Many companies refuse to settle for the information provided by the applicant on job applications and in personal interviews. So-called background checks (also known as “pre-employment screenings”) therefore enjoy great popularity among employers in the US and the UK as a measure to investigate the potential employee’s background. This screening may be conducted by the company’s own staff, or, increasingly, by third party companies that specialize in background screening. In both cases, validation of the application information helps employers to obtain and retain competent and high quality employees. This can be done by verification of documents and certificates, examination of the applicant’s financial situation and criminal record or inquiries into his/her physical- and/or mental-health status (although such health checks are inadvisable in the UK as they are prohibited under disability discrimination legislation).

However, whilst in the UK and in particular in the US background checks are much more common, German employee data protection rules have established a much tighter regime.
The information to be gathered is likely to be ‘personal data’ for the purposes of the German Federal Data Protection Act (Bundesdatenschutzgesetz). Therefore, without the explicit consent of the employee, personal data of an employee may only be collected, processed or used for employment-related purposes where necessary for hiring decisions or, after hiring, for carrying out or terminating the employment contract. In addition, employees’ personal data may be collected, processed or used to detect crimes only if there is a documented reason to believe the employee has committed a crime while employed, and the collection, processing or use of such data is necessary to investigate the crime and is not outweighed by the employee’s legitimate interest in excluding the collection, processing or use, and in particular the type and extent are not disproportionate to the reason.

All other personal data may only be collected if the employee explicitly consents. German law places strict conditions on the obtaining of valid consent. The employee must be informed both in principle and in detail about the extent and the purpose of the data collection and processing. General information that personal data will be used is not sufficient. The employee must be explicitly informed about the specific use of his data, the specific purpose for processing and the full name of the third parties that will receive the data in the course of the search to be conducted (generic words like “service providers” are not sufficient). Even if these strict requirements are met, it is often debatable whether consent given in an employment relationship can be valid, as another requirement of valid consent is that the consent be freely given. The extent to which consent can be relied upon in the context of employment is limited, primarily because the inevitable power imbalance between an employer and employee generally undermines the extent to which an employee can be said to have freely given their consent. If the consequence of not entering into an employment contract containing a consent clause is that a job applicant is not offered a position, or an existing employee’s continued employment or provision of benefits is conditional on entering into such a contract, then it is questionable whether the employee has any realistic alternative and is freely consenting. Consent will be void if not considered to be given freely. In addition, under German data protection law, consent can be withdrawn. If consent needs to be obtained, it is therefore advisable to do so via a side agreement.
In general, the collection of information by means other than voluntary disclosure should be the exception to the rule and limited to the requirements of the individual case. This is due to the principle of direct inquiry: As a rule, personal data must be collected directly from the person in question, i.e., the prospective employee. Data may be collected without the applicant’s participation and/or from a third party only if this has been provided for or compulsorily stipulated by legal provision, or if collecting the information directly from the applicant would entail disproportionate time and effort and if an objective observer would conclude that the applicant’s right to privacy does not supersede the employer’s need to obtain this information from a third party.
It is also important to remember that the employee may request a copy of the result of the check as the information collected is very likely to constitute ‘personal data’ and therefore is subject to the prospective employee’s right to make a data subject access request.

To the extent that the establishment of background check procedures amounts to the development of staff questionnaires, general guidelines on background checks or guidelines for the selection of employees for recruitment may require the approval of the works council according to sec. 94 and 95 of the German Works Constitution Act (Betriebsverfassungsgesetz). Also the data protection officer, if any, (Sec. 4 f/g of the German Data Protection Act) may have to be involved when implementing background checks.