GDPR and Obtaining Consent for Employment Reference Checks

Should employers obtain signed consent from prospective employees when checking references? If so, when is the best time to do this?

Seamus: This has come around because now we've got GDPR in place and everybody is very concerned and uptight and thinking that we need consent for everything - "we need written consent and that's it". And certainly, yes, that's a prudent way to work, but at times it can be very unnecessary to have to think that you need written consent all the time.

Scott: That can be withdrawn anyway. Let's not use it if you don't have to.

Seamus: That's it. And I think this question . . . I mean, I can understand why somebody is asking. I can't understand why they would be concerned. But I don't think that there's a necessity to obtain express written consent in terms of this. This is a prospective employee, so they've come across the job advertisement. They've put an application form in respect of the job, and I think you'd be very much reliant on the position that this is a legitimate aim in terms of, you know, the recruitment process. If that person provides details of a reference, I think it's perfectly fine for the employer to say . . . or the potential employer, I should say, to rely on that and say, "Well, they've given me the details and I can now approach that person for a reference".

Potentially, the onus on GDPR is more on the referee who's providing the reference because they are going to be given information out to a third party. Often, now, you know that the references are factually . . . they're factual reference. They're start/end dates and job title at the time of the request or the time that they left. But that still is personal information for that person.

But I think you could satisfy yourself fairly easily to say that this is a legitimate circumstance. We've had an application process and they've provided us with referee details. We've made the approach. And I think for the prospective employer, I don't see an issue in terms of them having to have the prospective employee sign a form or sign part of the application form to say, "I consent my . . ." I think if you were going to be very prudent about it, you could absolutely put that into the application form and say, "Sign here for the consent". But, personally, I don't think this is necessary.

Scott: No. There are issues we were chatting about earlier about where you get references early if you look at the time scale. You do it early in anticipation that you're going to have a shortlisting panel. And you want to get together so you do it. In the meantime, you end up offering one job and there are four or five people who don't get the job and you've got references for them. There's no need to keep those references unless you're going to hold the job open for a period.

Seamus: Yeah, that's right. I was looking at a recruitment pack that a client had put together. I was just reviewing it for them yesterday. In that, they were requesting the references at shortlisting stage. And my thought process was then around to, "Well, you're going to have a lot of unnecessary information, documentation, and personal information about the unsuccessful applicants".

But then whenever I was able to satisfy myself . . . because when I read on it, they said that they were keeping the job open for a period of time after the process had completed, or in case it didn't work out in probationary and that they would move on to the next person in line for the role.

And importantly, then, what they had in their policy was they had the details of that they would retain the documentation for 12 months on this occasion. And then they would, you know, safely dispose of the documentation in accordance with the regulations themselves.

And I think that's the key part, is that once the window was closed in terms of the recruitment process and the person has been appointed, and there's a period of embedding in, that you then dispose of all of the recruitment documentation and those references that you don't require. You put yourself, as we've said before, at risk of retaining documentation that you don't need. There's more chance of a breach happening if you're holding and retaining the documentation.