S.L. 460.43 Art. 15Background checks. 21    Cap. 586.

(1) Critical entities shall conduct backgrounds checks on persons who:

(a) hold sensitive roles in, or for the benefit of the critical entity, in particular in relation to the resilience of the critical entity;

(b) are authorised to directly or remotely access its premises, information or control systems, including in connection with the security of the critical entity;

(c) are under consideration for recruitment to positions that fall under the criteria established in paragraph (a) or (b).

(2) To conduct background checks on persons, the management bodies of critical entities shall:

(a) establish the person’s identity on the basis of documentary evidence;

(b) collect and verify the criminal records of the person in all states of residence during at least the preceding five

(5) years. A "state of residence" shall be any country in which the person has been resident continuously for at least six (6)

months:

Provided that when carrying out background checks, the management bodies of critical entities shall use the European Criminal Records Information System in accordance with the procedures established in Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States and, where relevant and applicable, Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 for the purpose of obtaining information from criminal records held by other Member States. The central authorities referred to in article 3(1) of Framework Decision 2009/315/JHA and in article 3(5) of Regulation

(EU) 2019/816, shall provide replies to requests for such information within ten (10) working days from the date on which the request was received in accordance with article 8(1) of Framework Decision 2009/ 315/JHA.

(3) The management bodies of critical entities shall not allow a person to hold the roles and positions referred to in sub-article

(1) if from the information indicated in the criminal records it results that the person has been found guilty of an offence and the punishment awarded was of a term of imprisonment of thirty (30) months or more, whether or otherwise such term of imprisonment has been suspended.

(4) Requests as referred to in this article shall be assessed within a reasonable timeframe and processed in accordance with the

Data Protection Act and relevant and applicable Union law. Background checks shall be proportionate and strictly limited to what is necessary. They shall be carried out for the sole purpose of evaluating a potential security risk to the critical entity concerned.