POPIA instructs employers to comply with all the requirements for the lawful processing of personal information when collecting or processing the data of prospective, temporary, or full-time employees. Potential information includes information relating to an employee’s past criminal history or behaviour. POPIA creates a distinction between that of ‘criminal information’ and ‘criminal behaviour’.

‘Criminal information’ is defined within ‘personal information’ and refers to the criminal history of the employee. Employers often require certain reference checks before employing a person. This may include criminal or other background checks, and references from previous employers. ‘Criminal behaviour’ is defined as ‘special personal information’ and requires an employer to obtain, among others, consent from the employee before processing any special personal information. However, ‘criminal information’ is not defined as ‘special personal information’ and is therefore information that the employer can process without consent.

Special personal information includes, among others, pre-employment screening records relating to criminal convictions. Section 26(1)(b) of POPIA informs us that an employer may not process information about the criminal behaviour of a third party if such information relates to the alleged commission of any offence or any proceedings regarding any offence allegedly committed by an employee or the disposal of such proceedings. The prohibition on the processing about an employee’s criminal behaviour, or biometric information does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information under the law.

For example, where an employer is recruiting employees in positions that require employees to deal with expensive stock or large sums of money daily, the employer is not expected to be barred by the limitations set on special personal information. In such a situation, the employer will have to either get consent from the employee, or prove that processing the information is necessary, with reference to the exceptions set out in section 27(1) of POPIA to process information on the employees criminal behaviour.

Employers are advised, when recruiting new employees, to consider only processing that of criminal information, rather than that of criminal behaviour. Criminal behaviour, besides being regarded as special personal information, is rather onerous to secure the necessary consent and / or approval to process it. From an employment perspective, criminal behaviour may not be relevant to employ employees.