30 May 2006
Employers are required to handle large amounts of information relating to their employees and workers. It is possible that most if not all of this information will be categorised as "personal data" for the purposes of the Data Protection Act 1998 ("DPA 1998").
Personal data is defined as information which relates to a living individual who can be identified from that information. Although that definition has been subject to considerable discussion in recent court cases, some examples of personal data include an individual’s name and address, still or moving pictures of an individual, or their e-mail address, particularly if that address includes the individual’s name.
Employers may be asked to provide references about workers or employees
– both past and current – for a variety of reasons. These may include character references as part of legal proceedings, financial references under mortgage applications, and references to be issued to prospective new employers. References will inevitably contain much personal information about the individual concerned.
An employee reference may occasionally contain information which the author did not intend to be seen by the individual concerned. As a result, some employers have struggled when individuals have presented a request to have sight of that information. It is often difficult for the employer to gauge to what extent the information contained in an employee reference should remain confidential.
Subject access requests
All individuals, including workers and employees, are entitled to have access to the personal data which is held about them by "data controllers". The employer is regarded as a data controller for these purposes. On this basis, an employee or worker has the same rights of access to files containing information about him or herself as anyone else.
It is important to bear in mind that the DPA 1998 covers manual records as well as computer records, and so that the fact that a reference may have been scribbled on a former employer’s headed paper will not prevent it from being disclosed.
Are references confidential?
The DPA 1998 provides that employment references which are given by the data controller in confidence will be exempt, provided the reference is given for the purposes of education, training or employment (including future employment) of the individual.
Such references will be exempt, but only from the subject access request provisions of the DPA 1998. The information contained within them must still used (or ‘processed’) fairly and lawfully in accordance with the provisions of the DPA 1998. Importantly, only employment references which are confidential will be exempt. Employees will therefore be entitled to request sight of any references which are not clearly marked as being confidential.
Another important point is that this provision of the DPA 1998 only applies to confidential references given by the data controller itself. In these circumstances, if an employer holds any reference
– including confidential references – given by a former employer, then the employee is entitled to request access to them. (The DPA 1998 provides limited exemptions from this rule in respect of Crown Employment and the armed forces). The thinking behind this is that individuals should have the right to challenge information which they consider to be misleading or inaccurate, especially when the information may have an adverse effect on their future employment prospects.
The individual however is only entitled to access information on him or herself, and not information about other people. The difficulty is that a reference will invariably contain "personal data" of another person, that of the author. Disclosure of a reference is likely to involve the identification of the author and their opinions. In doing so, the employer could be breaching the provisions of the DPA 1998.
Good practice
Recently, the Information Commissioner issued a data protection good practice note on this subject. The notes are intended to be practical, user-friendly guides for employers, and they include some important "do’s and don’ts".
One important consideration is that although a reference may be marked "in confidence", the information contained within it may not automatically be confidential. The message is that employers are expected to consider the information contained in the reference carefully before forming a view on whether or not to disclose it. For instance, there is little point in withholding factual information which is already known to the individual such as dates of employment, absence records, positions held and so on.
Where expressions of opinion are involved, the Information Commissioner suggests that it may be sensible for the employer to contact the organisation which provided the reference. By contacting the author of that reference, it will be possible for the employer to confirm whether or not the information contained in the reference is already known to the individual and/or whether the author has any objection to that information being made available to the individual. Prudent employers will ask the author to clarify this fact at the time when the reference is provided.
Conclusion
In summary, a worker or employee does not have the right to request access to a confidential job reference from the company or organisation which gave it. Once that reference is in the possession of the recipient, however, then the individual is entitled to request access to it.
When faced with a subject access request for information contained within the reference, the recipient may need to perform a balancing act to determine whether or not to withhold certain elements of that information. The recipient will always have the right, however, to take steps to prevent the disclosure of the identity of the third party which provided the reference and/or to protect the identity of the author (although in many cases it will be obvious to the individual who the author was).
As a matter of general good practice, employers should not keep references provided by former employers or other third parties for any longer than is necessary. Once a decision has been taken to hire or employ the individual, a reference for him or her should generally be deleted or otherwise destroyed as there is no genuine business need for retaining it.