GDPR AND IMMIGRATION PROCESSES

Most employers will be aware of the upcoming introduction of the General Data Protection Regulation, or GDPR. But how can they be sure the way they collect and store information for immigration purposes will be compliant? Amelore look at the key risk areas.

GDPR

The introduction of the General Data Protection Regulation (GDPR) presents a huge challenge for employers in many data processing scenarios.

Not surprisingly, immigration processes necessitate the collection and processing of considerable personal data by an employer and, in many situations, one or more third parties such as legal advisers.

And with the deadline (25 May 2018) fast approaching, there is a chance that certain types of personal data processing will not be captured in your thinking, and will therefore create a risk of a breach.

For many employers, immigration is a niche activity that changes constantly and is therefore difficult to fully understand and account for with internal policies and processes.

However, given the sensitive nature of data collected and processed, and the multiple parties often involved in this, now is the time to look at key immigration activities and ensure that they are GDPR compliant.

Here are a few scenarios that illustrate the wide range of immigration data points to be accounted for in preparing for GDPR.

Right to work checks

Employers must conduct right to work checks on any new employee, ideally before they start working for you so you only employ people with the ‘right to work in the UK’.  Employers should take copies of any original documentation they see and copy, sign and date the document copy which should then be securely stored.

While it is easy to assume that this is covered by a “legal obligation” that is not actually the case.

A right to work check is done to establish a statutory excuse against a civil penalty – that is, to avoid a fine should an employee be found to be working illegally. It is not strictly speaking a legal requirement to perform a right to work check and there are no penalties for failing to perform a right to work check where the employee is working legally. However, employers that do not carry out right to work checks will not have a statutory excuse.

Therefore, the retention and processing of data relating to immigration status would be categorised under “legitimate interests” and this processing should be covered in a privacy notice.

Resident labour market test

The resident labour market test (RLMT) is conducted as part of a Tier 2 General (new hire work permit) application to justify the recruitment of a non-UK/EU individual, ahead of a UK/EU individual.

The employer generally needs to place two adverts on two websites for 28 days each, and then assess applications against the skills, education and experience described in the advert.

If there are no suitably qualified candidates from the UK/EU, then a non-UK/EU individual can be offered the role and be sponsored under Tier 2 General.

Documentation, including job applications, CVs and interview notes need to be retained for up to seven years in the event that the Home Office conducts a compliance audit.

Now imagine you were one of the candidates who applied for that role. You were interviewed for the job but ultimately were unsuccessful. It would be reasonable to expect that your details would be retained for a reasonable period, for example six months, to allow the employer to defend any challenges arising from the appointment.

However, most candidates would be surprised to learn that their personal information would be stored for up to seven years and shared with legal advisers and the Home Office as part of the immigration process for the successful candidate.

While employers may be able to argue that retaining the information is a legal obligation, the Home Office document that describes document retention is not technically part of the immigration rules. Rather, it is a policy document and therefore it may be open to interpretation whether it is a legal obligation or not.

As such, employers may instead have to rely upon “legitimate interests” as the appropriate legal basis to retain such information. This of course requires a proper assessment to ensure those interests are not outweighed by risk of prejudice to individuals.

What steps do employers need to take to ensure that their RLMT processes are GDPR-compliant?

  1. Ensure your privacy notice for recruitment purposes makes clear the possibility of personal data being processed and retained for the purpose of immigration requirements, specifically the RLMT for Tier 2 General, including the sharing of that data with legal advisers and the Home Office, and the length of time data may be stored.
  2. Minimise personal data where possible. The personal data that must be retained on file, as per the relevant Home Office policy document, relates only to applications shortlisted for final interview – rather than all candidates who responded to the advert. Likewise, do not ask for personal data that is not strictly required at this stage of the process, for example, copies of passports, immigration documents and evidence of qualifications and experience.
  3. Redact and anonymise personal data. A further way to minimise the personal data you hold is to redact information that is not relevant to the information you need to retain, such as contact details, interests and hobbies.

