In a job market as competitive as Luxembourg’s, reference checks are increasingly becoming a key stage in the recruitment process. Checking a candidate’s skills, confirming their career history or assessing their interpersonal skills may seem like common sense. Yet behind this seemingly straightforward practice lies a strict legal framework that employers cannot afford to ignore.
Straddling employment law and personal data protection, reference checks must be handled with care. If used incorrectly, they can expose a company to legal risks or even damage its employer brand.
Consent: an essential requirement
In Luxembourg, reference checks are perfectly legal. An employer can contact a former manager or another professional reference to obtain information about a candidate. However, this freedom is not unlimited.
The key principle behind reference checks is the candidate’s consent. An employer cannot contact a reference without obtaining the candidate’s prior approval.
In practice, this means that employers are not allowed to:
- Contact a former employer without informing the candidate;
- Use their network to obtain “off-the-record” information;
- Or, even worse, contact the candidate’s current employer without authorisation.
This principle stems directly from the GDPR, which strictly regulates the collection and use of personal data. Candidates must know what information is being collected, from whom and for what purpose.
In practice, the simplest approach is to explicitly ask the candidate to provide one or two references, or to approve the people you wish to contact.
Information should be limited to what is relevant
Even with the candidate’s consent, not everything can be asked. Reference checks must remain proportionate and directly related to the position being filled.
An employer may therefore ask about:
- The tasks and responsibilities carried out;
- Technical skills;
- Adaptability;
- Or professional conduct.
By contrast, any questions relating to private life, health, personal opinions or family circumstances should be strictly avoided.
This principle of proportionality is essential. It protects the candidate, but also the company, which must be able to demonstrate that the information collected was necessary for its recruitment decision.
Real risks when reference checks go too far
A poorly managed reference check can have tangible consequences for a company.
From a legal perspective, collecting data without consent or obtaining irrelevant information may constitute a breach of the GDPR, potentially resulting in sanctions.
But the risks are not solely legal. In a country such as Luxembourg, where the job market is both relatively small and highly interconnected, reputation plays a key role. A poor candidate experience can quickly spread and affect a company’s attractiveness.
There is also the risk of making the wrong decision based on incomplete or biased information. In some cases, this could even lead to allegations of discrimination.
This is why reference checks should always be viewed as a complementary part of the recruitment process, helping to confirm an overall impression rather than serving as the sole deciding factor.
Discover our other articles on HR issues in Luxembourg on our blog.