Providing references for a former employee contravenes the LOPD

Giving references for a former employee, although a common and socially accepted practice, can become potentially dangerous.

Although it was previously permitted, nowadays, responding to a request from another company asking for information about a former employee, regardless of whether these references are going to be negative or favorable for him, may involve committing more than one infringement of the LOPD (Spanish Data Protection Law).

In fact, by providing this information, we are transferring the employee's data (Article 11 of the Spanish Data Protection Act) for which we require their prior consent. This is because this data transfer is not at all necessary for maintaining or fulfilling the employment relationship we had with the employee, which has now ended. Therefore, from the moment the employment relationship with an employee ends, anything we wish to do with their personal data, unless permitted by law, will require their prior consent.

The specific risks are as follows:

(I) To begin with, as we have pointed out, we would be committing an unlawful transfer of data, classified as very serious in article 44.4.b) of the LOPD;

(II) The Spanish Data Protection Agency (AEPD) could also classify this action as data processing carried out without the consent of the affected party, classified as serious in article 44.3.d) of the LOPD;

(III) Finally, any of the above infringements would entail a violation of the duty of secrecy established in Article 10 of the LOPD, classified as minor in Article 44.2.e) of the LOPD.

It should be noted that in similar situations, the AEPD has applied article 4.4 of Royal Decree 1398/1993, of August 4, which approves the Regulation of the Procedure for the Exercise of the sanctioning power, according to which "in the absence of specific regulation established in the corresponding rule, when the commission of an infringement necessarily derives from the commission of another or others, only the sanction corresponding to the most serious infringement committed should be imposed". .

Therefore, if we want to provide references for our former employees, it will be necessary to establish a mechanism that allows the company to demonstrate, if needed, that the former employee has previously authorized them to share their personal information with a third-party company for the specific purpose of providing references within the framework of a personnel selection process. We should regulate this, for example, in the forms that employees sign.