Immigration enquiries and opinions

Throughout the course of employment an employee can expect that their employer may need to consult with legal advisers and other professional advisors on a range of matters, including immigration, and in doing so may need to share personal data.

This should of course be covered in the section within the privacy notice dealing with disclosures to third parties.

However, what if as part of these enquiries it is necessary to transfer data outside the European Economic Area (EEA)? For example, where the organisation is looking to transfer an employee to the US and would like a US-based immigration lawyer to assess eligibility.

Transfers of personal data outside the EEA need to be addressed within privacy notices. Also, any such transfers of personal data should only take place where steps are taken to ensure adequate protection for that personal data in the recipient country (this is also the existing position under the Data Protection Act 1998).

With just over a month to go until GDPR goes live, now is the time to understand the data points in your immigration processes and ensure they are GDPR compliant.

Our top 10 tips regarding “Right to Work Checks”

Every employer is aware that it is unlawful to employ someone who does not have the right to carry out the work in question, and employers can be subject to a civil penalty of up to £20,000 per worker for any breach of this.

Avoiding the £20,000 penalty

It is possible to establish a statutory (legal) excuse in respect of such penalties provided that the employer checks the worker’s documents prior to employment commencing, and then repeats the checks for those workers who have time limited permission to work in the UK.

Generally, UK nationals and European Economic Area (EEA) nationals have the automatic right to work in the UK, whereas migrant workers from the rest of the world will need to establish this right to work by showing that they have appropriate permission under one of the tiers of the UK points based system, by way of another form of visa, or under other European Treaty rights.

However, it is important that checks are carried out consistently on all employees and below we detail our top tips on what to do and some potential pitfalls.

  1. Obtain

Obtain an original of one or more documents listed in the Home Office’s Guidance.

The Home Office has produced a helpful right to work checklist which details those documents that can be relied on.

This list is “non negotiable” and no other documents “will do”. You have been warned!!

  1. Check

Check the document in the presence of the holder.

It is surprising the number of employers who arrange for reception staff or managers to take copies of the document but then in fact pass these copies onto the HR function to validate. This is not strictly compliant. Whoever is in the migrant’s presence when the document is presented should be the person doing the check. HR can of course assist, but the ultimate responsibility lies with this individual, so ensure that he or she has had appropriate training.

  1. Make a copy

Take a clear copy of the document(s). If the copy is blurred, illegible or has information missing/cut-off the statutory excuse will not be achieved. This sounds obvious but you’d be surprised.

This copy should then be marked as a true copy of the original, clearly signed and dated, and then stored or scanned and filed securely. Beware Biometric Residence Permits (BRP’s). It is mandatory to copy the front and back if the statutory excuse is to be secured.

  1. Check the documents thoroughly

It is not simply a matter of taking a photocopy. Make sure you check the validity of the documents, for example that the photos are consistent with the actual appearance of the individual and that any stamps/endorsements look genuine.

If you are given a false document, you will only be required to pay a civil penalty if it is reasonably apparent that it is false, and that means it has to be properly checked.

  1. Specifically check the terms of the visa:

Make sure the job you provide does not break any conditions or restrictions on the type of work an individual can do, or the hours they can work (see below). The terms of the visa or work permission should clearly say what these are. Again, a proper considered check is vital to securing a statutory excuse.

  1. Beware students:

It is important to be aware that non EEA migrants who come to study in the UK under Tier 4 of the points based system are generally entitled to work for a maximum of either 10 hours or 20 hours per week term time (dependent on the course and the educational establishment), and for any period during vacations and following the end of the course to the expiry of their visas.

Since May 2014 it has been the employer’s responsibility to check the dates of working against the student’s published term time tables. If a student is found to be working over the permitted hours during term time then they will be working unlawfully and you will not have a statutory excuse. That additional extra hour of work could therefore cost the business £20,000 per student, so do be sure to check.

