Global menu

Our global pages


Education briefing - ICO Consultation on the Processing of Criminal Records Data

  • United Kingdom
  • Education


The legal issues surrounding the processing of personal data relating to criminal convictions, allegations and offences or related security measures (“Criminal Records Data”) are complex. Education institutions tackle such issues on a regular basis in relation to the recruitment of staff, admissions of students/pupils and often the handling of potential and actual criminal allegations by or in relation to those individuals.

In recognition of the complexities surrounding the processing of such data, the Information Commissioner’s Office (ICO) has published a survey to understand current practice and to find out if gaps exist in relation to understanding around the ability to process criminal records data. All institutions involved in the processing of criminal records data are therefore being encouraged by the ICO to complete the short survey, which remains open until 28 February:

The questions asked by the ICO as part of the survey relate to the purposes relied upon for the processing criminal records data and asks how confident institutions are about making decisions when processing such data as well as querying the key challenges faced in relation to this type of processing.

The Position under GDPR

Criminal Records Data cannot be processed under GDPR, unless by a law enforcement body. The Data Protection Act 2018 (DPA) derogates from the GDPR to allow Criminal Records Data to be processed as special category data by controllers in the UK. Like other special category data, this cannot be processed unless there are lawful bases on which to do so under both the GDPR and the DPA. Essentially, there must be a lawful basis under Article 6 of the GDPR and legal authority under Article 10 for the processing (which for the UK, is the DPA). The DPA provides that in order to be able to process data concerning Criminal Records Data, the legal ground to do so must fall within a Schedule 1, 2 or 3 condition.

The most likely ground to be relied upon will be that in Schedule 1 DPA, namely that it is necessary for the performance or exercise of obligations or rights in connection with employment. However, other grounds which may be relied upon in the education context are: that the processing of criminal records data is necessary for statutory and government purposes, to carry out a protective function in relation to members of the public, to comply with a regulatory requirement and/or in order to ensure the safeguarding of children and individuals at risk.

However, there is no generally applicable lawful basis for the processing of criminal records data (even in contexts whereby criminal checks are required) meaning that the ground(s) to be relied upon to justify the processing must be considered on a case by case basis and current ICO guidance on the issue is not particularly detailed.

Of course, in order to process such data, an institution must have to have in place an appropriate policy document in place (in addition to fair processing information) which explains how its processes Criminal Records Data as well as detailing its procedures on the erasure and retention of the data, who the data will be shared with and how the data is used for any decision making.

Institutions may therefore wish to complete the survey to highlight any issues encountered in relation to the processing of such data and to request more detailed, sector-specific guidance given the often challenging and sensitive scenarios this sector faces.