosure of information about employers and workers (except for the purpose it was given) without written consent; ensuring workers have the right qualifications; making applicants and employers aware of legal conditions; and not approaching employees to work with another employer without agreement of the current employer.

There are also prescribed conditions about fees and terms of business, advertisements and dealing with young people.

Contractual issues between employers and online recruiters

If you are using an external online recruiter, make sure there is a clear contract which sets out mutual responsibilities. This helps the employer to keep control of the process to the extent required; allows matters to be ironed out up front, reducing the scope for later disputes; and helps the employer to get best value for money from using the online recruiter.

The responsibility for what is put into job advertisements belongs to the employer, and you need to be specific about how long a job is to be available on a website and how much communication takes place between the online recruiter and any applicants.

The online recruiter should have liability for wrong information or copyright issues unless these issues arise because of specific requirements of the employer.

You also need to establish whether the online recruiter should have DPA liability as data controller and at what stage this becomes your responsibility as the employer. So it is important to clarify with the online recruiter how the process will work and the amount of input and control you wish to have.

Whatever you agree, you should demand maximum security to be observed by recruiters at all times. And you should regularly review the basis of automated decisions to ensure compliance with legislation and make it clear that the online recruiter is liable for lost applications.

Commercial terms of business

Commercial terms of business, such as payment terms, the complaints process and any termination arrangements should be agreed in advance and should also include:

Sources

www.dataprotection.gov.uk

www.cre.gov.uk

www.eoc.org.uk

www.erc-gb.org

www.aolr.org/html/code.htm

www.dti.gov.uk/er/agency/reg.pdf