Authored By: Faith Nyambura Muchinji
DAYSTAR UNIVERSITY
Introduction
The job hiring system is undergoing a transformative shift in which prospective employers no longer have unfettered discretion to conduct background checks of ideal candidates. The Constitution of Kenya demands respect for privacy, including the right not to have an individual’s information unnecessarily revealed.[1] Information inquiries ought to be on a need-to-know basis, with express consent obtained from the candidate before soliciting information from former employees.[2] However, the bone of contention is that references lie within the former employer’s discretion to relay. This leaves the candidate vulnerable with no procedural mechanism to verify, interrogate, or contest what was communicated on their behalf. It is a process entirely about the candidate, yet conducted without them.[3] This article contends that the law is progressively recognizing this imbalance, and a candidate who surmises that a recruitment outcome emanates from an adverse referral has the right to access the content of what was said.
Analysis
Professional references are a common practice in the hiring industry used in making hiring decisions.[4] Additionally, it is an opportunity through which potential employers get a chance to hear what a great asset you would be from other people’s perceptions.[5] A referee has the discretion to relay information regarding a candidate to the best of their knowledge, whether favorable or not. The principle of qualified privilege shields the referee who communicates an honest but unfavorable reference about a former employee.[6] However, the gravamen of this article lies in the employer invoking company confidentiality policies as a shield against disclosure of referenced information. The legal deficit is most felt when the employment relationship is terminated due to animosity, leaving room for an employer reference that is characterized by personal grievance rather than professional integrity.
The Employment Act of Kenya does not bind an employer with a mandatory obligation to furnish a reference attesting to a former employee’s character or performance.[7] However, where an employer voluntarily chooses to do so, consent must be obtained from the employee. This is because information on professional qualifications is considered personal data within the meaning of the Data Protection Act.[8] Personal data under this framework is defined as information relating to an identifiable natural person, in which professional references entail an identifiable individual’s character, conduct, and performance, calling for compliance with the data subject rights.[9]
The communication of a reference to a prospective employer constitutes a transfer of personal data to a third party; as a result, the data subject is entitled to know what information was shared and to have consented to its disclosure.[10] In the case of Spring v Guardian Assurance[11] it was held that where an employer decides to provide a prospective employer or employee with a reference, they are under a duty of care to ensure information conveyed is reliable and verifiable. This is because the nature of a reference can make or break the candidate’s prospects of securing employment.
In cognizance of the data subject’s rights to know about how their personal data is processed and communicated, an employer cannot lawfully invoke confidentiality policies to frustrate a candidate’s right of access.[12] This was well illustrated in the case of Harrison Kisaka v Faulu Microfinance Bank, where the Office of the Data Protection Commissioner (ODPC) underscored in para 35 that the right of access was absolute.[13] The ODPC further relied on the Data Protection(General) Regulations, which place a legitimate expectation on a data subject to access their personal data and an obligation on the data controller to provide access on request.[14] Additionally, the case of Margaret Nzula v United Winners DT Sacco[15] encompasses compensation to an aggrieved data subject whose personal data was shared with a prospective employee without her consent, and she alleged that this resulted in the loss of a job opportunity. The complainant, whose efforts to access her reference letters were rendered vain, was awarded a sum of two hundred and fifty thousand Kenya shillings for the infringement of her right to access her personal data. Imperatively, the absolute right of access overrides internal policies on confidentiality, and employers cannot use it as a bar to deny a candidate the right to know what was said in the reference letters.
III. Challenges and Recommendations
One of the key concerns is that the medium of professional references often takes the form of calls. Unlike emails, which show a record of sent or received emails, calls are inherently difficult to contest. However, the procedural requirements for obtaining consent and notifying a data subject of the processing of personal data cure this challenge.[16] Where an employer has obtained tacit consent before soliciting a reference, the existence of that consent is evidence that the reference was given.
Notably, employers should ensure that candidates consent to background checks via consent forms and embrace the standard practice of having references in writing. Adapting the facts in Kisaka v Micro Finance Bank, the existence of an express consent and assent to it gives the complainant a legitimate expectation to be informed and notified if their data was processed or shared with third parties.
This article contends that the procedural requirements are insufficient and Kenya should further enact a statutory requirement compelling all professional references to be rendered in writing or recorded as a deliberate measure to address the structural power imbalance between the referee and the candidate. Without this, the employer retains discretion to relay vague, unverifiable oral responses, effectively insulating the substantial reference contents from scrutiny.
Conclusion
The recruitment process banks on personalized information about a candidate. Professional references may either break or make the candidate’s prospects of securing a job; therefore, the vitality of such references must be upheld by holding employers accountable for the information relayed to third parties. Employers must relay factually correct information, keeping in mind that the candidate’s reputation, profession, and future are at stake. The right to know is an absolute statutory right anchored in the data protection laws and one which no internal confidential policy can lawfully extinguish. The article advances the need for a mandatory rule requiring employment references to be in writing or recorded to implement this right. It would be ironic that the candidate whose career is at stake is denied access to information that is entirely theirs.
BIBLIOGRAPHY
Statutes
Constitution of Kenya 2010
Data Protection (General) Regulations 2021
Data Protection Act of 2019
Employment Act of Kenya 2007
Case Law
Harrison Kisaka v Faulu Microfinance Bank (2023)
Margaret Nzula v United Winners DT Sacco & Shirika DT Sacco (2024)
Spring v Guardian Assurance (1995
Articles
M Aamodt et al ‘Employment References: Who Are We Talking About?’ (1998)
S Joubert ‘How to Use Professional References to Your Advantage’ (2020)
M Dowd ‘Former Employee’s Defamation Claim Arising From Negative Reference Dismissed by Court’ (2025)
[1] art 31(c) (d) Constitution of Kenya 2010
[2] s 25 of the Data Protection Act 2019
[3] Corporate Staffing Services ‘Are Employers Allowed to Secretly Check Your References? Here is What You Should Know ‘(2026)
[4] M Aamodt et al ‘Employment References: Who Are We Talking About?’ (1998) 16-18
[5] S Joubert ‘How to Use Professional References to Your Advantage’ (2020)
[6] M Dowd ‘Former Employee’s Defamation Claim Arising From Negative Reference Dismissed by Court’ (2025)
[7] s 51(3) of the Employment Act of Kenya 2007
[8] s 2 of the Data Protection Act 2019 cap 411C of the Laws of Kenya
[9] ibid
[10] s 29(d) n5
[11] [1995] 2 AC 296
[12] s 26(b) n6
[13] ODPC Complaint No 0586 of 2023
[14] reg 9(1) (3) of the Data Protection ( General) Regulations 2021 legal notice 263 of 2021
[15] Margaret Nzula v United Winners DT Sacco & Shirika DT Sacco OPDC Compliant no 1910 of 2023.
[16] s 29 (a) (b) (c) (d) of the Data Protection Act 2019
