# Standards and Regulatory References — Background Check Privacy

## Primary Legislation

### GDPR
- Art. 5(1)(c): Data minimisation — checks proportionate to role.
- Art. 6(1)(b): Contract performance — qualification verification.
- Art. 6(1)(c): Legal obligation — right-to-work checks, regulated role screening.
- Art. 6(1)(f): Legitimate interest — credit checks for financial roles.
- Art. 10: Criminal conviction data — requires national law authorisation.
- Art. 13: Right to be informed — candidates must be told about checks before they occur.

### National Criminal Record Frameworks
- **UK**: Rehabilitation of Offenders Act 1974; DBS (Disclosure and Barring Service) — Basic, Standard, Enhanced levels.
- **Germany**: BZRG (Federal Central Register Act); Führungszeugnis (Certificate of Good Conduct) — Belegart N (standard), Belegart O (extended).
- **France**: Code de procédure pénale Art. 776; Extrait de Casier Judiciaire — Bulletin No. 3.
- **Netherlands**: Wet justitiële en strafvorderlijke gegevens; VOG (Verklaring Omtrent het Gedrag).
- **Spain**: Ley Orgánica 1/2015 (Criminal Code reform); certificate of criminal record from Ministry of Justice.

## Rehabilitation Principle

| Jurisdiction | Framework | Key Rule |
|-------------|-----------|----------|
| UK | ROA 1974 | Spent convictions not disclosable except for excepted roles |
| Germany | BZRG | Convictions removed from certificate after 5-15 years |
| France | Code pénal Art. 133-16 | Automatic rehabilitation after statutory periods |
| Netherlands | Wet justitiële en strafvorderlijke gegevens | Judicial data removed after 20 years (adults) |

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| ICO (UK) | Experian, 2020 | Enforcement notice | Employment screening without adequate transparency |
| CNIL (France) | SAN-2019-007 | EUR 30,000 | Criminal record certificates retained beyond verification period |
| AEPD (Spain) | PS/00321/2020 | EUR 50,000 | Social media screening without informing candidates |
| AP (Netherlands) | 2021 Investigation | Corrective order | VOG requested for all roles without necessity assessment |
| Garante (Italy) | 2020-0893 | Warning | Background check data retained 5 years for unsuccessful candidates |