30 January 2006

The Information Commissioner's Office (ICO) is the UK's independent public body established to promote access to official information and to protect personal information. It regulates and enforces the Data Protection Act, the Freedom of Information Act, the Privacy and Electronic Communications Regulations and the Environmental Information Regulations.

One of the regular types of queries that the ICO deals with is in relation to employment references. For example, it is often asked about whether organisations can release a reference to the person who is the subject of the reference; how the Act applies to references; and what are the implications of references given ‘in confidence’. A practice note, recently issued by the ICO helps to answer these questions by clarifying how, and to what extent, the Data Protection Act 1998 applies to employment references.

This note explains the following;

• If someone asks for a copy of a confidential reference you have written about them, relating to training, employment or providing a service, you do not have to provide it. However, you may choose to provide the information if it is sensible to do so.
• References you have received from a third party, for example a previous employer, are not subject to the same rule. If you receive a written request and a fee of up to £10, it will be a subject access request and in most situations, you will have to provide the information within 40 days of the request.
• Electronic data tends to be covered by the Act, so you are generally obliged to reveal personal data that is saved in this manner. Therefore, if you would prefer that an employee did not read what you have put in his/her reference, it is recommended that you send the reference by post, not email.
• If you receive references that are marked ‘in confidence’ you will need to consider whether the information is actually confidential. You should disclose information which is already known to the individual, for example factual information such as employment dates or detail relating to performance which was discussed with them in an appraisal. 
• If the reference contains information which you are not sure about, for example the referee's opinions, it is a good idea to contact them and ask whether they object to this being provided and why. If the referee declines, you will still need to provide the reference if it is reasonable in all the circumstances to comply with the request without their consent.

Remember that whenever you are processing data there are eight principles which must be complied with.

Data must be: 

• Processed fairly and lawfully
• Protected by appropriate security
• Obtained for specified and lawful purposes and not further processed in a manner incompatible with that purpose
• Adequate, relevant and not excessive
• Accurate and where necessary up to date
• Kept for no longer than is necessary
• Processed in accordance with the individual’s rights
• Not transferred outside the European Economic Area without adequate protection.

If you would like further information about data protection then please contact the info-line.