Employees have rights to be told what information is being held about them and may request reasonable access to that information.

Disclosure should not take place if it will compromise the personal data of someone else or the identity of someone who has provided information in confidence (normally an employment reference).

A referee should be asked to give consent to disclosure if an employee requests access to a reference.  If consent is refused on balance access may still be given but only if the information in the reference has had or is likely to have a significant adverse impact on the employee.

Employee data should only be provided to third parties with the consent of the employee concerned.  In the case of mergers or takeovers data communicated should not be able to identify individuals.