Recent headlines have been ablaze with reports of blacklisting of workers within the construction industry. Blacklisting is nothing new, and it can take many forms. In this article we look at the laws underlying the current furore, and more generally at how the law deals with blacklisting.
To view the article in full, please see below:
Full Article
Recent headlines have been ablaze with reports of blacklisting of workers within the construction industry. Blacklisting is nothing new, and it can take many forms. In this article we look at the laws underlying the current furore, and more generally at how the law deals with blacklisting.
Press Reports
Press articles have reported of a business called the "Consulting Association" that kept the names of more than 3,000 "blacklisted" construction workers, including details of any involvement they may have had in trade unions, and any adverse comments about them. It was reported that many construction companies subscribed for a fee to the database of the "Consulting Association", and could therefore access the information on the "blacklisted" workers.
The Information Commissioner's Office ("ICO") has seized the database, and plans to prosecute the owner of the "Consulting Association" for breach of data protection laws. The ICO also named construction companies that it says subscribed to the database.
Data Protection Laws
The use of information kept about individuals (not companies) is regulated by the Data Protection Act 1998. In particular:
- The Act places restrictions on the keeping and use of "personal data" including "sensitive personal data"
- "Sensitive personal data" includes information concerning a person's race, ethnicity, political opinions, religious beliefs and whether he or she is a member of a trade union
- There are very limited circumstances in which a person may keep and use "sensitive personal data" about another person. One is where that other person has given his "explicit consent" to the use of data about himself
- The person who processes personal data and controls its use must be registered with the ICO as a "data controller". The registrable particulars filed with ICO must cover all the processing activities of the data controller
- The processing of personal data must be in accordance with the 8 data protection principles which include the requirement that all processing be 'fair and lawful'
- Companies who process personal data including by providing personal data to a third party should ensure that the individuals concerned are properly informed of what data is involved and the purposes of such processing. Obtaining express consent to such disclosure is always desirable
Misuse of Information
If personal information is not used in accordance with the Act, the individual whose data has been misused may have various rights against the person who kept (and misused) the data, including the right to compensation. The relevant "data controller" may also be prosecuted and subject to fines or subject to other action by the ICO. Companies who have contravened the requirements of the Act should be taking steps now to mitigate their potential liability and reputational impact.
The key point here is that the keeping of "blacklist" databases of "undesirable" workers (based on their trade union activities) is generally illegal.
If a company obtains personal data from any organisation which operates a blacklist, then generally it will be processing that data for the purposes of the Data Protection Act 1998 from the minute it receives the data and will be subject to all the requirements of that Act including that such receipt and any further processing of that personal data must be fair and lawful. This requirement for fair and lawful processing will generally not be met unless the individual concerned has been informed of the receipt and further processing of the personal data.
Blacklisting Generally
There are many other examples of where blacklisting of individuals or companies can (and does) take place in the construction industry. Not all of it is illegal. The law does not place any general restriction on who people in the industry may choose to work with - or not work with.
However:
- In an employer-employee context: In addition to breaching data protection laws, the "blacklisting" of a worker may also be defamatory. If an employer wrongfully puts details of an employee on a blacklist, the employer could face an action from the employee based e.g. on victimisation. If a worker fears that he has been or will be blacklisted, this does not mean he can be dishonest in dealing with his employer. For example, in one reported case from the 1970s a member of UCATT, who was well known for his militant recruiting of union members, was lawfully dismissed from a job after he gave a false name and a bogus reference to an employer to obtain work as a bricklayer, knowing that if he gave his real name he would not be employed
- In a client-contractor context: In a more recent Australian case, a government published a list of 240 "black listed" contractors. This was held to be illegal, on the basis that the government should have given the contractors the opportunity to make representations to the government about whether they should be included on the list. Similar principles could apply in England should a public authority maintains a "blacklist" of contractor companies. In the private sector, however, there is nothing to prevent a client from maintaining a list of companies (but not individuals) with whom it will not work
On the flipside, it is usually permissible for owners and contractors to maintain lists of persons with whom they will work. Local authorities do this pursuant to their standing orders. There are, however, limits on the extent to which local authorities can rely on such lists, in particular where the authority is required to comply with European public procurement rules that require tenderers to be treated equally (even including those that are not on the authority's list).
Commercial Implications
- Setting up and maintaining "blacklists" of workers based on their trade union affiliations is illegal
- But blacklisting through less formal means is not specifically regulated, and it seems there is little that can be done to stop it short of another Act of Parliament
- Having said this, the publicity generated by the ICO's recent actions is almost certain to make people think twice before setting up or using information from a "blacklist" database
- The illegal use of personal information is a risk management issue for all players in the construction industry, and steps should be taken (e.g. by obtaining warranties or indemnities from information suppliers) to ensure that information is not obtained and used from illegal sources
- Maintaining lists of desirable contractors, clients etc is generally permitted under English law (at least in the private sector), and doing so may ensure that a party to a contract is able to work with a known and reliable entity
This article was written for Law-Now, CMS Cameron McKenna's free online information service. To register for Law-Now, please go to www.law-now.com/law-now/mondaq
Law-Now information is for general purposes and guidance only. The information and opinions expressed in all Law-Now articles are not necessarily comprehensive and do not purport to give professional or legal advice. All Law-Now information relates to circumstances prevailing at the date of its original publication and may not have been updated to reflect subsequent developments.
The original publication date for this article was 30/03/2009.
Cyber Security - Are CFOs Doing Enough?
