Reputation checks without consent are a violation of the law – Risks that hiring professionals must know.

Can employee criminal record checks be performed?

There has been increasing legal controversy recently regarding 'reputation checks (reference , reference check)' in the recruitment market. In particular, informal reputation check practices, without the consent of job applicants, still exist, especially in the IT and startup industries, and there is increasing concern about whether this constitutes a violation of the Personal Information Protection Act. According to related reports, some companies are continuing to confirm reasons for leaving and work attitude through former colleagues or industry contacts, which could lead to legal disputes such as violations of the Personal Information Protection Act or criminal liability, requiring special caution. (Related article: “What do you think of this friend?” Job applicant reputation check... “Illegal act” vs “Necessary process”, World Ilbo 2025.03.17.)

Under these circumstances, Law firm Veat received a legal consultation request from a client about to hire employees regarding whether obtaining criminal record data of the recruitment candidates carries the risk of violating the Personal Information Protection Act. In this post, we would like to introduce the main legal issues related to criminal record checks and reputation checks, and practical points for companies to pay attention to in the recruitment process, based on this consultation case.

Can companies check criminal records?

The consultation started when the client requested a review of whether there was a way to check the presence or absence of criminal records for prospective employees. Criminal records, which constitute sensitive information, are strictly restricted by law regarding their acquisition and use, and improper access could lead to criminal penalties.

According to Article 8 of the “Act on the Expiration of Punishment, etc.” (hereinafter referred to as the “Expiration Act”), criminal record data or investigation record data may not be acquired or used for purposes other than those stipulated by law, such as criminal investigations or trials. Violations of this provision may result in imprisonment for up to two years or a fine of up to 20 million won, and in fact, illegal acts occur in the recruitment process of companies due to a lack of thorough understanding of the laws.

How are reputation checks (reference checks) carried out in practice?

In addition to criminal record data, so-called ‘reputation checks, reference checks’ are frequently used in practice in the recruitment process. This is a procedure for collecting information to more precisely assess the applicant's abilities, reliability, and organizational fit, and plays an important role, especially in recruiting experienced or senior personnel.

However, most of the information collected in this process constitutes personal information, and if collected or transmitted to third parties without the applicant's consent, it could violate the “Personal Information Protection Act.” In addition, if the information provided in the reputation check process contains false statements or inaccurate testimonies, it could be a separate legal issue such as defamation or obstruction of employment.

Reputation checks are carried out very frequently in the recruitment process. They have become a means to examine the abilities, teamwork, and reliability of applicants from various angles, and are practically a mandatory procedure when recruiting experienced or senior personnel. However, many companies proceeding with these reputation checks are unaware that ‘reputation checks conducted without the applicant's consent can violate the Personal Information Protection Act.’ If the information provided in the reputation check process includes information that identifies a specific person or involves facts, it is generally classified as ‘personal information,’ and obtaining or providing it requires the consent of the information subject.

Law firm Veat has precisely analyzed the possibility of legally obtaining criminal record data, based on specific facts such as the client’s service characteristics and the job description of the recruitment candidates. Rather than a binary judgment of ‘allowed’ or ‘prohibited,’ we provided advice on various methods to prevent hiring individuals with criminal records, other than the methods inquired by the client.

How to proceed with information checks related to recruitment, without legal risks?

The recruitment environment is rapidly changing. The demand for verifying the trustworthiness and qualifications of applicants is also increasing. In addition to criminal record data, various personal information may be collected in the recruitment process, and if misused, it could lead to various legal issues such as violations of the Personal Information Protection Act, defamation, or obstruction of fair employment procedures. In particular, since there is a lack of clear criteria for ‘which extent constitutes personal information,’ ‘when is it possible to collect without consent,’ and ‘what procedures must be followed,’ companies can easily be exposed to legal risks such as unintentional violations of the Personal Information Protection Act, defamation, or obstruction of fair employment procedures by performing information checks or reputation verification that they unwittingly perform. Therefore, recruitment staff or HR personnel should check the permissible scope and procedures of relevant laws before conducting recruitment-related information collection such as reputation checks and career verification, and discuss with legal experts in advance to prevent risks.

If you need legal advice on talent recruitment processes such as reputation checks and reference checks, please feel free to contact Law firm Veat.

Thank you.
Law firm Veat