Criminal behaviour VS criminal conduct: What is the issue?

With the Information Regulator taking a hard stance against refusing any extensions to the 12-month grace period, and with the 1 July 2021 deadline fast approaching, employers are encouraged to ensure that they become compliant in terms of The Protection of Personal Information Act 4 of 2013 (POPIA).

3 May 2021 2 min read Employment Law Alert Article

At a glance

Employers are urged to become compliant with the Protection of Personal Information Act (POPIA) before the 1 July 2021 deadline.
POPIA requires employers to comply with lawful processing requirements when collecting or processing personal information, including criminal history or behavior.
While processing "criminal information" does not require consent, processing "criminal behavior" falls under special personal information and may require consent or meet specific exceptions outlined in section 27(1) of POPIA. Employers are advised to focus on processing criminal information rather than criminal behavior when recruiting new employees.

POPIA instructs employers to comply with all the requirements for the lawful processing of personal information when collecting or processing the data of prospective, temporary, or full-time employees. Potential information includes information relating to an employee’s past criminal history or behaviour. POPIA creates a distinction between that of ‘criminal information’ and ‘criminal behaviour’.

‘Criminal information’ is defined within ‘personal information’ and refers to the criminal history of the employee. Employers often require certain reference checks before employing a person. This may include criminal or other background checks, and references from previous employers. ‘Criminal behaviour’ is defined as ‘special personal information’ and requires an employer to obtain, among others, consent from the employee before processing any special personal information. However, ‘criminal information’ is not defined as ‘special personal information’ and is therefore information that the employer can process without consent.

Special personal information includes, among others, pre-employment screening records relating to criminal convictions. Section 26(1)(b) of POPIA informs us that an employer may not process information about the criminal behaviour of a third party if such information relates to the alleged commission of any offence or any proceedings regarding any offence allegedly committed by an employee or the disposal of such proceedings. The prohibition on the processing about an employee’s criminal behaviour, or biometric information does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information under the law.

For example, where an employer is recruiting employees in positions that require employees to deal with expensive stock or large sums of money daily, the employer is not expected to be barred by the limitations set on special personal information. In such a situation, the employer will have to either get consent from the employee, or prove that processing the information is necessary, with reference to the exceptions set out in section 27(1) of POPIA to process information on the employees criminal behaviour.

Employers are advised, when recruiting new employees, to consider only processing that of criminal information, rather than that of criminal behaviour. Criminal behaviour, besides being regarded as special personal information, is rather onerous to secure the necessary consent and / or approval to process it. From an employment perspective, criminal behaviour may not be relevant to employ employees.

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2024 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.