Between a rock and a hard place

The GDPR (General Data Protection Regulation) and the Data Protection Act 2018 have ushered in new rights for individuals, such as: the right to rectification, the right to restrict processing and the right to erasure, amongst others. However, upon detailed analysis and practical application, it would appear that some of these rights are more illusory than real.

Prior to the implementation of the Data Protection Act 2018, individuals who were the subject of unfavourable references (employment or otherwise) could obtain information contained within the reference from the organisation which received it. This could be achieved by making a subject access request under the Data Protection Act 1998. Strangely enough, the person or organisation that authored the reference had no obligation to disclose it to the individual. The Data Protection Act 2018 has removed this anomaly. In pursuant to Schedule 2, Part 4, Paragraph 24:

The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of—

(a) the education, training or employment (or prospective education, training or employment) of the data subject…..

 (b) the placement (or prospective placement) of the data subject as a volunteer,

(c) the appointment (or prospective appointment) of the data subject to any office, or

(d) the provision (or prospective provision) by the data subject of any service.

The “listed GDPR provisions” means, inter alia, Article 15 (1) to (3) (confirming or processing, access to data and safeguards for third country transfers).

The new law will help to deliver consistency of application for referees and the receiving organisation/individual, which is a positive development. On the other hand however, it could be argued that the law has inadvertently created a lacuna.

There is now a potential injustice that may be experienced by a job seeker who may be affected by an unfavourable employment reference. Following a successful job application, the candidate would generally be offered the position pending satisfactory employment checks, including references. In those situations where the candidate gave the contact details of one referee and the offer of employment is subsequently withdrawn due to an unfavourable reference, it would be obvious to the candidate who provided the reference (the situation gets more complicated where more than one referee is involved). However, under the new law, the candidate can no longer submit a subject access request to the receiving employer to obtain information within the reference. Ostensibly, the candidate in this scenario could potentially ask the receiving employer to restrict processing, but this right is not absolute and only apply in certain circumstances. One of which is where the individual has challenged the accuracy of their data (i.e. the reference is factually inaccurate). This places the individual in a virtually impossible situation, they cannot exercise their ‘newly bestowed’ GDPR rights without being able to evidence inaccuracies, which is not possible without first obtaining the disputed reference. As mentioned, the latter is not mandated under the Data Protection Act 2018.

The principle of fairness is a central tenet that underpins data protection laws. As such, natural justice demands that candidates should be told the reasons for revoking an offer of employment, rather than an employer hiding behind vague statements such as “unsatisfactory employment checks”.

One of the first maxims of Equity is “ubi jus ibi remedium” - Equity will not suffer a wrong without a remedy. In other words, no wrong should go unaddressed. There is no suggestion that all unfavourable references are inaccurate or wrong. And under civil law employers have a duty to take reasonable care to ensure that references are not misleading or inaccurate. Failure to do so could result in the employer being sued under the law of Tort for negligent misstatement (see the High Court case of Hincks v Sense Network Ltd [2018] EWHC 533 (QB). It can be seen that in order to discharge the burden of proof the individual must adduce evidence ( as opposed to assumption, belief, suspicion or conjecture) to prove his/her case on the balance of probabilities, in the absence of such evidence, it would appear that they are left between a rock and a hard place.