What rights of access do employees have to job references?

Generally, employees have the right under the General Data Protection Regulation (2016/679 EU) (GDPR) to access information that organisations hold about them. However, there is an exemption under sch.2 to the Data Protection Act 2018 (which supplements the GDPR) that allows employers to refuse to disclose a confidential employment reference to an employee or former employee if they request access to it.

Under the previous data protection regime, the equivalent exemption relating to confidential references under the Data Protection Act 1998 applied only where the employee made the request to the employer that provided the reference. The employee could therefore access the reference by making a request to the employer that received the reference instead. This anomaly is removed by the Data Protection Act 2018.

An employer that is covered by the exemption and does not therefore have to provide access to the reference can choose to do so anyway. It should be careful not to disclose information about a third party, for example the person who wrote the reference, unless that person has consented to the disclosure or it is reasonable to disclose the reference without their consent. Where the third party does not consent, the employer could choose to disclose as much of the reference as possible without revealing the identity of the author, by the omission of the author's name and other identifying particulars.