Data Protection Rules and References

What do employers need to know about data protection rules and references?

Providing a reference involves the disclosure and processing of personal data under the UK General Data Protection Regulation (UK GDPR).

So what do employers need to be aware of when responding to a reference request?

Employers must identify a lawful basis for all data processing activities. When providing a reference, this lawful basis is that the data subject (the individual asking for a reference) has given their consent.

For consent to be valid under data protection principles, it must be unambiguous and freely given.

So how does an employer ensure that they have this consent?

1. Record consent at an exit interview
2. Require the prospective employer to obtain written consent

Employers should keep a copy of the evidence of consent to be able to demonstrate their lawful basis for processing.

If you are uncertain whether you have consent, you should always contact the individual to check this and, ideally, obtain the consent in writing.

It is worth noting that GDPR provisions expressly exempt references from data subject access requests (DSARs), meaning that references do not have to be disclosed under a DSAR.

However, care should always be taken if providing anything other than a “basic” reference, containing dates of employment and job role. Employers have a duty of care to ensure that references are truthful and fair and do not mislead the reference receiver. Failing to do so could lead to a civil claim against the reference giver.

If you are unsure whether you have valid consent before responding to a reference request, contact Solutions for HR today.