The rules haven't really changed about who could/can require CRB/DBS checks for their employees; they've simply between clarified under the new system which has recently been introduced.
CRB/DBS checks could/can only be called for when the relevant person would be working with, or in close contact with, young/vulnerable people on a regular basis. [I'm ignoring jobs within the administration of justice, etc, as they clearly aren't relevant here]. If there were no such people on the college site at the time that your husband would have been working there, then no CRB check could be carried out. However if, say, the college premises were being used for a summer school for young people at that time then, clearly, the employer would have had the right to call for a CRB check.
Employers can sometimes be put in a difficult position by inflexible education authorities who state they won't give a contract for anyone to work in their schools or colleges unless all employees have been through CRB/DBS checks, even though the contract relates to a period when no young people will be present. It's easy to see why employers would simply go along with such a requirement, even though it's unjust and unlawful.