Six months into my employment in the UK, my current employer is now asking that I can provide a character reference from a former employer. They had received responses from a few other employers but was asked to forward this last one myself. One of the questions in the questionnaire is:

  1. Do you know of any factor concerning the subject that might cause his/her fitness for employment on sensitive work to be questioned? If yes, please give details. (Among the factors which are relevant are significant financial difficulties, abuse of alcohol or drugs, an extravagant mode of living or signs of mental or physical illness which may impair judgment or reliability)

I am surprised that my previous employer has been asked to asses if I showed signs of mental health issues? Is anybody qualified to asses that except mental health professionals? Is this questionnaire form legal? Can the company legally ask this type of questions from a previous employer?

Indeed, this information is required as part of a security vetting. However, I was only asked to guarantee that the company will receive employment references. A successful security vetting was a mandatory condition of my employment. I was never told that they would be asking for (signs of) mental health information from my previous employers.

Edited to highlight this is happening in the United Kingdom / England. Edited to add more context information.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    Commented Nov 22, 2019 at 12:53

5 Answers 5


These references aren't standard, run of the mill references that employers request every time you move between jobs. These are specifically in relation for security vetting, and the entire purpose will to see whether or not you are suitable to be given access to Security Cleared documentation and work on particular projects.

I would suggest this is likely to be normal for this level of clearance, and likely to be happening now due to you passing the probationary stage of your employment.

Take a look here and see if this applies

  • It certainly is on the equivalent form in the United States (SF-86). SF-86 is all about providing truthful information throughout the form (I.e self-reporting).
    – Donald
    Commented Nov 21, 2019 at 0:05
  • These are indeed normal questions for a security vetting - but it's not the employer that asks them.
    – motosubatsu
    Commented Nov 21, 2019 at 12:13
  • (At least in the US) It's very normal for the employer to ask these questions. They're not going to sponsor an employee for a clearance if they don't think the employee will pass it. Commented Nov 21, 2019 at 19:42

Just as a general point:

Your current employer can ask your former employer whatever they like. Whether your former employer can legally answer in any kind of detail is another matter. Whether they would answer in that kind of detail is another still.

Most employers, in order to avoid the potential for lawsuits, won't confirm anything beyond job titles and dates of employment on a reference check.

The fact that they're asking you to forward this personally might mean that the former employer in question has taken that route and your current employer is hoping you'll circumvent that.

I'd recommend you tell your current employer to send it to your former employer's HR as it's up to them (and company policy) what they will disclose about former employees.

  • 2
    For sensitive personal information, it's not a given that they can ask whatever they like - "signs of mental or physical illness" is health data, which has special protections (much stricter than ordinary personal data) under GDPR and other legislation. Handling such data, no matter how obtained, is highly regulated.
    – Peteris
    Commented Nov 20, 2019 at 17:16

That word sensitive is evocative. This sort of question is exactly what FBI or OPM agents are checking into when doing a security clearance investigation for a potential US government employee. Although everyone agrees this sort of questioning is uncomfortable, I certainly wouldn’t take it personally. Your employer — which may well be a government agency or contractor, you have not said — is looking for independent verification of your trustworthiness, and the possibility that you are a covert agent or are in thrall to a foreign power due to blackmail is part of that.


I see what the employer is trying to do here - they are trying to avoid having the expense and hassle of putting someone through vetting if they are going to fail it. And really they are doing so with reasonable intentions.

But that doesn't mean it's okay as I discussed in my answer here these sorts of questions are normal and valid for security vetting purposes (and in some scenarios UKSV will actually ask your former employers these questions themselves) but it's UKSV who ask them and it's only they who get the answers.

The sponsoring organisation only gets a yes or no answer to the question of whether you've been cleared. They can legitimately make having a specific clearance a condition of having the job but the specific details of what hypothetically made you unsuitable for a given clearance are not made available to them intentionally.

They can ask and receive this information with your consent but you don't have to agree. To be honest when I've been in the position of having to have subordinates go through vetting I've always preferred not to know details of a failure, it's invariably sensitive information that I'd just as soon not have the responsibility of processing appropriately!


GDPR restrictions

Any answers relating to "signs of mental or physical illness" is health data, which falls under the scope of GDPR Article 9 "Processing of special categories of personal data". Much stricter than the protection of 'ordinary' personal data, handling such data is prohibited by default (Article 9.1) unless particular specific exceptional conditions apply.

One such exception may apply in this case, namely, Article 9.2 (h):

[.. if one of the following applies: ...] processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

So, in the absence of specific UK law (which might be present or absent, I don't know that) the company would be allowed to ask such a question if and only if it's done according to these conditions, including that paragraph 3

Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

In essence, a licensed doctor (to whom all the ordinary medical privacy/secrecy provisions would apply) could be given these answers and use them in evaluation of the working capacity, but the company would be prohibited to use/store/process that data for pretty much any other purpse.

There are some cases in which this is routinely done - one example that comes to mind is evaluation of airline pilots, the other common situation is for security clearances. However, in both such cases the actual data processing is done by licensed professionals (e.g. doctors/psychiatrists), and the company HR "just asking" to use in their own processes would be illegal.

  • 1
    Your interpretation of GDPR would mean that it's illegal for manager to inform team that one of the members is sick. If person gives consent to security/background check, they are allowed to ask. They are asking for personal opinions, not systematically stored and processed data records. Data records would fall under GDPR, opinions not.
    – Sopuli
    Commented Nov 21, 2019 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .