GDPR and employment references is one of the things we often hear in our GDPR training courses. People believe that data protection legislation under the GDPR stops you giving bad references. Certainly that the myth that you can’t do this is widely held to be true, whatever the underlying reason.
Of course, like most myths it isn’t true at all.
Contents
What is a Reference?
No-one is obliged to give a reference about a current or former employee. But, it is good practice to provide one.
An employment reference is part of the employment screening process. Providing references helps employers complete the hiring process. It gives them another view about any potential employee and helps make the final decision on whether to formally employ someone.
Many job offers are contingent on satisfactory references.
What do we mean by giving a “bad reference”?
Well, strictly speaking, there is no such thing. You can give a true and accurate reference or a false and inaccurate one. This is where the dilemma for employers, managers and HR lies.
You may well be of the opinion that John Smith was lazy, late, and rude during his time with you. However, did you tell HIM that? And what did you do about it? Of course it is unreasonable to criticise someone to a potential employer when you, as current employer, failed to take action on the faults you are sharing.
If someone is underperforming in their job this needs to be tackled. Either the is situation improved or, in the fullness of time, ended (through termination of employment).
It’s not easy and it definitely isn’t pleasant. I know: I’ve done it. Has someone had the right training? Is there a personal situation affecting their work – and if so how can we adjust working arrangements to help? If someone flat out hates their job then they need to be encouraged to at least be professional so they can earn an accurate reference that praises them and be considered for promotion. You have to be candid about that.
GDPR and Employment References
Fortunately for employers there are two important things in the GDPR to know.
Although people have the right to rectification – to have information that is inaccurate corrected – disagreeing with an opinion about them is not in itself grounds to change that opinion. As long as it is a properly informed and sincerely held opinion it is accurate in the eyes of the person holding it. As such it is not eligible for rectification.
References are also excluded from disclosure as part of a subject access request if given in confidence.
While under the right of access you should still acknowledge that someone’s personal data was used to obtain or provide a reference, you should not share the reference itself.
Schedule 2, Part 4, Section 24 of the Data Protection Act sets this out:
“[the right of access does] not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of (a) the education, training or employment (or prospective education, training or employment) of the data subject.” Data Protection Act 2018
This also means that people do not have the right to complain to the Information Commissioner about any refusal to disclose a reference.
Exemptions to the GDPR in this part of the Act are couched in terms of “may” rather than “shall” restrict. So in theory the choice is yours about whether or not to disclose. However, you risk setting a precedent if you have disclosed references in the past and that potentially could lead to a non-GDPR related claim of discrimination.
Sign Up Here:
Slay the GDPR myth that you can’t give bad references. Focus instead on giving accurate ones that reflect not only your employee’s actions and attributes, but what you have done to support them. An accurate reference must be evidence based, so anything it contains should be capable of being backed up. And, to help ensure GDPR compliance: only answer the questions asked only provide the minimum necessary data; and ensure that any reference you provide will be treated in confidence. Plus six months’ free post course support to help you apply your learningGDPR and Employment References; What to do instead?
Learn More About the GDPR
This GDPR training course includes the following modules:
