The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), which implemented many of its provisions, are now over a year old. The aim of the GDPR was to increase the protection of individuals’ personal data. Employees are better informed than ever of their data protection rights, with employers receiving an increased number of subject access requests from their employees.
Interesting, however, under the DPA, individuals are not entitled access to a confidential employment reference written about them; neither from the author of the reference i.e. the ex-employer, nor from the recipient of the reference i.e. the new or prospective employer. In order for ex-employers to refuse disclosure (should they wish to do so), the reference should clearly state that it is confidential, intended for the attention of the recipient only and that the author does not give permission for it to be disclosed to the subject.
Under the previous Data Protection Act 1998, the exemption relating to confidential references applied only where the employee made the request to the employer that provided the reference. The employee could therefore access the reference by making a request to the employer that received the reference instead. This provision (which was considered an anomaly) was removed by the DPA.
The author of a reference owes a duty of care to both the subject of the reference and the reference recipient. Caselaw has established that where a reference is given, the reference must in substance be true, accurate and fair, and must not give a misleading impression. Most job offers are conditional upon receipt of satisfactory employment references. Clearly, an unfavourable reference can harm an individual’s future employment prospects and result in the prospective employer withdrawing an offer or dismissing an employee during their probationary period. This means that the balance in the employer’s favour may be disproportionate in cases where a reference is open to challenge due to being factually incorrect, or generally giving a misleading impression. Of course, where the individual is not permitted access to a reference, they are unable to challenge its contents. Where the individual has evidence that the ex-employer had provided a negligent reference, they could bring a claim in the county court and request that the court orders disclosure of the reference.
This statutory exemption could mean that the UK is in breach of Article 8 of the European Convention of Human Rights in respect of an individual’s qualified right to a private life, as it is questionable whether the exemption which permits the reference to be withheld is proportionate to the individual’s right to fairness and transparency regarding their personal data. It is possible that at some point, the UK courts will receive a challenge to the legislation on this basis. However, as the law currently stands, employers can continue to rely on this exemption, which means that any request for access to personal data contained in an employment reference which is clearly stated to be confidential, is exempt from disclosure.
