False positives in online background checks: name matching and context
A false positive is an online result that looks like a problem with your candidate but is not: a namesake's post, a fake account, an old post read as current, a joke read literally, or a photo someone else posted and tagged. The Information Commission (ICO) says in its draft vetting guidance that information found online may not be accurate and that a decision based on it alone is unlikely to be fair and lawful. Our main social media screening page covers the ICO's wider rules; this guide is about getting the match and the meaning right.
The practical answer: treat every result as unconfirmed until it is matched to the candidate on more than a name, read it with its date and context, and let the candidate explain before anyone relies on it.
Why online results go wrong
Online posts are written by someone else, but the search and the record are yours. The ICO's accuracy guidance says that where you compile personal data yourself you must make sure it is correct, taking particular care if it could have serious implications. Where you rely on information someone else provided, you must accurately record it and its source, take reasonable steps to ensure its accuracy and carefully consider any challenges. The more a decision may significantly affect the person, the more effort you should put in, which may mean getting independent confirmation.
The ICO's data minimisation guidance has an example that fits screening closely. A debt collection agency collects information on several people with a similar name to a debtor. Once some are discounted, it should delete most of their data, keeping only the minimum needed to record that they were removed from the search.
Name matches and confirmed matches
Sanctions screening has a useful vocabulary, offered here only as an analogy. The Office of Financial Sanctions Implementation (OFSI) calls it a name match when a name matches an entry on the UK Sanctions List, and says this does not necessarily mean it is the same person. Where the person matches all the information on the list, OFSI says this is likely to be a target match. Employment screening is a different regime, but the lesson transfers: a name is where checking starts. If a role needs actual sanctions screening, see our sanctions page.
| Identifier | Use it? | Why |
|---|---|---|
| Name, and any former names or spellings the candidate gave you | Starting point only | On its own it is a name match |
| Places lived, studied or worked, from the application | Yes | Independent details the candidate supplied |
| Employers and dates | Yes | Can be compared with a business networking profile, which Acas says you can use |
| A link the account holder made to an account already confirmed | Yes | Strong, if the first account is confirmed |
| Photograph resemblance | Only with other identifiers | Resemblance is an opinion and easily wrong |
| Mutual friends or followers | Weak | Shows proximity, not identity |
| Nationality, ethnic origin or religion assumed from a name | Never | Unreliable, and race and religion or belief are protected characteristics |
| Anything from private accounts or another person's login | Never | The ICO says checks reaching non-public information are unlikely to be lawful |
Names, nationality and the Equality Act
In Great Britain, section 9 of the Equality Act 2010 says race includes colour, nationality and ethnic or national origins. Direct discrimination under section 13 is treating someone less favourably because of a protected characteristic, and section 39 says an employer must not discriminate in the arrangements it makes for deciding to whom to offer employment. Northern Ireland has its own equality law.
Our view: a reviewer who decides a result is "probably" the candidate because the name seems to belong to a particular nationality, or who searches harder or in more places for some names, is making assumptions the Act is designed to stop. Acas also warns you might be breaking the law if you look at some applicants' social media but not others. Use the same sources, identifiers and criteria for every candidate checked for the role.
Old posts
A post from years ago accurately shows what someone said then, not what they think now. The ICO's accuracy guidance makes the same distinction for records generally: a changed fact does not make a historical record inaccurate, but you must be clear that it is a historical record. The ICO makes a related point about criminal records only: if you ask about spent convictions, the person's age at the time of the offence is likely to bear on its relevance. Our view: the same thinking applies to old posts.
Our view: date every finding, set a time window before searching, and let the candidate say what has changed.
Parody, impersonation and fake accounts
Our view: we have found no official guidance on these, but they follow from the accuracy principle, but they follow from the accuracy principle. Warning signs include an account that is new, contradicts details on an account you have already confirmed, uses the candidate's photos without linking to their known profiles, or carries a parody label. Record why you think an account is or is not genuine, never contact or report it, and ask the candidate before treating it as theirs.
