The Data Protection Act 2018 has broadly been described as a positive re-inforcement of the data rights of individuals, including workers. This is a fair summary but it is not a completely positive development in that the Act has actually curtailed the rights of an worker to see what their employers and former employers have written about them and provides cover for unscrupulous employers to evade their accountability for discriminatory conduct.
Before explaining why it is helpful to recap on how one category of victimisation claim presents itself, by means of a hypothetical scenario. A worker has been subject to discriminatory behaviour by an employer, perhaps complaining about how a colleague sexually harassed them. After the employer conducts and whitewashes an internal investigation the worker resigns in disgust at the employer’s failure to confront endemic sexual harassment in their organisation. The worker is not however keen to pursue a sexual harassment case and just ones a fresh start at a new employer.
She applies for many positions, for which she is well qualified, but despite performing well at interview is never offered a job. She suspects that her former employer has provided an unfair reference, perhaps alleging performance or misconduct issues that have put off potential employers in retaliation at her for having made a complaint of sexual harassment. In fact, that is precisely what the former employer was done.
Under the old Data Protection Act (1998) if this worker made a subject access request for a copy of any references the former employer could (I think unreasonably) refuse to provide these but this get out did not apply to the employer’s a worker made an application to so that a copy of the reference and the retaliatory negative reference could be obtained. With that evidence in hand the worker’s suspicion of unlawful and discriminatory victimisation has a solid basis in evidence and she can be more comfortable that she has a good case of victimisation against her former employer under the Equality Act 2010.
However, under the Data Protection Act 2018 – paragraph 24 of Schedule 2 to be precise – both former and prospective employers are explicitly told they can refuse to provide a worker a copy of a confidential employment reference without any other proportionality considerations needing to be considered. So now a worker who thinks their former employer has unlawfully discriminated against them by providing an inaccurate and vindictive reference to a former employer on the basis of that employee having had the temerity to challenge for employer about how it discriminated its staff finds themselves hamstrung.
While they can of course still claim discrimination they will be much less likely to be confident bringing such a claim when their only evidence is their gut feeling that something is amiss which will inevitably mean good cases are not brought and bad employers will evade scrutiny. For workers subject to post-employment victimisation from former employers at least the Data Protection Act’s plaudits of advancing employee’s data protection acts ring hollow.
To date there has been no reported decisions (that I have been able to find) on the compatibility of the reference caveat to subject access requests with human rights or the GDPR itself. Hopefully the harshness will in due course be mitigated or Parliament will see sense and repeal paragraph 24 of Schedule 2 of the DPA 2018.