Who’s Checking Your Background Screening Provider?

In today’s risk averse and compliance focused world, most organisations wouldn’t dream of hiring new employees without conducting background checks – organisations have an obligation to do so. But who’s checking the company running your background checks?

Why you need to check your checker

Recently, the Australian Competition and Consumer Commission (ACCC) released findings from its investigations into major data brokers operating in Australia. What they uncovered was deeply concerning: there was clear evidence of personal data being repurposed and exchanged without consent. Surprisingly, many of the organisations that supplied the data were unaware that this was taking place.

Even if the information comes from a background screening provider, the organisation that requested the data from a candidate can be held liable if there is a breach. This means personal data protected under the Australian Privacy Principles can be at risk – typically, this is sensitive information and not something a candidate would appreciate being leaked.

Therefore, there’s a need for higher levels of scrutiny when it comes to finding a reliable background screening provider.

Case study: DISA Global Solutions

In April 2024, US-based background screening company, DISA Global Solutions, was hacked, with 3.3 million individuals impacted as a result. Stolen data included: names, social security numbers, driver’s licence numbers, employment records, criminal records, drug test results, and even financial details! Although this is a US case, it shows how any organisation can become victim to a hack and the risk involved with sensitive data. It also shows that background screening companies aren’t immune to data breaches. In fact, many background screening providers still operate on outdated platforms lacking core capabilities like single sign-on (SSO), introducing avoidable cybersecurity vulnerabilities. 

Compliance and responsibility

Many businesses tick the compliance box by ensuring background checks are performed, but don’t consider how personal data is handled by their background screening provider. Without rigorous oversight and transparency, background screening providers can become a serious liability, exposing your organisation to privacy breaches, regulatory sanctions, and reputational damage. The last thing any organisation needs is regulatory scrutiny from the Office of the Australian Information Commissioner (OAIC) due to a third-party background screening provider’s failure to protect personal data. A background screening provider should therefore demonstrate clear and secure data protection and ethical use.

How to pick a secure background checks provider

Due diligence and market research are essential when selecting a background screening provider. It’s worth investigating which providers are commonly used within your industry – or in sectors with similar risk profiles – to ensure your choice aligns with best practices. For example, a healthcare provider may choose to work with a background screening provider that works with financial institutions – both industries are high risk and have severe impacts on the people they deal with.

It’s worth thinking about the following questions when approaching a background screening provider to ensure they can handle your operational, regulatory and compliance requirements and responsibilities.

• How is personal data collected, stored, and destroyed?
• Is consent actively and transparently managed?
• Will the personal data of my employees be used for any secondary purposes?
• What protections are in place to prevent data being leaked in a cyberattack?
• Does the background screening provider fully comply with the Australian Privacy Principles and best practices?
• Can the background screening provider demonstrate evidence of ethical data stewardship?

Hiring candidates comes with the need to conduct background checks. Your background screening provider should uphold the same principles you do – the foremost being the need to protect personal data and ensure it doesn’t get into the wrong hands. Due diligence and background research can help inform your decisions – choose a background screening provider that is secure, has a global presence and a strong reputation in Australia, and an end-to-end encrypted system that acts as a vault, protecting employees and candidates’ personal information.

‍