Clearly another quiet week over at Acas if its new guidance on employment references is anything to go by. It is, in all honesty, a bit on the basic side, even including an answer to that never-asked question – what is an employment reference?

Bar one point, the guidance adds nothing to the sum of human knowledge, but it does touch briefly on the impact of the GDPR on the provision of employment references. It must be remembered that such references will inevitably include the personal data of your employee or former employee, whether it is just bland details of dates or role, or more useful comments on their performance or personality. We have in the past all responded unthinkingly to reference requests for staff with such information, but the GDPR reminds us to consider on what legal basis that processing is now taking place. After all, outside certain highly regulated industries (NB Acas, the Financial Services Authority became the Financial Conduct Authority in 2013) there is no legal obligation to provide a reference.   Doing so isn’t necessary for the performance of any contract between you and your current or former employee, so that won’t work either. You are essentially thrown back on consent as the only potential GDPR-compliant basis for processing the personal data contained in a reference.

But under the GDPR consent must be voluntary, explicit, informed, etc. Technically that probably means the employee has to consent not just to the principle of your providing a reference for him but also to its precise wording as it relates to him, and maybe even to each intended recipient of it. Of course in practice it would be very hard for an employee to make any sort of complaint about the disclosure by an ex-employer of information which is factually beyond argument, especially dates of employment, job title, possibly salary, etc. even if he did not consent to the particular addressee. Therefore, the continued provision of such references without that sort of consent is in practical terms unlikely to get you into trouble.

Unlikely, but not impossible. The Acas guidance makes it clear that employers cansay in references (IF it is accurate, fair and not subjective) that someone wasn’t very good or (expressly or by implication) that they lacked the experience, skills or aptitude necessary for the role being applied for. Those may well be facts too, but they are also personal data and disclosure of them could do serious damage to the departing employee’s prospects. Even the disclosure of unarguable facts, while unchallengeable as a reference, could still be a breach of the GDPR and thereby create a claim for compensation as a result. There are again practical limits to this – one of our clients has been threatened with a report to the ICO as a consequence of its including in a reference without consent information about the employee’s salary and role which, though entirely accurate, tragically undermined his efforts to mislead his next employer on both counts. We are still awaiting any sign of interest in this terrible injustice from the ICO.

So we reach the practical position that if your reference will include only that the employee worked for you from A to B as C, seeking express consent is probably unnecessary. The same is true if any subjective comment you propose to make is entirely positive. Once you get into the more touchy areas sometimes requested by prospective employers (salary, absence record, disciplinary history, etc.) then specific consent should ideally be sought. However, if you intend to say anything remotely slighting about your employee, you would be most unwise to do so without his express consent. Which will of course never be given, so Acas’ new guidance is perhaps a little misleading in gaily okaying negative references so long as the facts justify them.

Outside the occasional regulatory requirement, therefore, the days of the bad (as opposed to merely unhelpful) reference would seem to be over. It will almost always be easier simply to decline to provide a reference at all (hence no processing of the employee’s personal data to engage the GDPR) than to give one which (a) he has not consented to; and (b) may cause any damage to him. So farewell to all those old 1980s favourites: “He was fired with enthusiasm“, “You will be lucky to get him to work for you” and a particular pet of one of my older and more cynical clients of those days: “She always worked to her own entire satisfaction“.