These guidance notes cover the provision and receipt of references for both staff and students and should be read in conjunction with the University's Data Protection Policy.  This document is Appendix IX to the policy.

Section 1: General

Many staff in the University may, in the course of their career, be asked to provide references for students and/or members of staff, whose careers they are in a position to influence. This will involve the disclosure of personal data in the form of facts and opinions about individuals and as such is covered by the Data Protection Act 1998.

There are a number of types of references including:

  • standard references for employment or placement at another academic institution
  • references for internal candidates regarding their employment/promotion
  • references in the form of ‘academic peer review’ (provided by/for external academics relating to the promotion or appointment of an academic with whom they may have a close working/research relationship).
  • character references for legal proceedings
  • financial references for mortgage applications

All types of references fall under the definition of personal data and sometimes sensitive personal information (e.g. relating to health, race, religion - see Data Protection Policy section on definitions for full details of what data the Act considers to be sensitive), in the Data Protection Act. Therefore staff should ensure that they are fully aware of the implications of the Act when providing references, this includes appropriately secure storage of references both received by and provided by the University. Further information on the Act (including the University’s Data Protection Policy) is available at the following web-page:

Section 2: Guidance on Writing a Reference

Particular care should be taken if asked to provide a reference for someone who is not known to you.

If you receive a request for a personal reference relating to a member of staff or a student, you should ensure that:

  • the information contained in the reference is FACTUALLY correct
  • where possible, disclosure is kept to a minimum (e.g. dates of study/employment, marks and/or degree class, positions held)
  • sensitive data (e.g. details of health to explain absences from the University) must not be disclosed without the explicit consent of the member of staff or student (if this is not possible, please contact the University Data Protection Officer for advice)
  • where opinions about a person's suitability are disclosed, your comments are defensible and justifiable on reasonable grounds
  • if you are asked to express an opinion on an issue about which you have limited knowledge, e.g. honesty and integrity, you respond appropriately response (for example, “I know of nothing that would lead me to question X's honesty”)
  • if you are unable or unwilling to give a reference, such a refusal is communicated carefully, without, in effect, implying a negative reference
  • you do not disclose any information if asked to give an unsolicited reference (i.e. for a student or member of staff who has not, to your knowledge, cited your name as a referee) without the individual’s consent.

Further guidance on writing references is available from Personnel.

Section 3: Permission to Disclose Information in the form of a Reference

If a member of staff or student has provided the name of a referee, the University interprets them as having given their consent for the disclosure of personal information in the form of a reference. However, if you are intending to release sensitive personal information (e.g. relating to health, race, religion - see Data Protection Policy section on definitions for full details of what data the Act considers to be sensitive), you should always seek explicit consent (preferably in writing) from the individual concerned. As a matter of good practice and courtesy, members of staff and students should be encouraged to inform people that they intend to cite them as a referee.

In some cases, requests for references may be presented on a pro-forma already signed by the individual permitting you to disclose information in the form of a personal reference. You should be able to satisfy yourself that the signature on the form is genuinely that of the individual concerned before proceeding with the request.

The identity of the person requesting the reference should always be confirmed prior to disclosure. Requests for references should usually be made in writing on headed paper. If you receive an email request for a reference, you should be assured that it is a valid request. If it is from a known source or company, you should process the request but you may wish to reply in written format to a known postal address for the company/organisation. If the email address is not familiar, you are advised to investigate further.

Telephone references are not recommended.

Section 4: Rights of Access to Confidential References

4.1 References RECEIVED BY the University

All staff should be aware that the Data Protection Act gives individuals the right to access information that an organisation holds on them. Such requests are known as subject access requests. This includes references received by the University which are stored in staff or student files. However, when releasing references to individuals upon receipt of a subject access request, staff need to be mindful that they are not inadvertently disclosing information relating to a third party (e.g. the referee) without their consent. For further information on obtaining consent for the release of third party data in response to a subject access request, see guidance on Handling Subject Access Requests.

With this in mind, you should be aware of the following issues regarding retention of references received (eg, UCAS forms, references for potential employees/students):

  • References for successful staff appointments must be retained for 12 months after appointment. You may need to communicate this to referees when requesting references.
  • References for unsuccessful candidates should be retained for a period of up to 12 months (in case of possible litigation from unsuccessful applicants).You may need to communicate this to referees when requesting references.

Some organisations invite the referee to state if s(he) has any objection to the reference being disclosed to the candidate. However, only in very rare cases will this be possible and usually the candidate will have a right to see their reference albeit it with referees’ personal details removed. See Section 5 for further detail.

4.2 References PROVIDED BY the University

References are exempt from subject access requests in the hands of the originating data controller (i.e. the University). However, the Act does not stop the disclosure of such references and all departments are encouraged to be as open and transparent as possible regarding the information they hold on individuals (staff and students). Also remember that individuals could request the reference from the RECEIVING organisation. As a general rule, you are advised not to include information in a reference that you would not wish to the individual concerned to see.Where opinions about a person's suitability are disclosed, make sure your comments are defensible and justifiable on reasonable grounds so that you do not cause unnecessary distress in the event of your reference being viewed by the individual.

4.3 Internal References

When providing references for internal promotions, staff are reminded that it is highly likely that individuals will be able to access them. Where disputes arise as to whether or not an individual should be allowed access to references provided to the University from the University, it is likely that the reference will be released in an anonymised form. You should consult the University Data Protection Officer if you have any concerns.

Section 5: Requesting References

When requesting a reference (as an employer / provider of education) from external or internal referees you may wish to:

  • inform them of the University’s policy on retaining references (12 months for both successful and unsuccessful candidates)
  • inform them that in the event of a subject access request, wherever possible their personal data will not be disclosed without consent but where the University considers it to be reasonable, it may be necessary to release references without consent
  • that references will be accessible if requested in connection with legal proceedings or in connection with the detection or prevention of crime.

Please be aware that this might affect the nature of references received by the University. All staff are reminded that telephone references are not recommended University practice.

For further guidance, please contact Personnel Services or the University's Data Protection Officer.