When the law punishes candour and rewards silence, the people it claims to protect are the ones who suffer most.
Employment references occupy an uncomfortable position in the law. They sit at the intersection of data protection, defamation, negligence, and safeguarding, and no single legal framework governs them coherently. The result is a system in which employers, referees, and regulators face contradictory incentives, and in which the consequences of getting it wrong fall most heavily on individuals who can least afford to bear them.
A recent dispute in Guernsey, reported by the BBC12, has brought these tensions into sharp focus. A teacher applied for a role with the States of Guernsey and was rejected. The applicant submitted a subject access request to obtain the data held about them, including a reference. The States initially withheld the reference. The Office of the Data Protection Authority (which falls under Home Affairs’ remit) ordered its release. The family of the applicant alleged the reference was a work of “malicious fiction” that would “destroy their reputation.” The States then began work on tightening data protection law to restrict access to references in future, a move the family condemned as “embedding in law the opportunity for cover up.”
This article takes no position on the merits of the Guernsey dispute itself; the facts are contested and the parties’ accounts differ. But the case is a useful springboard for a broader question that the law has never satisfactorily resolved. Every reference dispute involves at least three sets of interests: those of the data subject, those of the person who wrote the reference, and those of the people whose safety or interests depend on honest information flowing between employers. The law of references creates risks on every side, and the consequences of getting the balance wrong can be severe for all parties. What follows is a hypothetical exploration of how those risks interact, and why the current framework is failing.
The Duty to Speak
Under English common law, which Guernsey’s legal system draws upon, an employer who provides a reference owes a duty of care to the subject of the reference and, in appropriate cases, to the recipient. In Spring v Guardian Assurance plc [1995] 2 AC 296, the House of Lords held that a referee must exercise reasonable care to ensure the reference is true, accurate and fair. A reference that is inaccurate or that gives a misleading overall impression may give rise to liability in negligence. That misleading impression may arise from incorrect facts or from selective presentation of facts that distorts the picture. There is no general duty to include every negative detail, and a referee is not required to provide a full history; but where what is included creates a falsely positive impression because material information has been omitted, liability may follow. This was reinforced in Bartholomew v London Borough of Hackney [1999], where the court held that omission of serious disciplinary history could render a reference misleading in context.
This duty runs in both directions. If an employer provides a reference that is negligently harsh or inaccurate, the subject may sue for the economic loss caused by failing to secure employment. But if an employer provides a reference that is negligently positive, or that omits material information about misconduct or unsuitability, the new employer may sue if it relies on that reference and suffers loss as a consequence.
In regulated sectors, the stakes are particularly high. In education, the statutory guidance Keeping Children Safe in Education3 requires that references include information about disciplinary action relating to child safety. In financial services, regulatory frameworks such as those administered by the FCA impose obligations of full and frank disclosure regarding fitness and propriety. In healthcare, similar duties apply to references for clinical staff. Across all of these sectors, settlement agreements cannot lawfully be used to suppress material safeguarding or regulatory information. The rationale is obvious: if an employee is dismissed for serious misconduct or regulatory concerns and the former employer provides a bland or positive reference that conceals those concerns, the new employer may hire someone who poses a risk to clients, patients, children, or the public. If harm follows, the former employer’s failure to disclose is not merely a breach of guidance; it is a potential foundation for a negligence claim by the new employer, the injured party, or both.
The Duty to Be Silent
Set against this obligation to speak candidly is a powerful set of incentives to say nothing at all.
A referee who provides a candid reference faces exposure on multiple fronts. If the reference contains statements that damage the subject’s reputation, the subject may bring a claim in defamation. The defence of qualified privilege exists to protect referees who provide honest assessments in circumstances where there is a legitimate interest in the information being communicated, but qualified privilege is defeated by malice, and what constitutes malice is litigated on the facts. Even where the defence is sound, asserting it requires legal representation, court proceedings, and cost. For an individual referee, as opposed to a large institutional employer, the financial burden of defending a defamation claim may be prohibitive regardless of its merits.
Data protection law adds a further layer. Under most modern data protection regimes, including the UK GDPR and its equivalents, individuals have the right to access personal data held about them. References are personal data. While some jurisdictions provide exemptions for confidential references, those exemptions are not absolute, and data protection authorities may order disclosure. A referee who was assured that a reference would remain confidential may find that assurance overridden by a regulatory order.
The combination of these pressures creates a rational calculus that points firmly towards silence. If providing a candid reference exposes the referee to real or imaginary defamation claims, data subject access requests, and the potential for regulatory reversal of confidentiality assurances, the safest course of action is to refuse to provide a reference altogether, or to provide only a bare factual confirmation of dates and job title. This is precisely what has happened across much of the private sector in the United Kingdom, where many employers now have blanket policies prohibiting substantive references.
The Asymmetry of Resources
The law of references is formally neutral. It applies equally to all parties. In practice, however, it operates with profound asymmetry.
A large employer or public body can absorb the cost of defending a defamation claim or responding to a data protection complaint. It has in-house legal counsel, insurance, and institutional resources. An individual referee, such as a small business owner, a sole practitioner, or an independent consultant, does not. If an individual provides a candid reference at the request of a regulator and is subsequently sued by the subject, the individual bears the full cost of that litigation personally. Legal aid is unavailable for defamation claims in most jurisdictions. The cost of instructing solicitors and counsel for a contested defamation trial can easily run into six figures.
This means that the outcome of a defamation claim arising from a reference may be determined not by the merits of the defence but by the relative financial resources of the parties. Consider a hypothetical: a referee with a strong defence of qualified privilege is nevertheless forced to settle because the cost of proving the defence at trial exceeds their means. The settlement itself then becomes a matter of record, potentially cited in future proceedings or regulatory decisions as evidence of wrongdoing, even though the underlying claim was never tested.
The subject of the reference, if backed by greater financial resources, can exploit this asymmetry strategically. The threat of litigation is itself a weapon, and its effectiveness depends not on the strength of the claim but on the inability of the defendant to bear the cost of contesting it.
The Regulatory Gap
Where a regulator or public body directs an individual to provide a reference, and that individual is subsequently sued for doing so, a fundamental question arises: who bears the risk?
In principle, a person who acts under the direction of a public authority, in compliance with a legal or regulatory obligation, ought to be protected against personal liability for the consequences of that compliance. The direction itself should carry with it either a statutory immunity or, at minimum, an undertaking by the directing body to indemnify the individual against claims arising from the act it required.
In practice, no such protection routinely exists. It is easy to imagine a scenario in which a regulator directs an individual to provide information, assures them of confidentiality or support, and then withdraws when litigation follows. The individual is left to face the consequences alone. This is not merely unjust; it is destructive to the regulatory framework itself. If individuals learn that compliance with regulatory direction leads to personal ruin, compliance will cease. The regulator’s ability to gather material information depends entirely on the willingness of individuals to provide it, and that willingness depends on trust that the regulator will stand behind those who do as they are asked.
Once that trust is broken, it does not return easily. Word travels fast in small professional communities. Even a single hypothetical case in which a referee is abandoned by the body that directed them to speak would be sufficient to ensure that nobody in that community will provide a candid reference again.
The Consequences of Silence
When referees stop speaking, the immediate beneficiaries are individuals who should not be working in positions of trust or responsibility. A blanket refusal to provide a substantive reference is ambiguous. A new employer receiving a bare confirmation of dates and job title cannot distinguish between a referee who is following institutional policy, a referee who is being cautious, and a referee who is concealing a catastrophic failure. Some experienced recruiters treat a refusal to provide a substantive reference as a red flag; others treat it as routine. There is no consistency.
The deeper consequence is that the entire architecture of pre-employment due diligence depends on the flow of honest information. Background checks capture criminal convictions and, in some cases, regulatory sanctions. They do not capture concerns that fell short of criminal proceedings, internal disciplinary findings, patterns of behaviour that caused alarm but did not result in formal action, or professional judgments about suitability. References are the mechanism by which this information is transmitted. If that mechanism fails, dangerous or unsuitable individuals move freely between institutions.
The people who pay the price for this failure are not the employers, the regulators, or the referees. They are the clients, patients, children, and members of the public who encounter an individual about whom material information existed but was never communicated.
