Firstly, there is no legal obligation for an employer to provide a reference. However, there may be a contractual obligation if provision of a reference is stated in terms of employment or a contractual staff handbook.

The GDPR and Data Protection Act 2018 (“DPA 2018”) require a lawful basis for processing personal data. This is particularly pertinent to references as they may also contain “special category" personal data e.g. sickness absence details.

Consent is one of the lawful bases that can be relied upon for processing personal data. However, ICO guidance suggests that consent is not the most appropriate basis in the context of an employment relationship due to the imbalance of power.

Other lawful bases for processing under the GDPR are:

• processing necessary for an employer to comply with their legal obligations;
• processing necessary for an employer to perform their side of the employment contract; and
• processing which the employer has a legitimate interest for carrying out.

Provision of a reference is not necessary for compliance with legal obligations, it is unlikely to be necessary for performance of a contract (unless explicitly stated that a reference will be provided) and as it is for the benefit of the employee, it is unlikely to be a legitimate interest. Therefore, consent is likely to be the most viable basis because a reference will be for an employee's benefit so they are likely to have a genuine inclination to give their consent.

Many references will contain “special category" personal data i.e. data containing information about an employee’s health. Therefore, under Article 9, if consent is being relied upon it must be "explicit".

Employers should ensure that they keep a clear record of consent, including the precise type(s) of information that an employee permits to be included in his/her reference.

Another option for an employer is to place the onus onto an employee’s new employer to require them to obtain the necessary consent for particular details in a reference.

The DPA 2018 and GDPR also limit the scope for an employee who is unhappy with the contents of a reference to prevent such information being disclosed. Under the DPA 2018, an employee would have to rely upon his/her right to erasure or right to limit processing. 

N.B Schedule 2 to the Data Protection Act 2018 (which supplements the GDPR)  allows employers to refuse to disclose a confidential employment reference to an employee or former employee if he or she requests access to it.

Perhaps to avoid confusion we should say that: