Consent to collect candidate ID and background information: what you actually need
A common recruitment myth is that you need signed consent for everything you collect from a candidate. You do not. For ordinary personal information, the rule is to collect only what is reasonably necessary, by lawful and fair means, and to give a collection notice. Consent is the higher bar, and it applies to sensitive information, most importantly the police checks and medicals that go with screening.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Notice is the baseline, consent is the higher bar
Two different requirements often get merged:
- Collection notice (APP 5) is required whenever you collect personal information. You make the candidate aware of who you are, why you are collecting, who you disclose to, and so on. This is notice, not consent. Read: the candidate collection notice
- Consent is a stronger step, and it is required for particular things, most notably sensitive information (which generally needs consent as well as being reasonably necessary), and it can be the basis for certain other steps.
So for ordinary candidate information, contact details, work history, an identity document you genuinely need, the requirement is usually to collect only what is reasonably necessary and to notify, not to obtain formal signed consent.
The collection rules for candidate ID and background
- Only what is reasonably necessary. Under APP 3 you collect personal information only where it is reasonably necessary for your functions. Do not collect an identity document, a full date of birth, or background detail you do not actually need to source, assess or place the candidate.
- By lawful and fair means. Collect openly and fairly, generally from the candidate, and use the collection notice for information you gather from third parties such as referees.
- Sensitive information needs consent. A police or criminal-history check and a pre-employment medical are sensitive information, so you generally need the candidate's consent and the collection must be reasonably necessary. Read: police checks and medicals
What good consent looks like (where you do need it)
Where consent is required, it should be voluntary, informed, specific and current, and given by someone with capacity. In practice that means telling the candidate plainly what you will collect and why before they agree, not burying it in a wall of text, and not treating a stale tick from years ago as ongoing consent for a new check.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Do we need written consent to collect a candidate's ID document?
Usually not a formal consent, provided you genuinely need it and you notify. The controls for an ordinary ID document are necessity and notice: collect only what you need, by fair means, and cover it in your collection notice. Written consent becomes important for sensitive information such as a police check.
Is a tick-box on the application form enough?
For a collection notice, a clear notice on the application path is the mechanism, not a tick-box. Where you do need consent (for sensitive screening), a bundled "I agree to everything" tick is weak, consent should be specific to what you are actually collecting.
Can we rely on consent the candidate gave last year?
Be careful. Consent should be current. A consent given for one purpose or a while ago may not cover a fresh check now. If in doubt, ask again for the specific collection.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.