Replies, edits, deletions and tags
Our view: a reply makes sense only alongside the post it answers, so read the thread. A deleted post you see through someone else's screenshot or a cached copy is that person's version, so the ICO's point that the source and status of data must be clear applies: record where you saw it and that it was not on the candidate's own account.
Content other people posted and tagged the candidate in was not chosen by the candidate, and it contains other people's personal data. Data minimisation points to leaving it out unless it meets your criteria. The ICO's subject access guidance says you do not have to disclose information that would reveal another person unless they consent or disclosure without consent is reasonable, which is harder to manage if their posts sit in your report.
Letting the candidate explain, and correcting mistakes
Our main page sets out the ICO's process for discrepancies. For matching, the key step is to ask the candidate whether an account is theirs before treating it as theirs, and to record their answer. Where facts are unclear, the ICO says to make a reasonable decision based on the factual evidence.
Candidates have a right to have inaccurate personal data rectified. A request can be made verbally or in writing, and you have one calendar month to respond. Take into account their arguments and evidence. The ICO says it is good practice to restrict use of the data while you check it. If you decide it is accurate, explain why and tell them they can complain to the ICO and can seek to enforce their rights through the courts. Note the challenge either way, and tell anyone you shared corrected data with.
Match confirmation checklist
Our view of good practice:
- Write down the identifiers you will use before searching, and use the same ones for every candidate checked for the role.
- Confirm each account on at least one identifier beyond the name, and record which.
- Mark anything confirmed on name alone as a name match and stop there.
- Never infer nationality, ethnic origin or religion from a name or photograph.
- Record each finding's date, where you saw it and whether it is the candidate's own post, a reply, a share, a tag or someone else's copy.
- Read replies and shares in their thread before deciding what they mean.
- Record confidence as the reviewer's named opinion, separate from what the post shows.
- Delete what you hold on excluded namesakes, keeping at most a one-line note that one was excluded.
- Let the candidate comment on anything you plan to rely on, including whether an account is theirs.
- Correct your records if a finding turns out to be wrong.
Sources
- Pre-employment vetting of candidates · ICO
- Principle (d): Accuracy · ICO
- Principle (c): Data minimisation · ICO
- Right to rectification · ICO
- A guide to subject access · ICO
- UK financial sanctions general guidance · GOV.UK (Office of Financial Sanctions Implementation)
- Equality Act 2010, section 9 · legislation.gov.uk
- Equality Act 2010, section 13 · legislation.gov.uk
- Equality Act 2010, section 39 · legislation.gov.uk
- Equality Act 2010, section 217 · legislation.gov.uk
- Choosing who to interview · Acas
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Can we turn a candidate down if we cannot tell whether an account is theirs?
In our view, no. An unconfirmed result should not reach the decision maker. The ICO says a decision based on online information alone is unlikely to be fair and lawful and that you should give the candidate an opportunity to comment.
What should we keep about a namesake we ruled out?
Very little. The ICO's data minimisation example of a debt collector that discounts people with similar names says it should delete most of their data, keeping only the minimum to record that they were removed from the search.
Do OFSI's name match rules apply to recruitment checks?
No. OFSI's guidance is about financial sanctions, and we use its name match and target match terms only as an analogy. If a role needs sanctions screening, check the UK Sanctions List and follow OFSI's guidance; our sanctions and PEP screening page explains more.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- Sanctions and PEP screening of job candidates When a UK employer should check candidates against the UK Sanctions List, how to handle name matches, and why PEP status alone is no bar to a job.
Guides
- What a good social media screening report looks like A fictional, annotated social media screening report for a care worker role, showing what a UK employer should record at each step and why.
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
- Manual search or social media screening software? How a documented manual search compares with a specialist social media screening service on records, accuracy, privacy, automated decisions and contracts.
- What can social media screening legitimately flag? Which social media findings can fairly reach a UK hiring decision, which must be filtered out, and an illustrative criteria list to adapt.
Related answers
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.