References - Subject's Right of Access

Under the Data Protection Act, 1998, an individual has a right to a copy of information held about them that is covered by the Act.  However, when this information relates to references about that individual then the following should be taken into account:

The Data Protection Act 1998 applies differently to references which have been given by an employer and those which have been received by an employer.

1. References provided by the University
   There is no obligation under the Data Protection Act (DPA) for the data controller (the University) to provide a copy of a reference to the applicant (Schedule 7).
   
   This includes confidential references provided for the purposes of:
   
   (a) the education, training or employment, or prospective education, training or employment, of the data subject,
   (b) the appointment, or prospective appointment, of the data subject to any office, or
   (c) the provision, or prospective provision, by the data subject of any service.
   
   However, release of such information is at the University’s discretion.  The University will be guided by the Information Commissioner’s Office (ICO), which is of the opinion that ‘it would seem reasonable to provide a copy if a reference is wholly or largely factual in nature, or if the individual is aware of an appraisal of their work or ability.’¹
   
   
2. References received by the University
   References received by the University from another person or organisation are not exempt under the Act and should be considered for disclosure as normal as part of a Subject Access Request.
   
   References may have been provided ‘in confidence’ to the University however, it is not appropriate to use this as a reason for not disclosing any information at all.  It will need to be determined whether the information is actually ‘confidential’. A large proportion of the information contained within a reference will already be known to the individual, i.e. employment dates, absence records etc. 

• Where it is unclear whether or not the information, including the referee’s opinion, is known to the individual contact should be made with the referee to ask them if they have any objection to the information being given out and why.
• Even if a referee says that they do not want their comments released, the reference should be disclosed if it is reasonable in all the circumstances to comply with the request without the referee’s consent. A balance between the referee’s interests in having their comments treated confidentially and the individual’s interest in seeing what has been said about them should be struck.

When considering whether it is reasonable in all the circumstances to comply with a request, the following should be taken into account:

• any express assurance of confidentiality given to the referee;
• any relevant reasons the referee gives for withholding consent;
• the potential or actual effect of the reference on the individual;
• the fact that a reference must be truthful and accurate and that without access to it the individual is not in a position to challenge its accuracy;
• that good employment practice suggests that an employee should have already been advised of any weaknesses; and
• any risk to the referee

It should also be considered whether it is possible to keep the identity of the referee secret.

     3.  Recommended good practice
In most circumstances, you should provide the information in a reference, or at least a substantial part of it, to the person it is about if they ask for it. Even if the referee refuses consent, this will not necessarily justify withholding the information, particularly where this has had a significant impact on the individual, such as preventing them from taking up a provisional job offer.

However, there may be circumstances where it would not be appropriate for you to release a reference, such as where there is a realistic threat of violence or intimidation by the individual towards the referee. You should consider whether it is possible to conceal the identity of the referee, although often an individual will have a good idea who has written the reference.

If it is not reasonable in all of the circumstances to provide the information without the referee’s consent, you should consider whether you can respond helpfully anyway (for example, by providing a summary of the content of the reference). This may protect the identity of the referee, while providing the individual with an overview of what the reference says about them.

4. Internal Staff References
ICO guidance² is that references that have been provided by one part of the employer’s business to another, for example where an employee is seeking a transfer between departments, are not dealt with in the same way as ‘corporate’ references as described above. In the case of a Subject Access Request being received these internal references should be dealt with in the same way as access to any other information held by the employer about an individual.

^{1http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/references_v1.0_final.pdf   p.1
2http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/coi_html/english/supplementary_guidance/employment_records_1.html Section 2.9 References}