What Would a Workable Framework Look Like?
The tension between transparency and protection is real, and no single reform will resolve it entirely. But certain structural changes would address the worst failures.
First, the problem is not the absence of legal defences but the cost of asserting them. Qualified privilege already protects referees who act in good faith, but that protection is worthless to someone who cannot afford to get to trial. The reform needed is procedural, not doctrinal. Where a reference was given in compliance with a safeguarding obligation or at the direction of a regulator, and a claim is subsequently brought against the referee, the directing institution should be required to fund a discrete judicial scrutiny of the facts before the claim proceeds to open litigation. That scrutiny would determine, on the evidence, whether the reference was given in good faith on the basis of information held at the time. If the court so finds, the claim should be struck out. The cost of that process should fall on the institution that directed the reference, not on the individual who complied. This achieves what qualified privilege in theory already provides but in practice does not: protection that operates before the referee is financially destroyed by the process of defending themselves. If the institution considered the information important enough to compel its disclosure, the institution should bear the cost of vindicating the person who provided it.
Second, any regulator or public body that directs an individual to provide a reference should be required to indemnify that individual against legal costs arising from claims connected to the reference. If the state or the regulator considers the information sufficiently important to compel its disclosure, the state or the regulator should bear the financial risk of that decision, not the individual who complied.
Third, consideration should be given to centralised reference systems in regulated sectors. Rather than requiring individual referees to provide information directly to prospective employers, the regulator could hold the information and disclose it as part of the recruitment process. This would remove the individual referee from the firing line entirely and place the disclosure obligation on a body with the legal resources to defend it.
Fourth, data protection frameworks should distinguish clearly between the right to access a reference and the right to identify the referee. A data subject has a legitimate interest in knowing what has been said about them; it does not follow that they have a right to know who said it, particularly in regulated sectors where the referee may be vulnerable to retaliation.
Conclusion
The law of references, as it currently operates, asks individuals to bear risks that properly belong to institutions. It punishes candour and rewards silence. It allows well-resourced litigants to suppress inconvenient information by threatening those who lack the means to defend themselves. And it does all of this while claiming to serve the interests of transparency, accountability, and public protection.
The Guernsey case reported by the BBC is one dispute among many, and this article does not purport to adjudicate it. But it raises questions that extend far beyond a single island or a single reference. Wherever the law permits references to be given, the same tension exists. Somewhere in the system, there will always be an individual who is asked to provide an honest account of what they know, and the question that determines whether the system works is whether that individual can do so without being destroyed for it.
At present, the answer is no. Until that changes, the rational choice for any individual asked to provide a reference will be to refuse, point blank. The consequences of that refusal will fall, as they always do, on the people the system is supposed to protect.
Addendum: Private Indemnity as an Alternative
It has been suggested since publication that the problem could be resolved by requiring the job seeker to indemnify the referee as a condition of the reference being provided, effectively waiving the right to sue the referee for the contents of the reference. The proposal has appeal, but I feel that it may not withstand scrutiny. In most jurisdictions, a prospective waiver of claims in defamation or negligence, signed before the claimant has seen the statement they are waiving the right to challenge, is unlikely to be enforceable; a court would probably treat it as contrary to public policy, particularly if the reference turned out to be genuinely malicious rather than merely unfavourable. Even if the waiver were enforceable in private law, it would not exclude the job seeker’s right to submit a subject access request under data protection legislation, a right that cannot be contracted away. Once the reference is disclosed via that route, nothing prevents the job seeker from using its contents as the foundation for a regulatory complaint or litigation framed on grounds other than defamation. More fundamentally, the proposal would have a chilling effect on legitimate challenges. Some references genuinely are malicious or fabricated, and a blanket waiver signed before the job seeker has any knowledge of the reference’s contents strips them of the ability to challenge a reference that ought to be challenged. In practice, the request to sign such a waiver would itself signal that the referee intended to say something negative, and any competent adviser would tell the job seeker to withdraw the request. The problem returns, as it always does, to the same place: the protection must come from the institution that directed the disclosure, not from a private agreement between two individuals of unequal bargaining power.