Taking Up Workplace References

There are few guarantees in this world and employing new staff is no exception but taking up references is one way of checking certain facts.

Except in specifically regulated sectors, employers are not obliged to provide a reference and can refuse to do so (though organisations should be consistent in their approach otherwise the possibility of discrimination or victimisation claims may arise).

When responding to a reference request, you must consider and document the lawful basis for processing the employee’s personal data. Before I give a reference, I expect to see the data subject’s express permission. The lawful grounds or conditions which should usually be relied upon will be either that the processing is necessary for the performance of the contract with the employee or that it is necessary to fulfil a legal obligation.

Generally, consent given by employees will not be valid because of the imbalance in the power relationship. The situation is likely to be different in the case of references where it is the employee who wishes the reference to be given and they are not in any way under pressure from the current employer which might invalidate any consent given.

You can document a data subject’s consent in two ways. Firstly, at an exit interview you can ask the employee for their consent to retain information and process it for the purposes of providing future references and record this in a suitable format. Secondly, the current employer could put the onus on the prospective employer and make sure that it documents and produces the employee’s consent to the current employer providing a reference.

Any consent form used should document precisely what the data subject has consented to their former employee disclosing.

You may want to know about a prospective employee’s sickness or reasons for periods of absence. Under the GDPR health data falls under a special category of data and requires different grounds for processing but this does not apply where there has been “explicit, unambiguous consent” from the data subject. However, any reference requests relating to an employee’s health should be treated with extreme caution and that very specific consent is in place before any such disclosure is made.

Under the Data Protection Act 1998 employees had rights of subject access to personal information held by their current or former employer and this could, in principle, include references given by current or former employers. There was an exemption whereby an employer who provided a confidential reference was permitted to decline to disclose this to the employee. This protection was undermined by the fact that the employees could apply to the recipient employer for a copy of that reference. The recipient employer could not rely upon the same exemption.

The GDPR and DPA 2018, still give employees the right to make subject access requests, but the loophole in the previous legislation has been closed and personal data held by either the giver or the recipient of a reference may be withheld where it consists of a reference given or to be given in confidence for the purposes of the following.

Even though access to a confidential reference may have been made more difficult, an employee who is unhappy with the content of a reference being given by a current or former employer may be able to rely upon exercising their enhanced data subject rights including the right to restrict processing, erasure, object, and rectification.

The GDPR requires that any consent given to processing must be as easy to withdraw as it was to provide so employers will need to be aware of notification of withdrawal of consent and alter their practice accordingly in respect of any employee.

If you’re an employer with HR queries and problems, get in touch!

Sign up for our free resources and free weekly tip - subscribe here.



DISCLAIMER

Although every effort has been made to ensure the accuracy of the information contained in this blog, nothing herein should be construed as giving advice and no responsibility will be taken for inaccuracies or errors.

Copyright © 2022 all rights reserved. You may copy or distribute this blog as long as this copyright notice and full information about contacting the author are attached. The author is Kate Russell of Russell HR Consulting Ltd.