Job vetting practices may breach Privacy Act

The Privacy Commissioner warns that employers and vetting agencies may be breaching the Privacy Act with some practices of collecting and storing information about job applicants.

Commissioner Marie Shroff was responding to questions from NZPA about consents the Tertiary Education Commission (TEC) seeks from applicants for 24 new positions being advertised as part of its restructuring.

Application forms ask job seekers to sign consent for Resume Check Ltd to carry out background, resume and reference checks, and for "any relevant third party" to provide information to Resume Check about them.

Whether they are successful or not in their application for a TEC position, they are also asked to agree to Resume Check holding their information indefinitely for future pre-employment vetting.

While declining to comment on the conditions imposed by the TEC or Resume Check, Ms Shroff said job applicants had "little real choice but to sign the forms vetting agencies ask of them".

But she was concerned by instances where employers or vetting agencies were requiring applicants to give authority for wide collections of personal information from any source.

"And I am concerned that this information is then being held indefinitely," she said.

"While it may be technically correct that an agency can collect information from any source, if they have gained consent from an applicant, it is not in line with the spirit of the law.

"I am concerned about collections of information that are wider than necessary. Potential applicants should be made aware of exactly who is approached for information about them.

"A vetting agency is collecting information about an individual to assess their suitability for a position. If that person is not found to be suitable, then there is no longer a lawful purpose for them to retain that personal information.

"In this context, there would be few legitimate business reasons to retain information indefinitely. And the longer information is retained, the more likely it is that it may be used for another purpose, or be lost or become out of date. All of these place the agency at risk of breaching the Privacy Act."

Resume Check says it strictly adheres to Privacy Act obligations and managing director James Sutherland told NZPA if job candidates requested their retained personal information to be destroyed, "we do so".

But the conditions on the TEC job application form, which also apply to Resume Check's contracts with other public and private sector employers, do not say anything about applicants' ability to request information being destroyed. Nor is it mentioned in the privacy policy on Resume Check's website.

The company says it stores candidate personal information electronically, using the "most up-to-date encryption and IT security software" with "only authorised and background-screened Resume Check consultants" having access.

However, Ms Shroff said where vetting agencies were collecting information on behalf of a government department or company, it would seem more appropriate for the information to be retained by the employing department or company.

Asked how Resume Check could guarantee to job applicants it vetted that their stored information was used only for pre-employment screening, Mr Sutherland said job candidates were fully advised how their personal information was collected, stored and disclosed.

"The purpose of use is for pre-employment screening and no other," he said.

"It is not a saleable product or available to any other party, ie not available to monetary offer."