Whether it’s information gleaned from references, or a back story brought to light from a google search, how to deal with information uncovered during a recruitment process can be tricky for employers. You need to ensure the factors you are taking into consideration are legitimate, and the decision you make is fair and lawful. The recent case of Ngole v. Touchstone Leeds highlights the difficult balancing act for employers if adverse information comes to light in a recruitment process. 

Legal risks

Considering this topic in general, there are a number of specific legal risks to keep in mind (not all of which were relevant in Ngole case):

• Discrimination: it’s unlawful to discriminate against someone in relation to a protected characteristic during recruitment. This includes the “arrangements” made for deciding to whom to offer a job (i.e. pre-hire checks), and a decision not to make an offer. 

There is no specific prohibition or legislation on checking the social media profiles of candidates or general internet searches (e.g. of news media). However, a search could reveal information about a candidate that could lead to inferences of discrimination if the candidate is subsequently unsuccessful. As the Ngole case highlights, employers must carefully assess how to handle such information. 

• Rehabilitation of Offenders Act 1974: under this legislation, certain criminal convictions become “spent” after a set period of time, at which point a candidate is entitled to declare themselves as having a “clean” record. Even if an employer discovers that the individual has a spent conviction, they must be treated as if the conviction has not happened and cannot refuse to employ the person because of their historic conviction.  As we’ve explored here, this legislation lacks teeth. But if unfair dismissal becomes a day one right, new recruits (although not applicants) will have stronger protection. 

• Data protection: Searches conducted during a recruitment process will involve processing personal data, and potentially special category personal data on matters such as a person’s health, sexual orientation, religious beliefs or political opinions. This means that the candidate’s data and privacy rights under the GDPR must be upheld. 
  
  The ICO employment practices code suggests you only use vetting where there are particular and significant risks involved to the employer, clients, customers or others, and where there is no less intrusive and reasonably practicable alternative (reflecting general data protection principles).  

Recruitment checks in practice 

The Ngole case demonstrates what can happen if employers are not careful about conducting informal pre-employment checks.  Mr Ngole was a qualified social worker and applied to be a discharge mental health support worker with a mental health charity, Touchstone.  He was offered the job, subject to DBS checks and references. 

As Mr Ngole’s references were not sufficiently detailed, Touchstone resorted to an internet search to find out more about him. This revealed that Mr Ngole had been dismissed from a university course after expressing religious views on Facebook disapproving of homosexual acts. This had resulted in legal proceedings against the University. 

As a result, the charity was “very concerned” that Mr Ngole’s ethos and values did not align with theirs. They were particularly concerned about the impact on LGBT+ service users, who statistically face much higher rates of serious mental health issues, due to stigma and discrimination, and were therefore far more likely to need support from the charity. How would these vulnerable service users feel upon discovering that the person appointed to support them viewed their lifestyle, choice of partner, or gender identity as "sinful" or wrong? They concluded that this could be the "last straw" for some, potentially even heightening suicide risks. 

The charity therefore withdrew the conditional job offer.  After Mr Ngole challenged this, Touchstone offered him a second interview so they could discuss the approach he would take to the role and potentially reconsider their decision. However, Touchstone was not persuaded and the job offer was not reinstated.  

Mr Ngole brought a range of discrimination claims in the employment tribunal. The tribunal found that the withdrawal of the job offer amounted to direct discrimination on the grounds of his religious beliefs.  This involved the tribunal balancing Mr Ngole’s rights to freedom of expression against Touchstone’s objective of protecting others.  Although the objective of protecting staff and vulnerable service users was legitimate, the tribunal found that the withdrawal of the offer prior to the second interview was not proportionate – there were less intrusive options open to Touchstone. The Claimants’ other claims failed, including claims about the requirement for a second interview and Touchstone’s refusal to reinstate the job offer.  

What can employers learn from this case?

Although the decision is being appealed, there are still valuable takeaways:  

• Online “due diligence” is risky: best practice is to only use the information that you have told candidates you will use in order to make a decision. There is no guarantee that information found online, particularly on social media platforms, is accurate, or up to date, and relying on it could lead to bad decision making.
• If you find out information about candidates’ views or beliefs that raises concerns, always consider the Higgs criteria. These are the factors that the EAT identified as likely to be relevant when assessing whether an interference with the right to freedom of belief and expression is proportionate. For example, do you have vulnerable service users? Does anything that you have discovered potentially affect your reputation? 
• Work hard on job descriptions and interview questions to ensure tight role requirements, minimising the possibility that decisions appear to be on the grounds of religion/belief or other protected characteristics. 
• Have a thorough and robust recruitment policy, particularly if you are in a regulated sector, to ensure that you can refer to it should discrepancies or issues arise and to support consistent and fair decision making. 
• Avoid knee jerk reactions. In the Ngole case, having discovered the adverse information, Touchstone’s response of immediately revoking the job offer was found to be excessive and counterproductive - beyond what was “reasonably necessary”. More proportionate responses could have included:  
  
  • discussing with Mr. Ngole how he could more moderately express his views without discrimination concerns
  • offering him training or guidance as to how he might more appropriately express his religious views in a public forum
  • explaining to Mr Ngole that it was the manner of his expression of views, not the views themselves, that was problematic and detailing exactly what their concerns were
  • asking him to provide express assurances that he would care for LGBT+ service users 
    
    

Interestingly, the Tribunal found the later refusal to reinstate the job offer was proportionate, as Mr Ngole had been given the opportunity to address these issues at second interview and Touchstone’s concerns that he had been unable to provide the reassurances they needed were legitimate and proportionate.

Any practical tips on data protection?

The judgment does not consider Mr Ngole’s data and privacy rights under the GDPR (as Employment Tribunals do not have jurisdiction over these complaints) but there are also steps that can be taken to mitigate risks of breaching the GDPR. ICO Guidance covers this very scenario (it is over 19 years’ old, but no refreshed guidance has been published and it is still relevant):  

• If seeking information from internet searches (eg online media), it should be left as late as is practicable in the recruitment process.
• Where vetting results in adverse information, the applicant should be made aware of this and given the opportunity to make representations, to ensure that the information is accurate.
• The additional condition for processing this special category data is likely to be “necessary” for the purposes of complying with employment law, for example to ensure that you are not going unlawfully to discriminate. This is particularly relevant where it can be shown it’s necessary for you to conduct the search to enable you to meet your legal obligations, for example to others to whom you owe a duty of care (here, the Touchstone service users and staff members). 
• Consider whether you could rely on the information having been “made public as a result of steps deliberately taken by the data subject” – the Christian Legal Centre is known for conducting strategic litigation (and supported Mr Ngole in his previous and this litigation). It was acknowledged in the judgment itself that Mr Ngole threatened tribunal proceedings during the second meeting. 
• Specific to this case, “the processing is in the substantial public interest, is necessary for the discharge of any function which is designed for the provision of confidential counselling, advice, support or other service and is carried out without the consent of the data subject because the processing … is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent or the data subject”. 
• General pre-employment vetting “good data hygiene” includes: 
  
  • Conducting vendor due diligence and having a robust Data Processing Agreement with them;
  • Putting adequate security measures in place;
  • Ensuring the correct handling, use, retention and disposal of personal and special category / criminal offence data (including DBS certificates and certificate information);
  • Limiting access to results of checks to only a limited number of individuals, and subjecting them to a duty of confidentiality; and
  • Providing applicants with a copy of your recruitment privacy notice (if you have one – which we recommend), which sets out the types of background checks to be undertaken.

Mr F Ngole v Touchstone Leeds 1805942/2022– judgment available here