Tin Pot
Guru
That’s not the case - references are exempt. But she can request the same info from the other party.
From the 1998 DPA:
SCHEDULE 7Miscellaneous exemptions
Confidential references given by the data controller
1Personal data are exempt from section 7 if they consist of a reference given or to be given in confidence by the data controller for the purposes of—
(a)the education, training or employment, or prospective education, training or employment, of the data subject,
(b)the appointment, or prospective appointment, of the data subject to any office, or
(c)the provision, or prospective provision, by the data subject of any service.
Is that true under GDPR? Happy to be corrected.