In part one of this article, we looked at whether employers have to seek references when recruiting, whether there's a legal obligation for a previous employer to give a reference to their ex-employee, and whether a new employer withdraw a job offer on receipt of a bad reference. Read on for more information on professional references.

When a previous employer provides a reference what obligations do they have?

• An employer owes a duty of care to the recipient of the reference (the prospective employer) to ensure that it is true, accurate and fair, and doesn't give a misleading impression. The employer giving the reference could be sued by the recipient if it gives a negligent or careless reference which subsequently results in financial loss to the recipient

• The employer also owes a duty to the ex-employee to take reasonable care in the preparation of the reference. If, for example, the employee fails to secure a new job because of an inaccurate or misleading reference, he or she will be able to sue his or her ex-employer for damages (libel, discrimination or defamation of character). Following a case in 2011 that went to the High Court, this appears to apply regardless of how many years ago the employee left their previous employer

• Employers should therefore ensure that the information they give in a reference is accurate and genuinely or reasonably believed

• Employers should always be consistent about they type of information they provide on references, and when references are given. Employers should consider whether they have need for a Reference Giving Policy that makes this clear.

In addition, an employer, when providing a reference, is likely to access personal data, which falls under the General Data Protection Regulations 2018.

Therefore, the employer must satisfy one of the conditions required for processing data and when giving references – the most likely condition to apply is that the individual employee has consented to the data being processed. Confirming dates of employment and length of service and probably salary should not be a problem as this is factual information, even though it is of course ‘personal data’ of an employee, but confirming an employees attendance records, or disciplinary records may require specific consent from the employee which may be hard or impossible to achieve, as under GPDR, consent must be voluntary, explicit and informed.

The Data Protection Employment Practices Code recommends

• That employers have a policy on giving references that includes a requirement that “all those giving corporate references must be satisfied that the worker wishes the reference to be provided”
• When an employee leaves the company, the employer should keep a record on file of whether or not the employee wishes the employer to provide references on him or her.

The Code isn’t legally binding, but can be taken into account by a Court or Tribunal if there’s a complaint. This Code has not yet been updated for GDPR (September 2018).The prospective employer could send the previous employer a photocopy of the individual's signed consent to its seeking the reference, in the reference request. This will normally be sufficient for the previous employer to process the personal data.

If the previous employer has any doubts about whether or not the employee has given consent to the reference, they should contact the employee to check. The employer should obtain their consent in writing if possible, or should at least make a note of the individual's verbal consent.

The employer must not provide sensitive personal or special category data in a reference, for example information about the individual’s health, race or trade union membership, without first obtaining the employee's explicit consent.

To obtain the individual’s explicit consent, the employer should write to him or her, asking for their written consent to the request and clearly stating:

• Why it wishes to process the data
• The specific information to be processed
• To whom the information is being given to
• For what purpose the information is being provided.

References should also be marked ‘confidential’ and for the attention of the addressee only.

Many employers add a disclaimer to the reference, stating that they can’t accept any liability for errors or omissions in the content of the reference. A disclaimer will be effective only if it’s reasonable. If the employer has, or would be expected to have, direct knowledge of the information provided, it’s unlikely to be able to rely on a disclaimer if the reference contains information that’s not true, accurate and fair.

With the introduction of the GDPR, the position that many Employers now take, when giving references for ex-employees, may become more prevalent - it is easier to decline to give a reference, because you are not processing data, if you do not provide any information!

‍If you are an Employer and need ongoing professional help with any staff/freelance issues then talk to Lesley at The HR Kiosk  - a Human Resources Consultancy for small businesses – our fees are low to reflect the pressures on small businesses and you can hire us for as much time as you need.

Please note that the advice given on this website and by our Advisors is guidance only and cannot be taken as an authoritative or current interpretation of the law. It can also not be seen as specific advice for individual cases. Please also note that there are differences in legislation in Northern Ireland.