What can social media screening legitimately flag?
A social media check can legitimately flag only what is relevant to the specific risk you documented for the role before anyone looked. Our view: in practice that means public evidence of conduct the role cannot accommodate, such as threats of violence, harassment or abuse, or disclosure of confidential information; public information that contradicts something the candidate told you; and, for roles working with children or adults at risk of harm, conduct that raises a safeguarding concern. The ICO's draft vetting guidance names these kinds of risk, including danger to others, unsuitable people working with children or adults at risk, and disclosure of trade secrets.
What a check must not flag is who the candidate is, what they lawfully believe, or a private life unrelated to the role. In Great Britain the Equality Act 2010 protects nine characteristics in recruitment, and the ICO says you should not make assumptions about suitability based on special category information such as race, political views or sexual orientation, even if the person made it public. Write the criteria down, give them to a reviewer who is not the decision maker, and filter everything else out.
Start from the risk you wrote down
Our main page lists the ICO's examples of risks that can justify vetting, from danger to others to disclosure of trade secrets. The Information Commission (ICO) says its draft recruitment guidance is under review following the Data (Use and Access) Act 2025.
Each flag criterion should trace back to a risk you documented for the role. If a finding does not connect to that risk, it is not a flag, however interesting it looks. This mirrors the ICO's care home example, where the person doing the checks screens the information for relevancy against the specified interview criteria.
Findings that can be job relevant
Our view: none should reach a decision maker until the candidate has had a chance to respond, which the ICO says you should offer.
| Finding | When it can matter | Basis |
|---|---|---|
| Threats of violence | Any role where it shows a danger to colleagues, customers or the public | ICO names danger to others as a vetting risk; for staff assessed under FIT, FCA FIT 1.3.21G gives threats of violence as an example |
| Harassment or discriminatory abuse of others | Roles with responsibility for colleagues, customers or people in their care | FCA FIT 1.3.21G refers to conduct showing a material risk of harassment; ICO's charity example covers behaviour that would compromise the person's ability to do the job |
| Disclosure of confidential or commercially sensitive information | Roles with access to the same kind of information | ICO names disclosure of trade secrets or other commercially sensitive information |
| Conduct raising a safeguarding concern | Roles working with children or adults at risk of harm | ICO names employing unsuitable people in these roles; its care home example checks for conduct making someone unsuitable to work with people who need care and support |
| Contradiction of what the candidate told you | Any role, if the point matters to the decision | ICO sets out a process for discrepancies and says you cannot assume the candidate is being untruthful |
| Apparent involvement in criminal activity | Only where relevant to the role, and handled as criminal offence data | ICO says criminal offence data can cover suspicion or allegations of criminal activity |
What must not drive the decision
In Great Britain, section 39 of the Equality Act 2010 says an employer must not discriminate in the arrangements it makes for deciding to whom to offer employment, or by not offering employment. Section 4 lists the nine protected characteristics; our guide to protected characteristics and social media screening covers keeping them out of the process.
Political views need care. Acas says tribunals have found membership of a political party not to be protected, but that political beliefs could still be protected if they meet the definition of philosophical belief. Political opinions are also special category data, and the ICO lists political views among the things you should not make assumptions about. In Northern Ireland, nidirect says it is against the law to discriminate because of political opinion, though a political opinion which includes approval or acceptance of the use of violence for political purposes in Northern Ireland is excluded from protection.
Trade union membership is protected separately. In Great Britain, section 137 of the Trade Union and Labour Relations (Consolidation) Act 1992 makes it unlawful to refuse a person employment because they are, or are not, a member of a trade union. That Act does not extend to Northern Ireland.
- anything revealing a protected characteristic, including what a photo suggests
- lawful political, religious or philosophical views, or the absence of a religion or belief
- trade union membership or activity
- health, disability, sex life or sexual orientation
- family, relationships, friends and who the candidate is connected to
- lawful leisure activities and opinions unrelated to the role
- old posts that do not suggest a current risk
Regulated roles in financial services
For staff assessed under the FCA's fit and proper test, FIT 1.3.21G says social media activity in private life is relevant where it indicates a material risk that the person will breach the requirements and standards of the regulatory system. Where it does not, the guidance says that, subject to FIT 1.3.17G, the activity is unlikely to be relevant and nothing in FIT requires a firm to concern itself with it. FIT 1.3.17G covers private conduct that shows a willingness to disregard ethical or legal obligations, abuse a position of trust or exploit the vulnerabilities of others, or that is serious enough to undermine public confidence in the regulatory system.
FIT 1.3.16G adds two limits: it should not be assumed that simply because a person engages in conduct in their private life there is a material risk they will repeat it in their regulated role, and a remote or speculative risk is not sufficient. Our view: both are worth applying to any criteria list, regulated or not.
Illustrative flag criteria you can adapt
This is an illustrative template, not a legal standard. Delete any line the role's documented risk does not support, and add the risk reference to each one you keep. Give the reviewer the final list in writing before the search starts.
- Public statements threatening violence against a person or group (risk: danger to others)
- Public posts harassing, abusing or demeaning individuals, including because of a protected characteristic (risk: harm to colleagues, customers or people in care)
- Publication of an employer's or client's confidential information (risk: disclosure of commercially sensitive information)
- Public content suggesting a risk to children or adults at risk of harm (risk: safeguarding, for roles working with those groups)
- Public information contradicting the qualifications, employment history or other facts the candidate gave you (risk: reliance on false information)
- For public-facing roles only: public conduct that would compromise the person's ability to do the job, described in specific terms rather than as a values match
Testing a flag before it reaches the panel
Our main page explains why online information cannot be relied on alone. In the ICO's political party example, the information might be out of date or inaccurate, the candidate might have been mistaken for another person with the same name, or they may have since changed their views.
Before passing a flag on, the reviewer should record what was found, where, its date, which criterion it meets and how they confirmed it relates to the candidate. The candidate then gets a chance to comment. Our false positives guide covers identity checks.
Sources
- Pre-employment vetting of candidates · ICO
- Data protection and recruitment · ICO
- Shortlisting, testing, and interviewing candidates · ICO
- What is criminal offence data? · ICO
- Equality Act 2010, section 4 · legislation.gov.uk
- Equality Act 2010, section 39 · legislation.gov.uk
- Trade Union and Labour Relations (Consolidation) Act 1992, section 137 · legislation.gov.uk
- Religion or belief discrimination: what the law says · Acas
- Religious belief and political opinion discrimination · nidirect
- FIT 1 General · FCA Handbook
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Can we reject a candidate whose public views we disagree with?
Not on that basis alone. The ICO says you should not make assumptions about suitability based on special category information such as political views, even where the person made it public. The narrow exception is information significantly relevant to the role, as in its example of a political party recruiting a secretary for its leader. For staff assessed under the FCA's fit and proper test, FIT 1.3.21G says that, subject to the rest of FIT 1.3, a person can lawfully express controversial views on social media without calling their fitness into question.
Does an old post count?
Only if it still suggests a current risk relevant to the role. The ICO warns that online information may be out of date, and that candidates may have changed their views. Record the date of anything flagged and ask the candidate about it before relying on it.
What if the reviewer sees something serious that is not on the criteria list?
Our view: if it suggests an immediate risk of harm to someone, the reviewer should raise it with whoever handles safeguarding or security concerns, not with the hiring panel. Otherwise it stays out of the decision, and you review the criteria before the next campaign.
Can a 'values' mismatch be a flag?
Only narrowly. In the ICO's charity example, a public-facing role leads the charity to consider checking that public behaviour is not inconsistent with its values, but the ICO says the charity must decide whether, on balance, the checks are necessary and proportionate. Our view: describe the conduct you are looking for, not a general fit.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Guides
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
- Which social media platforms can employers screen? UK law does not list platforms. How public versus private information, purpose, relevance and consistency decide what an employer can look at.
- False positives in online background checks: name matching and context How UK employers avoid acting on the wrong person or a misread post in online checks: namesakes, old posts, fake accounts, tags and context.
- What a good social media screening report looks like A fictional, annotated social media screening report for a care worker role, showing what a UK employer should record at each step and why.
Related answers
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How does the law protect religion or belief at work? Religion or belief is one of the nine protected characteristics in the Equality Act 2010. It covers any religion, any religious or philosophical belief, and having no religion or belief. Employers must not directly or indirectly discriminate, harass or victimise anyone because of it, and Acas says they should try to accommodate related requests where possible.
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.