Background Check

Background check: a definition

A background check, also called background screening, is the verification of what a candidate has presented about themselves. It covers four things in particular: the qualification the candidate holds, the experience they claim, the job titles they have held and the periods for which they worked.

A background check has two possible points in the hiring process. It can be carried out before the job offer is issued, or after the offer has been issued and before the candidate starts work. In both cases the verification takes place before the candidate starts work.

Why a background check is carried out

A background check is carried out because the gap between what is written in a CV and what actually happened is not always an outright lie. The gap covers a range, and three points on that range can be named.

The first is an inflated job title: the CV gives a title larger than the one the candidate actually held. The second is an extended period: the dates on the CV stretch a period of employment beyond the time the candidate actually spent in it. The third is the achievement of a team attributed to one individual: a result that a group produced is presented as the work of the candidate alone.

Each of these can leave the candidate’s account inaccurate without amounting to a plain falsehood. The background check brings such a gap to light before it becomes a hiring decision.

The statutory dimension of a background check

A background check also has a direct statutory dimension. Article 80 of the Labor Law allows the employer to rescind the contract without an award, without notice and without compensation where it is proven that the worker resorted to forgery to obtain the job.

Article 80 of the Labor Law attaches a condition to that rescission: the employer must give the worker the opportunity to state their objections to it. The condition is part of the article itself, so a statement of the forgery case that leaves it out misstates what Article 80 of the Labor Law provides. Royal Decree M/44 did not amend Article 80 of the Labor Law, whose last amendment was made by Royal Decree M/46. The nine cases that Article 80 of the Labor Law lists, of which forgery is one, are set out in our guide to dismissal without an award and leaving work without notice under Articles 80 and 81 of the Labor Law.

So what is discovered late is handled by a far heavier procedure than a verification call.

What a background check covers in practice

In practice a background check covers three items.

• The academic qualification. It is checked on three points: that it exists, the date on which it was awarded, and the body that awarded it.
• The employment record. It is checked for the job title, the length of service and the reason the service ended, and the check confirms that these agree with the experience certificates.
• Professional licences. They are checked where holding a licence is a condition of the job, and the check covers whether the licence is still valid.

Two practical rules for a background check

Neither rule below is a provision of the Labor Law. Provisions of the Personal Data Protection Law that bear on both are set out after the list.

1. Inform the candidate and obtain their consent before contacting any party. Contacting a current employer without the candidate’s knowledge can cost the candidate the job they currently hold.
2. Confine the check to what concerns the job. The test question is whether a given piece of information would change the hiring decision. If it would not, there is no reason to ask for it.

The Labor Law is not the only instrument relevant to the information a background check gathers. Information that identifies a candidate is personal data under the Personal Data Protection Law (نظام حماية البيانات الشخصية). Article 2(1) of the Personal Data Protection Law applies the law to any processing of personal data relating to individuals that takes place in the Kingdom, by any means, and its scope does not depend on an employment relationship existing.

Article 10 of the Personal Data Protection Law provides that a controller may collect personal data only directly from the data subject, and then sets out seven situations in which collection from someone other than the data subject is allowed, the data subject’s consent among them. Consent itself is governed by Article 5 of the Personal Data Protection Law, which, except in the cases the law provides for, requires consent to process personal data and makes that consent withdrawable at any time. A separate requirement is set by Article 11(3) of the Personal Data Protection Law, which requires the content of personal data to be adequate and confined to the minimum necessary to achieve the purpose of its collection.

How Article 10 of the Personal Data Protection Law and Article 15 of its Implementing Regulations bear on collection from someone other than the data subject is discussed under cybervetting. Whether a particular background check rests on consent or on another of the situations in Article 10 of the Personal Data Protection Law is not something the definition of a background check settles.

How a background check differs from a reference check

A background check verifies facts that can be proved: a certificate was issued or it was not, a period of employment took place or it did not. A reference check gathers opinions from people who worked with the candidate about the candidate’s performance and conduct.

The background check answers the question “Is this true?”, while the reference check answers the question “What were they like?”.

The provisions relied on are those of the Labor Law as published by the Ministry of Human Resources and Social Development: Article 80 (rescission without an award, notice or compensation where the worker resorted to forgery to obtain the job, and the condition that the worker be given the opportunity to state their objections). The provisions of the Personal Data Protection Law relied on, as published by the Saudi Data and Artificial Intelligence Authority (الهيئة السعودية للبيانات والذكاء الاصطناعي), are Article 2(1) (scope), Article 5 (consent and its withdrawal), Article 10 (direct collection and the situations in which collection from another source is allowed) and Article 11(3) (the minimum necessary), together with Article 15 of the Implementing Regulations of the Personal Data Protection Law (collection from someone other than the data subject).

This is an explanation of the concept and of the statutory provisions cited, not legal advice.