Recruitment agencies could face unlimited fines if they fail to comply with a new code of practice on data protection in the recruitment process.

The code of practice is based on the Data Protection Act 1998 and gives guidance about how companies should be handling job applicants’ personal information.

Agencies failing to comply with the rules could face fines of up to £5,000 if a case goes to a lower court, and unlimited fines for more serious breaches tried in the higher courts.

But Dave Clancy, strategic policy officer at the Information Commission, which is responsible for upholding data protection laws, said that the commission uses legal action as a last resort.

‘When we have received a complaint, we tend to go along the route of educating the organisation and refer them to the guidance in the code,’ he said.

Clancy urged agencies to ensure they handled information fairly and tell applicants if the data was being passed on to third parties. He also warned that agencies selling their CV databases to other agencies could be in breach of the data protection act.

The industry’s trade body, the Recruitment and Employment Confederation (REC), has claimed that the code of practice could mean more organisations turn to agencies to handle their recruitment operations.

REC director of external relations Marcia Roberts said: ‘The code is long and prescriptive, but that was what we expected the information commissioner to produce.

‘It could assist our industry – because it is long and detailed, many small to medium-sized enterprises could turn to our industry to get professionals to recruit for them.’

The REC is working with the Information Commission to produce a code of practice focusing on recruitment agencies.

For further information about the code of practice visit www.dataprotection.gov.uk

Measures in the code of practice

• Recruitment agencies must identify themselves and explain how personal information they receive will be used.

• Agencies must let applicants know if the information will be used in some other way.

• If the information is to be used in connection with future vacancies, the applicant must be informed.

• Candidates can send anonymous information if they wish and be identified once the employer expresses an interest.

• Agencies must treat candidates’ information fairly and not discriminate on the basis of race, sex or disability.

• Automated systems must measure applicants’ work performance and not make simple decisions, for example rejecting all candidates under 18 years of age.