Employer sharing DBS check

[Cupcakequeen75]

A friend of mine works in a child care role so obviously has had a DBS check carried out (she has done similar work for years so the DBS is nothing new).
Just recently a new parent asked to see a copy of the DBS and the company shared it (via email) without checking with my friend, it of course contains EVERYTHING about her (including things like maiden name etc).
When she was told (after the event) she asked if they were allowed to do this (Data Protection Act) and the company apologised but said they didn't think it was wrong and been doing it as & when requested for the past 7-years!
She will be taking legal advice from her Union but in the meantime does anyone know if the company are allowed to share this information with a member of the public? We think not.

Wow. No - they shouldn’t be sharing this information:

www.gov.uk/government/publications/handling-of-dbs-certificate-information/handling-of-dbs-certificate-information

You have to have dbs for inspection but I photocopy and redact personal information apart from name

In fact section 2.3:

In accordance with section 124 of the Police Act 1997, certificate information is only passed to those who are authorised to receive it in the course of their duties. We maintain a record of all those to whom certificates or certificate information has been revealed and it is a criminal offence to pass this information to anyone who is not entitled to receive it.

The employer should not even be keeping a copy of the DBS check, let alone sharing it with anyone else! The nursery should hold a single central record of staff and their certificate number and issue date. But any copies taken should be destroyed immediately after recording the appropriate information. The certificate should remain in the employees possession.
The DBS certificate is the property of the employee (your friend) and can not be shared without her express permission. They have contravened GDPR here and your friend should think about reporting to both Ofsted and the ICO. Although I understand she may not wish to do so if she is in their employment.

The only time I've ever had to have a parent to see one was when they were hiring a staff member for private 1:1 work, I gained consent from the person and redacted personal information

Potentially my information about not retaining the certificate may actually be partly incorrect (although having worked in many large organisations in a recruiting role, I have never seen this happen). It looks like they may be able to keep a copy, however should definitely not have shared it with anyone.

Of course it isn't appropriate. I would encourage your friend to submit a formal grievance about this, as it's clear that the company practice needs to be reviewed and changed.

DBS certificate copies are not allowed to be kept on file.

The employer should take a copy of the dbs number and date of issue, this can then be shared with Ofsted/LA

Wtf? I was going to say contact ICO about clear data breach but if it is a criminal offence I'd be tempted to report as a crime.

@Cupcakequeen75 your friend should write to her employer and advise them that it is a breach of GDPR and they are required to report themselves to the ICO.
ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/

In the letter/email she should ask her employer to state what process(es) they have in place to ensure her personal data is not unlawfully shared again and to ensure the 3rd party (parent) does not compound the breach by unlawfully disclosing her personal data to anyone else.

If she has any safety concerns then include details of why disclosing her personal data on her DBS certificate increases her risk.

Thank you all. 👍
Will be passing all the replies onto my friend (she is not on MN).

That is absolutely awful. It’s good that she’s getting advice from her TU. I’d be reporting to the ICO in any case. It’s not just illegal, but a breach of trust - you expect employers not to share any of your details with customers, let alone sensitive details like this.