New Data Subject Access Request Code of Practice — References

Employers often refuse to hand over negative references to their employees, citing data protection laws. Reps should note that in August 2013, the Information Commissioner published a new Code of Practice on dealing with requests from individuals for personal information. Pages 40-41 deal specifically with confidential references.

The Code says:

• just because references are given in confidence, this does not make them exempt from disclosure following a data subject access request.

• the Data Protection Act distinguishes between references given and received by an employer.

• references given by an employer in confidence and for the purpose of someone’s education, training or employment or the supply of a service by them are exempt from production under a data subject access request but there is no such exemption for references an employer receives from a third party, such as the old employer.

• if the old employer objects to disclosure on the basis that the reference was provided in confidence, the new employer should contact the author and find out whether they object to disclosure and if so why.

• even if they object, the new employer must weigh up the referee’s interest in having their comments treated confidentially as against the individual’s interest in knowing what has been said about them.