Must an employer always obtain an individual's consent before providing a reference for them?

Providing a reference is likely to involve processing personal data under the UK General Data Protection Regulation (retained from EU Regulation 2016/679 EU) (UK GDPR). Therefore, the employer must ensure that it has a legal basis for processing data as set out in the UK GDPR. In relation to a reference, the most likely condition to apply is that the individual has consented to the data being processed. Generally, in the employment context an employer cannot rely on employees' consent to process their data, as the imbalance of power in the employment relationship can mean that consent is not freely given. However, in the context of providing a reference, an employee or former employee is likely to have a genuine choice about whether or not to consent.

The prospective employer will often enclose a photocopy of the individual's signed consent to its seeking the reference in the reference request. This will normally be sufficient for the employer to process the personal data.

Employers could have a policy of keeping a record on file of whether or not a former employee wishes the employer to provide references on them. For example, the employer could ask the employee this question at an exit interview, or it could be included on an exit questionnaire.

If the employer has any doubts about whether or not the individual has given consent, it should contact them to check that they wish the reference to be provided. The employer should obtain the consent in writing if possible, or should at least make a note of the individual's verbal consent.