In providing a reference confirming an employee’s name, dates of employment, absence record etc you are processing data. The General Data Protection Regulations therefore apply.
Express consent must therefore be given by the employee unless the data is being processed for one of the following reasons: –
- the processing is necessary for the employer to comply with their legal obligations;
- the processing is necessary for an employer to comply with a contractual obligation; or
- there is a legitimate interest for the employer to provide a reference.
In the vast majority of cases, none of these exclusions will apply. As such, you should ensure that the express consent of the employee is given before providing a reference.
A practical solution would be to ask the new/prospective employer to obtain express consent from the employee and provide you with a copy before you provide the reference.
The consent should be signed by the employee and should refer to the specific details that have been requested.
If you have any queries about this or any other aspect of employment law please do not hesitate to contact me on 01789 336 957 or firstname.lastname@example.org