I assume that the background screening you are referring to is made in connection with applying for a job. If so, it would generally be the applicant's (prospect) employer that is primarily responsible for the processing of the personal data in relation to the applicant. The employer outsources the background screening to a service provider, which in GDPR terms is considered a controller-processor relationship (the service provider processes personal data about the applicant on behalf of the employer/the controller).
The same principles generally apply irrespective of whether the data is collected prior to or during the screening. However, depending on the content of such data, different safeguarding requirements may apply.
Consent possibly not reliable
The employer must identify legal grounds for processing the data that a background screening collects (see Article 6 GDPR). It could be argued whether consent is valid ground for background screening considering the imbalance between the parties. In many jurisdictions within the EU, consent in an employment context has generally been very difficult to rely on. If consent could not be relied on, the employer would typically have to argue for that there is a legitimate interest to process the data. (See also Article 88 GDPR.)
A general principle in GDPR is storage limitation (Article 5(1)(e)). It means that a controller (or a processor) may not store personal data for a longer period than necessary. Hence, once the background screening is completed, the employer is not likely allowed to store the data for a longer period than is necessary for completion of the recruitment process. The background screening company should likely not have any use of the data after having provided the background screening report to the employer. The employer may however argue that the information must be stored for some time to be able to manage the recruitment.
Deletion upon request
The applicant has no absolute right to request a deletion of data (which is a common misunderstanding of GDPR). The "right to be forgotten" is a bit different depending on the context of the processing (see Article 17 GDPR):
- If the processing is based on consent, the applicant may request a deletion, which in general must be complied with, but the employer might find other grounds for keeping the data.
- If the processing is based on legitimate interest, the applicant may request a deletion, and the employer will have to re-assess its grounds for keeping the data. If the grounds are still valid, the employer is not obliged to remove the data.
Sharing with third parties
Your question touches upon the issue of parties with which the screening company would share the screening information. Except for with the employer (which has a direct relationship with the applicant), it should be noted that there is very little room in GDPR for the screening company (or the employer) to share the data with any other party, unless the applicant has explicitly consented thereto. Such a third party would then likely be a controller in itself, and the third party would then have a direct responsibility and liability towards the applicant. It would then likely be possible to withdraw the consent, which triggers an obligation to purge the data.
Third party deletion
If the employer is obliged to purge the data (e.g. if consent is withdrawn or there is no remaining legal ground for continuing the processing/storing of data), the background screening service provider should also delete the data. Although also the service provider is bound by GDPR, some responsibility falls upon the employer to stipulate the conditions for such deletion in a contract between the parties (see Article 28(3)(e) GDPR).
This area is a bit tricky and disputed, see for instance here, here and here. A good advice is therefore to review the privacy notices that the employer must provide along with any request to provide information for a background check.
It could also be worth mentioning that a background screening company is generally prohibited from dealing with data relating to criminal convictions and offences (Article 10 GDPR), which to my experience is quite common.