Legal FAQs – Subject Access Request

A former candidate has submitted a Subject Access Request asking to see a reference that we obtained from their previous employer. Am I able to give it to them?

Under the Data Protection Act 2018, there are certain exemptions that apply which do not require you to disclose certain information in response to a Subject Access Request. One of these exemptions relates to references given in confidence in connection with employment. If this is so then the exemption to disclose will apply and the candidate will not be able see it – unless the former employer who provided the reference has given its consent to do so.

If a reference has been given to you in confidence and you are therefore relying on this exemption, you should ensure that you document the reasons why you have not disclosed it. When you are responding to the candidate’s Subject Access Request you should also clearly explain to the candidate why you will not be disclosing the reference. In the event that the candidate raises a complaint with the Information Commissioner’s Office (the body responsible for enforcing data protection laws) regarding any failure to disclose the reference, you may be required to show evidence as to how you reached your decision.

If you receive a reference which has not been provided in confidence by the former employer, then you may be able to share/send it to your candidate. If it is unclear whether the former employer intended for the reference to be for the recipient’s eyes only, it is recommended that you contact the former employer for clarification.

If you are certain that the reference has not been given in confidence, meaning that it can be disclosed, you will need to ensure that any information included on the reference, which does not concern the candidate (for example information regarding third parties) is redacted - unless you have obtained consent from the third parties to share that information or unless it is reasonable for you to provide this information without the other individual’s consent. This requires you to balance the rights of the candidate to access their personal data against the third party’s rights regarding their own information.

The ICO have provided further guidance on references and exemptions here. For the avoidance of doubt and for future reference, it is recommended that you confirm with an employer upon request for a reference, whether it should be kept confidential, or whether it can be shared with a candidate – should they request for it.

Download the latest Legal bulletin here.