Since the GDPR came into force on 25 May 2018 in Hungary, it has become more difficult for employers to request criminal background information on their prospective and current employees. An employer now must look for a specific statutory legal basis in Hungarian law to request criminal background information. The Hungarian Labor Code, for example, states that criminal records may be requested by employers operating in the following fields:
- when the employee cares for those under the age of 18;
- when the employee supervises those under the age of 18;
- when the employee educates those under the age of 18; or
- when the employee provides health care to those under the age of 18.
Previously, those who worked in accounting positions could have been required to provide criminal records, but current applicable law no longer provides for this. On the other hand, public employees, a teacher or a caretaker employed by a kindergarten can be required to provide a clean criminal record.
Companies still have certain means to run some background checks on their applicants, but those checks may not have the aim of collecting[1] and processing personal criminal data. The instances in which the law requires the presentation of a criminal record are extremely rare.
Under the GDPR, a prospective or current employee may not be required to present his/her criminal record solely on the basis of the prevailing legitimate interest of the employer. Such records may not be procured even with the express consent of the prospective employee, because the voluntary nature of such consent might be challenged. Companies that currently require criminal records from their prospective or current employees should review their practices, because the unlawful processing of criminal personal data can result in potentially significant data protection fines. Further, the employee may enforce his/her rights before a court or an equal treatment authority as a result of the infringement of their personal rights, if the processing of the personal criminal data resulted in unfair discrimination
—————————-
[1] Act CXII of 2011 on informational self-determination and freedom of information, defines personal criminal data as personal data created for the criminal process and/or created by the organs responsible for crime detection or law enforcement, that can be correlated to the person concerned, and that pertains to having a criminal record.
