Must an employer always obtain an individual's consent before providing a reference for him or her?

Providing a reference is likely to involve processing personal data under the Data Protection Act 1998. Therefore, the employer must satisfy one of the conditions required for processing data as set out in sch.2 to the Act. In relation to a reference, the most likely condition to apply is that the individual has consented to the data being processed.

The Information Commissioner's Data protection employment practices code recommends that employers have a policy on giving references that includes a requirement that "all those giving corporate references must be satisfied that the worker wishes the reference to be provided". It also recommends that, when an employee leaves the organisation, the employer should keep a record on file of whether or not the employee wishes the employer to provide references on him or her. For example, the employer could ask the employee this question at an exit interview, or it could be included on an exit questionnaire.

The prospective employer will often enclose a photocopy of the individual's signed consent to its seeking the reference in the reference request. This will normally be sufficient for the employer to process the personal data.

If the employer has any doubts about whether or not the individual has given consent, it should contact him or her to check that he or she wishes the reference to be provided. The employer should obtain the consent in writing if possible, or should at least make a note of the individual 's verbal consent.

The employer must not provide sensitive personal data in a reference, for example information about the individual's health, race or trade union membership, without first obtaining his or her explicit consent. To obtain the individual's explicit consent, the employer should write to him or her, clearly stating: why it wishes to process the data; the specific information to be processed; to whom the data will be provided; and for what purpose the information will be provided. The employer should provide a means for the individual to indicate whether or not he or she consents to the data being processed, for example a form to complete.