My best advice to the person that originally asked this question is the best thing would be to find Bob first, if google didn't work which most times it doesn't try contacting him on facebook or the other popular social network site (my answer keeps getting rejected as spam when I mention other sites), that's usually the best places to locate ppl on the net, or maybe "Linked In" he might have a profile there since he is job searching.
Discuss with Bob what he wants you to say and tell him what you're comfortable with saying. Then politely inform him to not list you as a reference in the future without asking first.
If you cannot locate Bob then your safest bet to protect yourself legally and also not hurt Bob's chances of getting a job would be to lie to the company asking about him and say they got the wrong person, you're not the one that worked at ACME inc. with Bob and don't know or ever worked with Bob and probably just share the same name as the person he referenced.
If they say he gave them your contact info then reply it must've been his error when he searched for his references contact info he say your name and assumed it was the right person and put down your info. Basically you don't know him and it's no ones fault.
I don't know what the definition of "personal" recommendation is as opposed to "professional" in Germany. Does personal mean "your opinion of bob's character?" In that case you can just list his personality traits and not discuss his work performance.
I live in the USA and I managed 5 family businesses part time during the week and all 5 full time on weekends when my parents went camping out of town, this was in the 90's in a small town. I was always told you can't say anything bad about someone ever even when you do have proof. I'm not sure if we're allowed to say anything negative even with proof, here in this country that fact is generally irrelevant to most businesses and people bc even if you think you have proof why would you risk your job or your money if said evidence ends up not being held up in court? It does not benefit you to risk yourself just to hurt an ex employees chances at another job so just to be safe and protect themselves legally. The general rule is never say anything negative when asked to give a reference for an ex employee. I've never bothered to look into if it's legal to say with proof because it almost never happens and people rarely ever do it because it's a risk with no reward and not a smart thing to do in the first place so it's always been irrelevant for me to know if it's legal to do with proof here or not.
We basically would just give a general description of their job title and responsibilities, if they were great and we liked them we'd say all the great things we want about them but if we didn't like them then we would use phrases like "Performance was adequate or average", we don't comment on attendance issues due to the many laws such as "Americans with disabilities act", "Family medical leave act", etc that there may be parts of the laws we may be ignorant of or don't know so no one comments on attendance and I've never been asked by any other company or any third party background investigators some companies hire to check applicant resumes.
BUT, on the other hand, not everyone follows these common sense strategies and every once in a while you will come across someone who is ignorant of the laws and/or has intense anger and wants to hurt the ex employee and will bad mouth them anyway, then theres some that know the laws but will bad mouth someone they don't like anyway because they know there is very little chance that what they said would get back to the ex employee being referenced because if you don't get hired for a job 9 times out of 10 you just never hear from the company you applied at ever again or rarely if they're polite you may get a form letter in the mail letting you know that the position has been filled but the company would never admit that they didn't hire you due to a bad reference or something bad someone said about you as that would put the company at risk of being sued by both the applicant and the reference.
A lot of USA is small towns where everyone knows everyone though and sometimes a reference can use codes and slang to tell a potential employer that the employee was a bad employee to protect their town's other business owners and their own reputations. Small businesses in small towns sometimes do have to secretly answer honestly and still protect themselves from legal problems. If you call from a small town business to another small business in the same town and the employee you're enquiring about was a very bad employee and the reference doesn't tell you to protect you and you lose a ton of money on this employee then the reference giver now has a bad reputation and will not be trusted dealing with other businesses in town in the future and a bad reputation in a small town could destroy your business and drive you to shut down.
But on the other hand, it is a small town so if someone calls asking for a reference you don't know that the person calling could be a close friend or family member of the employee they're asking about so if you say anything negative and they tell the employee then the employee can sue the reference, so it's usually coded using slang or words and phrases that can be easily twisted in court if sued.
For instance I once called another salon from mine to ask about an applicant and was told "She has sticky fingers." I don't know what all countries use that phrase but here it means someone is a thief and will steal product or money. But if they were taken to court they could easily protect themselves with the defense it was taken out of context or the person asking didn't hear the beginning part where I said "She eats marshmallows for lunch everyday" and only heard the end of the sentence saying "and she has sticky fingers." and the case would get thrown out and no one in trouble, so the local business owner can still protect their reputation using codes or coded phrases and still protect themselves from legal problems.
I've also spent a decade working for large national corporations and pretty much large corporations usually always have the same procedure in regards to reference checks. They are only allowed to be given from human resources unless a specific employee is listed to be the one asked. Most times the HR dept will be in a different building and not know most of the employees personally and they are only allowed to verify that the person worked there, their job title and/or duties, and the dates they worked there.
Even if the employee was fired pretty much all HR personal are taught and instructed not to answer or reveal if the employee was terminated or even if they quit on their own and if asked are trained to say "We do not reveal reasons for why they left the company, we can only provide you with a start and end date."
While we do have laws against providing negative info in references, it is VERY VERY rare to ever see a court case regarding a bad reference. In my experience I've only seen one which involved rival families from rival businesses and I'll call them the "fake employee" applied for the job not actually wanting it to purposely have their family member bait the reference into giving a bad review on purpose so they could tell the "fake employee" what their ex employer said about them so they can sue and the family member that called to ask for the reference could be a witness to what was said. When the judge found out the relationships between all the parties involved the case was thrown out, no one won, no one lost. I believe the judge threatened the possibility of fraud charges the "fake employee" could be charged with, but it was so long ago I don't remember if they got in trouble for fraud afterwards or not.
I'm sorry I don't live in Germany but I hope I have helped you or anyone else in this situation in the future, in any country it is best to just use the strategy I described corporate hr deptartments using just to be safe and protect yourself. Don't take risks where no reward is involved.