Asking for employer references – what can you ask, and when? GDPR and other legal considerations.

During the hiring process, employers will usually request the names and contact details of a candidate’s current employer in order to obtain a reference. This allows an employer to learn more about a potential employee’s work history and performance to ensure the potential recruit is a good fit. It also ensures that their application was both an honest and an accurate representation of their current role, while checking for some other important basic traits.

There is no standardised reference request. However, we have seen the following information requested:

• Confirmation of dates of employment (start and end date) with their employer
• Confirmation of their last job role in the company
• Salary
• Job responsibilities
• If there were issues of misconduct
• Character reference
• Absence records for past 12 months
• Relationship with management and co-workers
• Would the employer rehire the employee?
• For non-current roles – why did they leave?

Can I still ask for references after GDPR?

Personal data can only be processed, in this case shared with a prospective employer, if the employer has a lawful basis for processing data.

A lawful basis can be that:

• the processing is necessary for the employer to comply with their legal obligations;
• the processing is necessary for the employer to comply with their side of a contract;
• the employer has a legitimate interest for processing the data; or
• consent has been given by the data subject.

However, an employer is under no legal obligation to provide a reference to a future employer (although this may be different when dealing with a regulator) and it is unlikely there is an obligation to provide a reference in an employment contract (although such obligation may exist in a settlement agreement or COT3 agreement). On most occasions, an employer is unlikely to have a legitimate interest to provide a reference (it is for the employee or future employer’s benefit). As such, the safest ground for an employer to rely on is consent. The GDPR prevents employers from relying upon implied consent or consent set out in a generic contractual clause. Instead, explicit, freely given and unambiguous consent is required.

One would expect the employee to give consent as the reference may be a condition on their job offer. However, an employer should be very careful to ensure that the consent will cover each piece of personal data shared. For example, an employee will be happy to give consent to their dates of employment but in certain cases, may be more reluctant for an employer to share their absence or disciplinary records. A new employer may wish to obtain consent for each question asked and then share this consent with the current employer to encourage the current employer to share such information.

We expect that employers may put in place standard references confirming dates of employment and job title. This will simplify the reference process, as standard forms obtaining consent can be put in place.

It is equally important to consider not only the legal ramifications of failing to obtain consent, but also the potential issues that would cause for the interviewee. Reaching out to their current employer before they have given consent acts to give the current employer notification that an employee is looking to leave. Most employees would prefer the opportunity to break this news to their employer themselves, especially if they have had a good working relationship. Equally, it is not only the potential employer who assesses the fit during the interview, but also the potential employee, who may have weighed-up their options and decided not to go ahead with the job offer. Should they decide that they would be happier to stay at their current place of work, a reference request would likely damage the relationship with their employer.

Note: Current employers, if obtaining consent themselves, should ensure the consent obtained clearly covers all the information that is to be shared. For example, explicit consent to share health records, a special category of personal data, would be required.

What am I allowed to ask?

There is no specific legal guidance on what questions can and cannot be asked. However, employers should avoid asking (or answering) discriminatory questions. For example, a question asking if an employee has raised complaints of discrimination may lead to a victimisation complaint if a job offer is later withdrawn. Moreover, what questions can be asked about health or disability is restricted under the Equality Act 2010. Specific legal advice should be obtained if you need to ask health questions or wish to undertake health screening on potential recruits.

What if I have concerns with the reference I have received?

If necessary, you should ask for more information from the employer.

Otherwise, you can ask for the employee’s side of the story. If your concerns are significant, then you can consider withdrawing any job offer from the employee.

What if the current employer refuses to provide a reference?

There is no obligation to provide a reference. As such, there is little you can do. You could ask the employee to provide a reference from an older employer, you could take the risk but review the employee’s contractual provisions in relation to the probationary period or you could consider withdrawing the job offer.

What if I have doubts that the reference is accurate?

If an employer does provide a reference for an employee or former employee, it should be fair, truthful and accurate. If you have relied on a negligent reference and this has caused your business loss, you may have a claim for damages. You should seek legal advice in these circumstances.