Introduction
Conducting background verification checks on prospective employees by employers has become increasingly common across sectors in India. While the verification practices differ from sector to sector, some commonalities in background checks include verification of a candidate’s educational qualification and previous work experience, identity checks, and checking for criminal records.

In the case K.S. Puttaswamy v. Union of India ((2017) 10 SCC 1), the Supreme Court of India has recognised the ‘right to privacy’ as an intrinsic part of the fundamental right to life contained in the Constitution of India, which would extend to personal information being shared by prospective employees with employers. It is however essential to note that fundamental rights are enforceable only against the ‘State’ or instrumentalities of the State, and might not be enforceable against employers in the private sector, who would not fall under the definition of State.

In India, the codified law on collection of personal information (i.e. anything that can identify a person) and sensitive personal data or information (critical personal information such as financial information, physical, physiological and mental health condition, sexual orientation, medical records and history, and biometric information) is governed by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”) and its parent legislation the Information Technology Act, 2000.

It is relevant to note that a draft Personal Data Protection Bill, 2019 is presently pending before the Indian legislature, and will significantly change the position of law with respect to collection, processing, storing, and handling of personal information once passed. However, there is currently no clear indication of when this bill is likely to be codified into law.

How do I handle the issue of background checks, including those involving sensitive personal data such as criminal records?

The SPDI Rules require entities to obtain prior written consent before the collection of sensitive personal data. In the event the information collected during background verification falls within the ambit of ‘sensitive personal data or information’, prior written consent would be required.

Please note however, that in the event the information collected is ‘sensitive personal data or information’, but is also publicly available information (such as court records or details of a criminal record), the obligations under the SPDI Rules would not be applicable.

Are there particular issues in checking candidates’ social media profiles?

While there is no specific legal restriction with respect to checking a candidates’ social media profiles, it is pertinent to note that the legality of data extraction from public databases using web-scraping and crawling, has not been judicially tested in India.

Can I ask candidates about their COVID19 vaccination status?

Covid19 vaccination status would constitute a medical record of the candidate and as such would be covered within the ambit of ‘sensitive personal data or information’. Therefore, while collecting, receiving, possessing, storing, dealing with or handling information pertaining to the vaccination status in electronic form, compliance with the SPDI Rules, including obtaining consent of the candidate, would be required.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

In the event an employee lies or omits to provide information which might be relevant for the employer to make an assessment with respect to hiring such an employee, the employer is entitled to terminate the employment of the said employee.

In the event an employee suggests a fact which they know is false or conceals a fact, and the employer, relying on the information executes an employment agreement with the employee, any subsequent discovery with respect to falsification/concealment of the information would amount to ‘fraud’ under the Indian Contract Act, 1872 and make the employment agreement voidable at the option of the employer, and as such the employer will have the option to terminate the employment agreement. Depending on the nature of and the implication of the falsification/concealment of information by an employee, employers may also have recourse to initiate criminal action against the employee for fraudulent and dishonest inducement by the employee, thereby causing the employer to enter into employment agreement and as such committing the offence of ‘cheating’.

How should I deal with the personal data of unsuccessful candidates?

The SPDI Rules stipulates that any ‘sensitive personal data or information’ collected with the consent of the information provider should be retained only for as long as necessary or the purposes for which the information may lawfully be used, and as such any ‘sensitive personal data or information’ of an unsuccessful candidate should be removed/deleted from employers’ database after a reasonable retention period.