Providing background check services, pre-recruitment or reputational investigations in Italy

The importance on relying on expert lawyers

Introduction 

The so called background-check are increasing their popularity. These investigations entail research carried out on the reputation of an individual. They usually aim to business purposes, such as: employing a worker, stipulating a partnership between two entrepreneurs, finding the right manager for a specific unit of someone’s business or selecting the right company for a commercial cooperation.

Such services may also be offered by professional operators specialized in retrieving information needed to find the “reputational background”, or the digital presence, of someone.

Juridical complexity of the matter

The activity itself is perfectly lawful, since it is not forbidden by any provision. However, in certain cases, background checks encounter severe limitation. Consented activities are identifiable only through existing bans and issues. What fall outside the scope of such limitations, may be considered the ground on which the activity ought to be considered lawful. At the end of this brief dissertation, we will nonetheless try to provide a picture of what can be lawfully done with little or no risk in relation to background check services.

Interests at stake

This major complexity in relation to background checks arises from the balance of the interests that are actually at stake and which all contribute to constrain what is lawfully doable. Be it clear: “constrain”, not “prohibit” at all.

Data protection, Labour law, reputation, right to be forgotten are all themes to be born in mind and which will be confronted in the following paragraphs.

The aim of this brief article is not to discourage from undertaking this activity, rather to warn that the same activity ought to be done either by operators who have a sound legal expertise or by operators who do rely on lawyers who offer a solid expertise on the subject at hand.

Defamation between civil and criminal law

Starting point of our reasoning is to be found in the concept of defamation. Defamation is an ambiguous lemma. In a strict sense, it indicates the crime of harming someone’s reputation among more third persons, which is regulated by the Italian Criminal code, at art. 595. It is punished with up to one-year jail-time and an amends of 1032,00 euros. If the defamation consists of attributing to someone a specific (mis)deed, penalties are increased. Other causes of penalties increase are of no concern for the purpose of present article. The conduct of harming someone’s reputation among other people shall be deemed relevant with a plurality of persons to whom the defamatory content is delivered and their contextual presence is not requested. People commonly believe –although it is wrong – that the truth of the discrediting speech or content is anyhow an excuse or a cause of impunity. This is incorrect since it only applies to the right of freedom of the press or to political critique, granted under art. 21 of Italian Constitution, under specific circumstances. The aforementioned principle is not applicable to common citizens or private individuals, whose speeches are not shielded from defamation if statements are true. As a consequence, people are not allowed to prove in court the truthiness of what they attributed to others, unless it is a specific fact and the defamed person agrees to it.

Furthermore, “defamation” bears some ambiguity. It may also be intended as a conduct which leads to compensation for damage. Possibility of success for claimants are higher before civil courts than criminal courts. This is not only because art. 2043 of Italian Civil Code provides for duty to compensate unjust damages, being them fraudulent or involuntary, therefore contemplating unintentional conducts too (whereas the crime of defamation requires a will to make a defamatory statement about someone); moreover, criminal law provides for more causes of impunity. In other words, there may well be defamation for a civil court, whereas a penal criminal cannot condemn, therefore, damaged subjects normally prefer to resort to civil jurisdiction.

Differences between the civil and criminal proceedings should nonetheless not be exaggerated. As said, the damage needs to be unjust for the law to require for compensation. In other words, only illicit conducts generate the duty to indemnify. Under a broad point of view, for the sole purpose of simplifications and bearing the risk of losing in accuracy, every time a person is punishable for defamation he will be held responsible for damages; when someone is not punished for defamation he will probably not be required to compensate or indemnify the claimant.

We will only mention that, on the contrary, releasing statements harming someone for no justified reason violates one of those rules through which jurists measure the justness of the damage suffered by an individual. We commonly refer to this as “neminem laedere” principle, abstaining from harming others. That is why there will be many declarations irrelevant under criminal legislation potentially generating a duty to compensate for damages.

Right to moral integrity

Bearing in mind that “defamation” under civil law is not just damages suffered for the crime of defamation, but instead it also indicates (defamation in a broad sense) the violation of other people’s rights, namely the right to moral integrity, we will now consider what the right to moral integrity means. This right is itself composed of: right to honour, right decency, respectability, decorum and the right to a reputation. Some of these were once protected by the crime of affront, which is not punishable anymore.

These rights assume a special vest within commercial and business relationships, in which reputation is a key requirement to operate within the market and being able to do business. Discrediting someone for no justified reason – as it should be clear – may not be relevant under criminal law, but it is certainly going to generate compensation duties, since, as it was said before, it does violate the “alterum non laedere”, eternal criterion of justice in human relationships, and parameter to discern just and unjust damage.

Privacy and Data Protection

Having mentioned all the above, before the reader has all elements to understand our explanation on what is lawful in the field of reputational analyses, we need to mention another area: privacy. With no regard for classificatory operations, after EU Regulation 679/2016 was adopted, individuals have a right to have their data processed as provided for by the law.

Data treatment refers to all operations on personal data including, among other things, collection, recording, consultation, extraction, comparison, usage, interconnection, communication, publication, even elimination. In order to be licit, data treatment, has to be based on “justified data treatment causes”. These are situations provided for by the legislator, which justify the treatment of data. Whoever processes or uses data in an illicit manner, not only is held responsible for damages caused for violating the right to privacy, but also to all further occurred damages. An example might consist in spreading someone’s Bank account number, with the relating duty to indemnify for infringing the right to privacy itself and also for the case the damaged subject becomes the target of a bank scam or fraud.

