An employer may process data about convictions and criminal offences of job candidates and employees only where it is necessary to meet a legal obligation to check that the person satisfies requirements set in laws or implementing acts for the post or functions, or (since 1 July 2024) where it is necessary for the employer's legitimate interests and those are not overridden by the person's interests, rights and freedoms, especially where the person is a child. Processing on legitimate interests is allowed only with four safeguards: a written legitimate interests assessment weighing the post's particular features, the risk posed by a person convicted of particular offences, the justification and proportionality of the no-conviction requirement and the person's rights, prepared in consultation with the data protection officer where one is appointed; an approved list, published on the employer's website if it has one, of the posts or functions subject to a no-conviction requirement naming the offences concerned; processing only for posts or functions on that list; and the data being supplied by the candidate or employee in the scope the employer specifies. The rules extend to people working under relations equated to employment (Article 5(5)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.