Background checks are a common part of the hiring process in the Philippines. Employers may verify an applicant’s employment history, educational qualifications, professional licenses, and other relevant information to help assess suitability for a position. These checks can help businesses make informed hiring decisions, reduce potential risks, and protect their operations.
However, conducting a background check involves collecting and processing personal information. Employers must therefore understand their responsibilities under Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations.
Content Overview
This article explains whether background checks are legal in the Philippines and outlines employers’ responsibilities under the Data Privacy Act of 2012. It covers lawful processing, consent, information collection, data security, third-party screening providers, record retention, and applicants’ privacy rights. It also discusses potential violations and practical steps businesses can take to conduct compliant background checks.
Are Background Checks Legal in the Philippines?
Yes. Background checks are generally permissible in the Philippines when conducted for legitimate purposes and in compliance with applicable laws. The Data Privacy Act of 2012 does not categorically prohibit employers from verifying information provided by job applicants or employees.
Under the DPA, personal information may be processed when at least one lawful basis under Section 12 applies. These include the individual’s consent, the necessity of processing in relation to a contract, compliance with a legal obligation, and legitimate interests, subject to the law’s conditions and limitations.
This means that employers should not assume every background check automatically requires consent as its sole legal basis. Instead, they must determine and document the appropriate lawful basis for each type of processing. When consent is used, it must meet the legal requirements for valid consent.
Employers must also observe the general data privacy principles of transparency, legitimate purpose, and proportionality. Information should be collected for a specified and legitimate purpose, processed fairly and lawfully, and limited to what is necessary for that purpose.
For example, verifying an applicant’s educational credentials may be relevant when a position requires a particular degree or professional qualification. However, collecting unrelated personal information without a legitimate and proportionate reason may raise privacy concerns.
The National Privacy Commission (NPC) oversees the implementation of the Data Privacy Act and provides guidance on the lawful processing of personal data, including information handled in employment-related settings.
What Laws Govern Employment Background Checks in the Philippines?
Employers should consider several legal requirements when establishing their background screening procedures.
1. Establish a Lawful Basis for Processing
Before conducting a background check, employers must identify an applicable lawful basis under the DPA.
Section 12 recognizes several grounds for processing personal information, including consent, contractual necessity, legal obligations, and legitimate interests, subject to the relevant conditions.
Employers should assess which basis applies to the specific screening activity and retain documentation supporting their decision. They should not rely on consent automatically when another lawful basis may be more appropriate.
2. Inform Applicants About the Screening Process
Transparency is an essential data privacy principle. Employers should provide applicants with a clear privacy notice explaining how their personal information will be handled.
The notice should generally cover:
- The types of information that may be collected or verified.
- The purpose of the background check.
- The methods used to collect and process the information.
- The parties or categories of recipients who may receive the information.
- The intended retention period or applicable retention criteria.
- The identity and contact details of the organization responsible for processing the information.
- The applicants’ applicable data privacy rights and how they may exercise them.
Providing this information helps applicants understand how their data will be used during recruitment.
3. Collect Only Relevant and Necessary Information
Employers should limit background checks to information that is adequate, relevant, and not excessive in relation to the purpose of screening.
For example, verifying professional credentials may be appropriate for a position requiring specialized qualifications. Collecting unrelated information about an applicant’s personal life, however, may be disproportionate to the hiring purpose.
Employers should also take particular care when collecting sensitive personal information, which is subject to stricter processing rules under the DPA.
4. Protect Personal Information From Unauthorized Access
Background screening records may contain identification documents, employment records, educational credentials, and other confidential information.
Under Section 20 of the DPA, personal information controllers must implement reasonable and appropriate organizational, physical, and technical security measures.
Employers can support compliance by:
- Restricting access to authorized HR personnel and other individuals with a legitimate business need.
- Using secure systems to store screening reports and supporting documents.
- Establishing confidentiality requirements for employees who handle personal information.
- Implementing access controls, secure file-sharing procedures, and appropriate data disposal practices.
- Maintaining procedures for identifying, responding to, and managing data breaches.
These safeguards help reduce the risk of unauthorized disclosure, misuse, or loss of applicant information.
5. Work With Third-Party Background Screening Providers Responsibly
Some businesses outsource background checks to professional screening providers. Although outsourcing may improve efficiency, it does not automatically remove the employer’s data privacy responsibilities.
Under the DPA’s accountability principle, a personal information controller remains responsible for personal information under its control or custody, including information transferred to a third party for processing.
Employers should evaluate screening providers before engaging their services. Relevant measures include reviewing their data protection practices, defining permitted processing activities, establishing appropriate contractual safeguards, and ensuring that information is used only for authorized purposes.
The employer should also determine the parties’ respective roles under the DPA and applicable NPC rules.
6. Retain and Dispose of Records Properly
Employers should not keep background check reports indefinitely without a valid reason.
The DPA requires personal information to be retained only for as long as necessary to fulfill the purpose for which it was collected, establish, exercise, or defend legal claims, meet legitimate business needs, or comply with applicable law.
Businesses should establish retention schedules covering applicants who are hired and those who are not. When records are no longer necessary and no applicable legal or legitimate retention requirement remains, they should be securely erased or disposed of.
7. Respect Applicants’ Data Privacy Rights
Individuals whose personal information is processed have rights under the DPA, subject to applicable limitations and exceptions.
These may include the right to be informed, the right to access personal information, the right to correct inaccurate information, and the right to object to certain processing.
Employers should establish procedures for handling privacy-related requests and ensure that inaccurate or incomplete information is addressed appropriately.
When a background check reveals a discrepancy, employers should consider verifying the information and allowing the applicant to clarify relevant facts before making a final hiring decision.
What Happens If an Employer Violates Data Privacy Requirements?
Employers that conduct background checks improperly may face complaints, investigations, or enforcement action under applicable data privacy laws and regulations.
Potential issues include:
- Collecting personal information without an applicable lawful basis.
- Using information for purposes that were not properly established or permitted.
- Accessing or disclosing confidential records without authorization.
- Failing to implement appropriate security measures.
- Keeping personal information longer than necessary without a valid basis.
- Mishandling sensitive personal information.
- Failing to meet applicable breach notification obligations.
The consequences depend on the facts, the nature of the violation, and the applicable legal provisions. The DPA and its implementing rules provide for penalties and other enforcement measures in qualifying cases.
Employers should therefore establish documented background screening procedures, train HR personnel, review third-party providers, and periodically assess their privacy compliance.
Conclusion
Background checks can help Philippine businesses make informed hiring decisions, verify qualifications, and manage employment-related risks. However, the process must be carried out responsibly and in accordance with the Data Privacy Act of 2012.
Employers should establish a lawful basis for processing, inform applicants about the screening process, collect only relevant information, protect confidential records, and ensure that third-party providers follow appropriate data protection requirements.
A compliant background check is not simply about verifying information. It is also about protecting the rights and privacy of the people being screened.
Businesses that need assistance with employment-related background screening can explore professional background check services to support their verification processes and internal compliance procedures.
Need Background Checks Assistance?
FilePino is a trusted leader in background check services in the Philippines. We ensure that our process of conducting background checks on virtual assistants is legally compliant, straightforward, and efficient.
Ready to hire our background check investigators? Set up a consultation with FilePino today! Call us at (02) 8478 5826 (landline) and 0917 892 2337 (mobile) or send an email to info@filepino.com.
