The Office of the Data Protection Authority in Guernsey have ordered the Policy and Resources Committee to release an employment reference.
A jobseeker whose offer of employment was withdrawn after a reference had been provided, requested a copy of it from the Policy & Resources Committee (P&R), the entity it was provided to. They did this by exercising their access request rights under The Data Protection (Bailiwick of Guernsey) Law, 2017 which entitles a person to certain information about themselves.
P&R refused to give the jobseeker the reference on the basis that it contained information about other people.
P&R had performed a balancing test before reaching their decision, deciding that the interests of the person who wrote the reference outweighed those of the jobseeker. The jobseeker had concerns as to why P&R were refusing to tell them what was in the reference and made a formal complaint to the Data Protection Authority. Following investigation, the Authority determined that P&R had not given appropriate consideration to the jobseeker’s significant interests.
It is reasonable for any jobseeker to understand and validate what is being said about them by a previous employer – especially when that information may impact their ability to get a job.
Why was that a problem?
The purpose of access rights is to empower individuals to understand what information about them is being used and for what purpose. This also enables them to validate whether the information about them is accurate.
P&R prevented the jobseeker from understanding what their previous employer had said about them, which meant they were unable to validate its accuracy. This made it difficult to challenge the recruitment decision as well as to exercise other rights available under the Law.
What has happened as a result?
Following the Authority’s investigation, P&R were found to have breached the Law by failing to provide information that the jobseeker was entitled to receive under the right of access.
As part of the Authority’s determination, an Enforcement Order was issued to compel P&R to provide the jobseeker with a copy of the reference, with redactions as agreed by the Authority, to which they were entitled. The Authority can now confirm that P&R did not appeal against the Authority’s Order and has provided the reference as ordered.
What can be learned from this?
Everyone has a right to know what is being said about them, especially when what is being said about them may impact their chances of getting a job. Everyone is entitled to due process, and this includes the ability to validate information about them. The individual was unable to do so in this case.
The second takeaway from this case is that personal data can relate to more than one person simultaneously. This is particularly common when it comes to opinions, such as those contained within employment references. Where personal data relates to more than one person, and cannot be redacted without losing its context, a balancing test must be undertaken to determine whether it is reasonable to refuse to give the information in response to a data subject access request.
The Authority has guidance on its website which explains how to comply in situations where an organisation cannot comply with a request without disclosing information relating to another individual.
Response from the Policy and Resources Committee
The Policy & Resources Committee has stated that they are: “extremely concerned that the legal provisions for the confidentiality around references for job applicants may not be sufficiently robust.
“The issue has come to the fore as a result of a decision by the Office of the Data Protection Authority, against the Committee, and the ODPA’s public statement on the matter today which indicates to all employers that their job references will not necessarily be considered confidential.
“The Committee’s view is that the ODPA’s current interpretation of the law in Guernsey is too narrow and creates a situation where employers will feel unable to provide honest feedback in a reference, effectively removing any real value of references altogether. The Committee believes this has serious implications for recruitment in Guernsey and therefore must be addressed.
“The Committee has accepted the ODPA’s decision in this specific case but intends to discuss with the Committee for Home Affairs what changes should be made to Guernsey’s current data protection legislation. Without a change, the Island is not aligned with England and Wales. The Committee hopes this will lead to changes that ensure the law provides much greater certainty that job references should be treated as confidential in the hands of both the past employer and prospective employer.”
