Data protection and references

Provision of a reference will generally involve the processing of personal data for Data Protection Act 2018 (DPA) purposes. The Data Protection Act 2018 (DPA) is the UK’s third generation of data protection law, aiming to modernise all laws surrounding data protection. It is to be read in conjunction with the General Data Protection Regulation (GDPR), which came into force in May 2018.

Under provisions highlighted in both the GDPR and DPA, employees must give consent for their personal data to be processed

This means, for example, that employers should avoid giving the reason for any sickness absence without the employee’s permission.

Disclosure of the reference

Confidential employment references are exempt from disclosure under a subject access request. This exemption applies to subject access requests made to both the organisation who provided the reference, and the organisation who received the reference. If an employer is asked to disclose the reference that it has received from a previous employer, they can still choose to do so but third party information, such as the identity of the author, should not be disclosed without consent unless it is reasonable to disclose without this. The employer should ask the previous employer if it objects to the reference being disclosed and, if so, its reasons for objecting.

In most circumstances, even if the referee has refused to consent to its disclosure, the employer can choose to provide the information without disclosing third party information. In these circumstances, the employer should balance the referee’s interest in having any comments treated as confidential against the employee’s interest in seeing the reference.

The Information Commissioner recommends that the following should be taken into account, in balancing these competing interests:

• Any express assurance of confidentiality which may have been given to the referee
• The reasons given by the referee for withholding consent
• The potential or actual effect of the reference on the employee (including whether the employee has lost or is likely to lose a position as a result)
• The fact that, without seeing the reference, the employee will not be able to challenge its accuracy
• The fact that good employment practice suggests that the employee should already have been advised of any matters which have led to unfavourable comments
• Any threat to the referee (for example, whether there has been a realistic threat of violence or intimidation)

In order to prevent disclosing third party information without consent, before disclosure the employer can omit any identifying information, only release parts of the reference or provide a summary of the content of the reference. This may protect the identity of the referee, while providing the employee with an overview of what the reference says.