  1. Beware discrimination claims:

In an attempt to avoid a £20,000 penalty do not then risk a claim of discrimination, which could prove even more costly. Presumptions should not be made about a person’s right to work in the UK based simply on the basis of their background, appearance or accent. As stated, apply the checks consistently to all workers regardless.

  1. Be mindful of ANY staff that have come TUPE

Yes, that four letter word again. Any employer who “inherits” employees under the Transfer of Undertakings (Protection of Employment) Regulations 2006 would be wise to carry out the right to work checks on all transferring employees if it wishes to be certain it has the statutory excuse.

You have a grace period of 60 days to do this and although you may be able to rely on any checks previously carried out by the transferor, there is no guarantee that these will have been done correctly.

  1. Don’t risk it:

£20,000 is the fine for unlawfully employing a worker subject to immigration control, if this is by mistake / oversight / incompetence. If you know the migrant does not have permission to carry out the work in question then the penalty is unlimited and the owners of the business can be sent to prison for up to two years, and this is set to rise to five years.

  1. If you are audited and fail – take urgent advice!

If, for whatever reason, a statutory excuse is not obtained and the employer finds that it has unknowingly employed a worker unlawfully or finds itself the subject of a Home Office audit, or even “raid”, all is not lost. There are still ways in which to seek to avoid or mitigate any civil penalties but in that eventuality it would certainly be sensible to seek urgent professional advice.

If you would like a review of your current employment practices with a particular focus on your starter and leaver processes, contact Amelore for more details.

www.amelore.com

Immigration Act 2016 – Illegal working offences

visa stampAfter months of rumbling through the political process the much debated Immigration Bill finally received royal assent on 13 May 2016, becoming the Immigration Act 2016.

Hot on its heels came the enabling regulations which will bring many of the measures into force on 12 July 2016, including those detailed below.

The purpose of the Act, put quite simply, is to make it as hard as possible for illegal migrants to live and work in the United Kingdom.

Immigration Minister James Brokenshire stated  “The message is clear – if you are here illegally, you shouldn’t be entitled to receive the everyday benefits and services available to hard-working UK families and people who have come to this country legitimately to contribute.”

Below are the key changes employers need to be aware of:

Illegal working

The act of illegal working is to become a criminal offence, punishable by fine and/or up to six months imprisonment. Whether those convicted are in fact jailed at taxpayer’s expense prior to deportation will remain to be seen. However, the obvious point is that, as a criminal offence, any “proceeds” (which would include wages/salary) will now come under the Proceeds of Crime Act 2002 and so therefore open to confiscation.

Employing an illegal worker

The penal sanction in respect of employing an individual illegally is to rise from the existing two years to five years, together with a continuing unlimited fine. This is further “beefed up” by amendments to the existing offence. Previously the risk of criminal liability arose if the employer knowingly engaged the migrant unlawfully.

The Act now provides that the offence will be committed if the employer “has reasonable cause to believe that the employee is disqualified from employment.” This is a lower threshold than previously, and presumably is to prevent those who routinely exploit illegal workers, from using plausible deniability to escape unlimited civil penalty and possible imprisonment.

However, for the purposes of all of those other employers who dutifully carry out right to work checks and then monitor the position as appropriate, the stakes have been raised significantly.

At what point, for example, does “reasonable cause” arise, whereby a consequential dismissal may be defended on the basis of “illegality” or “some other substantial reason”? Inaction or delay in this regard may result in an unlimited fine and imprisonment, whereas erring on the side of caution and moving immediately to termination of employment may subsequently result in a successful unfair dismissal claim, with the inherent further risk of an ancillary race claim.

Current new starter processes

Many companies still have out of date or insufficiently robust starters procedures which fail to check properly whether an individual has the right to work in the UK.

Next steps

Now, more than ever, it is important to get right to work systems and policies up to date, fit for purpose, and in place, as the consequences for failing to do this are now significantly more severe than they were previously.

See our blog on Right to Work checks for our top tips.