Changing Jobs – Reference Checks by a Prospective Employer and the GDPR

A prospective employer may contact your former employer only if you have given specific, written and freely given consent in advance. Without such consent, the conversation amounts to unlawful processing of personal data. The penalty may reach EUR 20 million or 4% of the company's worldwide turnover, in addition to compensation for the person affected.

1. Why the Subject Is So Sensitive

Information on where you have worked and how you performed is part of your personal data, and the GDPR protects it, defining “any information relating to an identified or identifiable natural person” as personal data (Art. 4(1)). To process it, an employer needs a legal basis, and in recruitment this is almost always your consent (Art. 6(1)(a)).

2. Freely Given Consent and the Imbalance Trap

The GDPR specifies that consent is not valid where there is a “clear imbalance” between the parties (Recital 43). The relationship between a candidate and an employer is exactly that, since refusing may cost you the job. Clauses such as “you may contact all my former employers” are therefore legally fragile. What works is specific and limited consent, for example

“Yes, you may call George Ivanov, my line manager at X Ltd, solely for the purposes of this position.”

3. The Bulgarian Framework and the View of the Data Protection Commission

The Bulgarian Personal Data Protection Act applies the same principles. Data may be disclosed only on a statutory basis or with express consent. This is also set out in the guide on privacy in the workplace published by the Commission for Personal Data Protection, which stresses that without consent the employer should not disclose personal data to third parties.

4. Penalties – the Cost of a “Friendly Call”

• Art. 83 GDPR allows fines of up to EUR 20 million or 4% of worldwide turnover, whichever is higher.
• Art. 85 of the Personal Data Protection Act refers directly to these amounts.
• In practice, the National Revenue Agency was fined BGN 5.1 million for the 2019 personal data leak, proof that the fines are far from theoretical.

Both the company that carried out the check without a legal basis and the company that shared the information may be penalised.

5. How Candidates Can Protect Their Rights

a) Right of access – Art. 15 GDPR entitles you to ask any controller whether it processes your data and to whom it has disclosed it. A reply must be given within one month. Make the request in writing (by email, post or online form) and keep a copy.

b) Withdrawal of consent – Art. 7(3) GDPR provides that you may withdraw your consent “at any time”, and that withdrawal must be as easy as giving consent. After withdrawal, the employer must immediately stop all contacts and delete the information already collected, unless it has another legal basis to retain it.

c) Complaint to the Commission – if you believe your data has been used without a legal basis, you may file a complaint with the Commission for Personal Data Protection (Art. 77 GDPR). The procedure is free of charge. The Commission must inform you of the outcome and may order corrective measures and impose a fine.

d) Claim for compensation – Art. 82 GDPR and Art. 82 of the Personal Data Protection Act entitle you to compensation for material and non-material damage. The Court of Justice of the EU has confirmed that non-material damage (stress, damage to reputation) is also compensable, provided the consequences are proven.

6. What Employers Need to Know

• Obtain written, separate and specific consent for each reference check.
• Contact only the persons named by the candidate, no more and no fewer.
• A refusal to give consent should not automatically exclude the candidate.
• Keep all evidence, as this is the first thing the Commission will ask for in an inspection.

A conversation between a former and a new employer is lawful only after your freely given “yes”. Without it, the transfer of information breaches the GDPR and the Personal Data Protection Act and may prove costly in money, reputation and litigation.

Need assistance? We protect the rights of candidates and employees and help employers build procedures that keep curiosity within lawful limits. Contact us and we will help you secure your data or your business.