We quoted in our most recent compliance tip that one thing firms could consider doing to ensure the security of customer data is to “conduct credit checks and criminal record checks on staff with access to large amounts of customer data”. Whilst a “credit check” of an employee can easily be undertaken by asking the individual to consent to such a check, firms have often had difficulties in checking whether the individual has a criminal past. The reason for this difficulty stems from the legislation contained within the Rehabilitation of Offenders Act 1974 which only allows for Criminal Records Bureau (CRB) disclosures to be issued in respect of particular positions or professions. Whilst firms in the financial services industry are able to obtain such disclosures these can only be obtained where the prospective employee is an “approved person” and therefore firms would not be able to apply for a CRB disclosure just because an employee had access to large amounts of data. Likewise CRB disclosures cannot be obtained for mortgage advisers who are not approved persons.

This situation has proved problematic for many firms who want to do all they can to ensure that the staff they are employing are of good repute and are suitable to conduct the role for which they have been appointed. However, there is a little known method of obtaining such information; this involves obtaining a “Basic Disclosure” from “Disclosure Scotland”, as explained below:

Disclosure Scotland

Unlike the Criminal Records Bureau (CRB), Disclosure Scotland will issue individuals with a “Basic Disclosure”. A Basic Disclosure differs from a CRB disclosure for an approved person (known as a “Standard Disclosure”) in terms of the restrictions applied to it and the information which it contains. Unlike a Standard Disclosure, a Basic Disclosure can be obtained for anybody and for any purpose. The information which it contains is more limited (it contains details of unspent convictions held in central police records rather than details of spent and unspent convictions, cautions, reprimands and warnings) and it must be applied for directly by the employee, not via the firm.

As stated above, the disclosure must be applied for by the employee, although they can request that the disclosure be sent directly to the employer. The disclosure application can be submitted in writing or it can be completed on-line. The individual will need to prove their identity and as such they will need to provide some information from a relevant identity document; copy documents may also be necessary. The cost of the disclosure is £20. Further information can be found here: http://www.disclosurescotland.co.uk/basic.htm

Summary

RC continues to believe that the Standard Disclosure issued by the CRB is the most appropriate type of disclosure and therefore we would recommend that these continue to be obtained for all approved persons. For individuals who are not approved persons, firms should adopt a risk-based approach to identify whether a criminal records check is required for other employees. Where such a check is deemed necessary the firm should obtain a Basic Disclosure from Disclosure Scotland.

Any firms requiring further guidance on this issue should contact their Consultant or the Resources Compliance office on 0161 486 1000.