One of the reasons justifying data treatment is consent, but it is not enough in our case, since consent needs to be free and the socio-economic balance of power existing in the specific case may determine deeming it not free. In worker-employer relationship, consent is never a reliable legal ground for data treatment. There are others, such as pre-contract interest or contract execution.  This does not apply to Curriculum Vitae of candidates sent spontaneously, since the law has special provisions for that. In our case, justification for data treatment should be, instead, the legitimate interest of one party to verify the correctness or the reliability of the the other party.

This is nonetheless not enough to avoid the risk of severe sanctions.

EU Regulation 2016/679 imposes to inform with a specific qualified communication that one is undertaking treatment of someone else’s data. There needs to be specified several information, such as the purpose of the treatment, the category of data and all the other relevant information duly provided for in art. 14 of Data Protection Regulation. There is a duty to warn that data in the CV will be verified after they are transmitted to the operator in charge of checking background.

The concerned subject has a right to scrutinize information collected about him, as well as report and dossiers and he is entitled to demand rectification of incorrect data.

We would also like to make it clear that data storage shall never exceed the time necessary to realize the purpose for which they were collected or to grant the exercise of the rights of the concerned persons.

Right to be forgotten

Before approaching the last argument, which is labour law, we believe it is necessary to mention the right to oblivion, or right to be forgotten. This is the right to have old episodes not published again, when there is no more public interest to their knowledge. The principle was firstly elaborated by European Court of Justice case-law, in the Google Spain case. The Court stated that Treaties should be interpreted so as to grant individuals the right that information concerning them and that are not of public concern anymore, are to be removed from search engines. This is a matter to be kept in mind, since it has evolving implications.

Labour law: pre-hiring investigations

Last argument to be mentioned before explaining how the background analysis activity ought to be carried, entailslabour law. Labour law experts are used to defining “pre-hiring investigations”, i.e. those checks aimed at discovering more about a candidate for the purpose of deciding whether or not to hire him. Labour main statute (legislation 300/1979) prohibits to inquire “even through third people, on political, union, religious opinions, and on facts non relating his attitude to work”. (art. 8)

When conducting pre-hiring investigation, it is forbidden to check on moral, psychological, sexual, sentimental, behavioural, intimate, familiar situations of candidates. The ban on treatment if this data is enforced with severe criminal provisions, not just mere fines (art. 171 of d. lgs. 196/2003, so called Privacy Code).

There is no doubt that data treatment for pre-hiring investigation shall adapt to privacy rules and regulations. 

Conclusion

Now we may finally explain what a background-check professional activity can legally consist of.

It shall be limited, whether it is made for personnel-hiring purposes, within the strict boundaries designed by labour law provisions, withdrawing from any idea of inquiring the temper or the conduct of the worker. The analyses will focus on the intellectual or manual capability to handle the assigned tasks.

Discovering the causes of a previous contract termination is an activity almost any investigation service offers with little awareness of the legal risks. Privacy reasons, requires the candidate to know in advance he will go through such verification. He is entitled to see the information collected upon him and the dossier made about him.

It may seem obvious, but it is not: language continence is a key matter. Implying neutral, never-offensive, non-judgemental forms is a policy which should be demanded with extreme severity. There is, for example, no problem in observing that someone is in no good relationship with his previous employer. Things change with a report affirming someone has been fired due to the the fact that he behaved in a dishonest way. It is allowed, e.g., to say that the cause of the end of a working relationship was a disciplinary proceeding.

Information included in reports need to be, as far as possible, verified, open for the contribution of the concerned person, enabling for rectification request. For no reason should data be stored more than necessary, spread, communicated to others, or reports reused. Storage in a safe archive is core importance.

No news damaging the reputation of the party may be communicated, since whoever does that, if not punished for defamation, may still be summoned before a civil tribunal for indemnification. This is without prejudice for a tight on analysis and critique, themselves part of the larger freedom of expression, which may well consist of a technical, continent, inoffensive critique, never aimed at discrediting. Stating, i.e., that the digital presence of someone should be improved, because it has some criticalities, and inviting the client to evaluate whether something of the candidate is in line with the business policy, can hardly be ground for a victorious lawsuit. As it was mentioned before, on a normal basis, very old information should be ignored.

Operators should be ready to acquire this method, based on transparency, constructive analysis never defamatory, nonetheless highlighting critical aspects, with no fear of contradicting what alleged in the CV of the candidate. This principle equally applies to background checks on people, entrepreneurs, corporates and so on.

There is no doubt that, the best option is to rely on a lawyer, so that he defines the right protocols allowing operators willing to provide background-check services to work autonomously without risking lawsuits.

The illusion of saving through providing such service without solid legal knowledge or assistance is to be avoided. Offering reports drafted secretly and without concerned individuals knowing, in the hope to be exempted from the respect of rules, may lead to disastrous consequences, which will not only frustrate any saving aim pursued, but determining significant losses compared to the results of those who follow the licit way.

In conclusion, we would like to remind that ignoring due forms can bring to merely apparent saving. For example, enabling rectification responds also to the interest of the subject preparing the report, since, through this dialogue, operators shield themselves from lawsuits for incorrect allegations and obtain a larger quantity of information with no effort.