University reference disclosing personal information

Short answer

Yes, in principle a university can include attendance records, disciplinary findings and even health information in an academic reference, but each of these engages data protection law and other legal duties, and there are meaningful limits on what a university can lawfully and safely include. Whether it should include a particular piece of information depends on the type of information, the university’s own policies, the purpose of the reference, and whether the information is accurate, relevant and fairly presented.

The general legal framework

A reference about you contains your personal data, so it is governed by the UK GDPR and the Data Protection Act 2018. When a university provides a reference it is processing your personal data and must comply with the data protection principles, including that the information is processed lawfully, fairly and transparently, is adequate, relevant and limited to what is necessary for the purpose, and is accurate and kept up to date.

The Information Commissioner’s Office guidance on references (written mainly for the employment context but applying the same principles) makes three points that are directly relevant here. First, an organisation does not have to provide all the information requested and may give a limited or neutral reference. Second, the organisation should share only information that is relevant and necessary for the purpose of the reference. Third, the subject has a right to challenge information they consider inaccurate or misleading, particularly where, as with a reference, it may adversely affect them.

Attendance and disciplinary findings

Attendance data and disciplinary findings are ordinary (non-special-category) personal data. A university can lawfully include them if it can point to a lawful basis, which will usually be its legitimate interests or the performance of its functions, and if the information is accurate and relevant to what the reference is being asked to address.

Key limits and safeguards apply:

Accuracy. A disciplinary finding must be recorded and reported accurately. There is an important distinction between stating a proven finding (for example, that a specific allegation was upheld after a proper process) and stating an unproven allegation as though it were fact. Reporting an allegation that was never upheld, or was withdrawn or overturned on appeal, as if it were established misconduct is likely to breach the accuracy principle and could also be defamatory or amount to negligent misstatement.

Fairness and balance. A reference must not be misleading overall. The general legal position on references, established in the employment context in Spring v Guardian Assurance and applied in later cases, is that the referee owes a duty to take reasonable care so that the reference is true, accurate and fair, and does not give an unfair or misleading overall impression even if each individual statement is literally true. Universities generally apply the same standard to academic references.

Relevance. Old, minor or spent disciplinary matters that have no bearing on the purpose of the reference may not be adequate, relevant and limited to what is necessary. A single upheld academic misconduct finding may be relevant to an academic or professional reference; a minor and long-resolved matter may not be.

University policy. Most universities have a reference policy that states what they will and will not disclose. Some universities as a matter of policy only confirm factual matters such as the course, dates of study and classification, and decline to comment on conduct. Others will disclose upheld disciplinary findings, particularly where the reference is for a course or profession with fitness-to-practise requirements (for example medicine, nursing, teaching, social work or law). You should check the specific university’s reference or data protection policy, because that policy, together with any statement made to you when you enrolled, largely governs what they will do.

Health information

Health information is special category data under Article 9 of the UK GDPR and is subject to stronger protection. The university needs both a lawful basis under Article 6 and a separate condition under Article 9 before it can include health data in a reference. In practice this usually means it needs your explicit consent, or it must be able to rely on another Article 9 condition, which for a reference will rarely apply.

Because of this, a university should not normally disclose health information, disability, mental health history or absences attributed to health reasons in an academic reference without your explicit and informed consent. There are limited exceptions, most obviously where disclosure is genuinely necessary to a regulator for fitness-to-practise or public protection reasons, but even then the disclosure must be lawful, proportionate and usually made through defined channels rather than a general reference.

If attendance is being reported, the university should be careful not to reveal health information indirectly, for example by stating that absences were due to illness or a specific condition. Reporting a bare attendance percentage is different from reporting the medical reasons behind it.

Your rights and how to check or challenge what is said

You have several tools available.

1. Ask for the university’s reference policy and data protection or privacy notice, which should tell you what categories of information they disclose in references and on what basis.

2. Ask the university directly, before a reference is sent, what it intends to include, and ask it not to include health information without your consent and not to include unproven or overturned disciplinary allegations.

3. Make a subject access request under Article 15 of the UK GDPR to see the personal data the university holds about you, including reference-related material where it is not exempt. Note there is a partial exemption for confidential references in the Data Protection Act 2018, which can limit your right to see a reference the university itself has given or received, but it does not remove your other rights over the accuracy of your records.

4. Exercise your right to rectification under Article 16 if any recorded disciplinary finding, attendance record or health note is factually inaccurate or misleadingly recorded, so that inaccurate information is not carried into future references.

5. Complain. If the university refuses to correct inaccurate information or discloses special category data without a lawful basis, you can complain to the university, escalate to the Office of the Independent Adjudicator for Higher Education if you are a current or recent student and it is a qualifying complaint, and complain to the Information Commissioner’s Office about the data protection aspects.

Other legal angles

Defamation. If a reference contains a false statement of fact that damages your reputation, defamation may be relevant, although references usually attract qualified privilege, meaning a claim would generally require you to show malice or reckless disregard for the truth.

Negligent misstatement. If the university carelessly gives an inaccurate or unfairly misleading reference that causes you loss, for example the loss of a job or place, the Spring v Guardian Assurance line of authority means a duty of care can arise and a claim in negligence is possible, though causation and loss can be difficult to prove.

Equality Act 2010. If health information relates to a disability and the university discloses it in a way that puts you at a disadvantage, or the reference process disadvantages disabled students, disability discrimination issues under the Equality Act 2010 may arise, including the duty to make reasonable adjustments.

Practical next steps

1. Read the specific university’s reference and data protection policies to see what they say they will disclose.

2. Contact the department or referee in advance to agree what the reference will cover, and give or withhold consent for any health information in writing.

3. Check your own records now, and use a rectification request to correct any inaccurate attendance or disciplinary entries before a reference is needed.

4. If a reference has already been sent and you believe it wrongly included health data or misstated a disciplinary matter, raise it in writing with the university’s data protection officer, seek correction and, if the recipient relied on it to your detriment, ask the recipient to disregard the inaccurate content.

What would change the answer

The outcome depends on facts you have not yet given: whether the disciplinary matter was actually upheld or merely alleged; whether it was later overturned on appeal or is spent under the university’s policy; whether the reference is for a fitness-to-practise profession where disclosure duties are stronger; whether you have given explicit consent for health information; and what the university’s own reference policy and enrolment terms say. If you tell me which university, what the reference is for, and the nature of the disciplinary matter and health information involved, I can give a more targeted answer.