In answer to Lucinda's question I think the position remains unclear because of
phrases like "given by the data controller".
So when Lucinda refers to the "position when an institution provides
> a confidential reference for use within the same institution ... when the
recipient is not an outside third party?" I find myself asking how "the
institution" can provide a reference - surely it is an individual who does
this. Yet the Act (Schedule 7: Miscellaneous Exemptions) refers similarly to
"a reference given ... in confidence by the data controller for the purposes of
education, training or employment..." and specifies that it is exempt from the
data subject access provisions.
A difference is clearly implied between this and the basic provision of Section
7, which we all know deals with how we have to allow disclosure unless the
referee objects to having text and identity revealed.
There must therefore be a difference between somone (even within the same
institution) giving a reference for a job elsewhere, and someone (say a head of
department) being REQUIRED to give an "official" reference - say, for internal
promotion. It has been made clear by commentators that the exemption does not
apply to references prepared by a person who is not the data controller - and I
think this would match the former case, and indeed most confidential
references. But in the latter case (internal reference by someone presumably
not chosen by the candidate, or at least chosen from a very short list), I
suppose it could be construed as the data controller giving the reference. And
if so it would seem to be clearly and explicitly exempted from disclosure by
Schedule 7.
Maybe it gets worse, in that many prospective employers ask that a reference
should be from present employer. Is that a "personal" choice (disclosure
basically allowed/required), or would it count as a reference by the data
controller (exempt)? The Act does not specify internal or external purposes,
does it - and yet a lot of our discussions centre on this distinction.
So it seems to me that clarification would indeed by useful, but that the crux
is the phrase "given or to be given in confidence BY THE DATA CONTROLLER" (my
caps).
----------------------
Dr Trevor Field
Senior Assistant Secretary
University of Aberdeen
[[log in to unmask]]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|