Must an employer always obtain an individual's consent before providing a reference for him or her?

Providing a reference is likely to involve processing personal data under the General Data Protection Regulation (2016/679 EU) (GDPR), which is in force from 25 May 2018. Therefore, the employer must ensure that it has a legal basis for processing data as set out in the GDPR. In relation to a reference, the most likely condition to apply is that the individual has consented to the data being processed. Generally, in the employment context an employer cannot rely on an employee's consent to process his or her data, as the imbalance of power in the employment relationship can mean that consent is not freely given. However, in the context of providing a reference, an employee or former employee is likely to have a genuine choice about whether or not to consent.

The Information Commissioner's Data protection employment practices code recommends that employers have a policy on giving references that includes a requirement that "all those giving corporate references must be satisfied that the worker wishes the reference to be provided". While the code relates to the Data Protection Act 1998, rather than the GDPR regime, it remains useful for employers, pending updated guidance from the Information Commissioner. The code also recommends that, when an employee leaves the organisation, the employer should keep a record on file of whether or not the employee wishes the employer to provide references on him or her. For example, the employer could ask the employee this question at an exit interview, or it could be included on an exit questionnaire.

The prospective employer will often enclose a photocopy of the individual's signed consent to its seeking the reference in the reference request. This will normally be sufficient for the employer to process the personal data.

If the employer has any doubts about whether or not the individual has given consent, it should contact him or her to check that he or she wishes the reference to be provided. The employer should obtain the consent in writing if possible, or should at least make a note of the individual's verbal consent.