Can a potential employer speak to people other than your nominated referees?

When you apply for a job in New Zealand, you’ll often be asked to provide referees, such as former employers or supervisors, so the potential new employer can check your work history and suitability. But what happens if the employer contacts other people, such as ex‑colleagues or friends, without your knowledge or consent? Is that allowed? And if such a conversation influences a decision not to hire you, do you have any recourse?

Under New Zealand law, contacting people who weren’t nominated as referees without your consent can be a breach of privacy. There are protections, and you can take steps if you think those protections were breached.

The main law to consider is the Privacy Act 2020. That act governs how employers (and prospective employers) may collect, hold, use, and disclose personal information about individuals, including job applicants.  Under the Information Privacy Principles, personal information should generally be collected directly from the person concerned, unless there's a good reason otherwise. And if information is going to be sought from third parties for a reference check, the applicant’s consent is required. 

Can my employer contact people other than the referees I have provided?

A prospective employer shouldn’t contact people other than the referees you provided unless you have expressly agreed to that. A potential employer can’t just ring up anyone who might know you and ask about your past without your permission.

Employers often use reference checks to verify that what you’ve told them on your CV or in interviews is accurate, including things like previous job titles, dates of employment, performance, and reliability.  In some cases, an employer might think they can reach out to a former co‑worker or mutual contact to get more context, and that is understandable as employers want to reduce the risk of a bad hire, but under New Zealand law, it is only allowed if you’ve given prior consent. Otherwise, it risks breaching the Privacy Act.

There are important reasons why these limits exist:

Fairness.  You should know who is talking about you, what they’re saying, and have the chance to respond if it’s negative or inaccurate.

Accuracy.  Unsolicited references or third‑party gossip can be unreliable, biased, or misleading. Relying on them without your consent is not only unfair, but a risk for employers too.

Privacy and dignity.  Your personal and work history is personal. Having employers contact people you didn’t list without your consent can feel intrusive. The law recognises that.

What about information from public sources (e.g. social media, Google or LinkedIn)?

Many employers use internet searches, including social media checks, online portfolios, general Googling, as part of pre-employment screening. That practice is generally allowed, so long as the information is publicly available, and such information may be considered by the employer when deciding whether to hire someone.  

However, even when using public info, the employer must follow the Privacy Act’s principles. They must ensure collection is necessary for a legitimate business purpose, and they must handle the information fairly and responsibly.  If they rely solely on public information, without contacting a person, the law typically allows that. But if they then contact a non‑referee for comment, who they have found from public information, then consent would be needed.

What happens if they do contact someone else without your consent?

If a prospective employer contacts people you did not nominate and you did not consent, that is a privacy breach under the Act.  You do have some potential recourse in this situation.  You could raise a complaint under the Privacy Act, either directly with the employer (or prospective employer), or with the office of the New Zealand Privacy Commissioner.

According to guidance from the Commissioner’s office, if a person obtains information about you from someone other than your nominated referees without your consent, this may raise privacy issues. If you believe you suffered harm, such as reputational damage or prejudice that affected your chances, you might have grounds to seek remedy. The Human Rights Review Tribunal (HRRT) has previously awarded damages in such cases. In one case, which went to the HRRT, it was found that a former employer breached privacy when they provided personal information about an ex employee to a new employer without authorisation.  In this case, the former employee was awarded a modest sum for the breach.  So it’s not just a bad practice, it can be legally actionable.

You also have the right to request from the employer what personal information about you they hold, including reference notes, under the Privacy Act. That may help you assess whether unauthorised contacts occurred.

It’s worth noting, though, that even if they collected information improperly, the employer might argue their decision relied on other lawful information such as public information or what you told them directly. As with many privacy law complaints, the outcome can depend on the facts.

What can you do as a job applicant if you want to protect yourself?

1. Only list referees you trust and who consent. Don’t assume it’s okay for an employer to contact other people.

2. If asked for consent to contact additional people, always ask what kind of information they’ll seek, who will be contacted, and whether you can approve those contacts in writing.

3. Keep copies of your job application, CV, and the list of referees you gave. Having a record helps if you suspect privacy laws have been breached.

4. If you aren’t hired and suspect unauthorised checking, request the information held about you. You can ask the employer for what personal data they collected, who they contacted, and on what basis.

5. Consider a privacy complaint if you believe there’s a breach. If the employer has acted without your consent in a way that caused you harm (e.g. lost job opportunity), you may have grounds to complain to the NZ Privacy Commissioner.

FAQs

Can an employer ask to contact my current employer even if I didn’t list them as a referee?

Only if you give your express consent. Otherwise, they should not contact them. The same rule applies to any other person you did not nominate as a referee.

What if the employer just checks my social media or public posts?

That’s generally allowed because it involves publicly available information. But if that leads them to contact someone (like a friend from social media) for comment, then consent is required.

I suspect an employer contacted someone I didn’t list, and I want to find out. What can I do?

You can ask the employer for any personal information they hold about you (including reference‑check notes or comments) under the Privacy Act. If they refuse or you believe there was a misuse of your information, you can complain to the New Zealand Privacy Commissioner.

If I wasn’t hired, can I claim damages because of an illegal reference check?

Possibly. There is precedent where a tribunal awarded damages for a breach of privacy when an employer provided information without permission.

Does this mean employers shouldn’t do reference checks at all?

No. Reference checks are common and legitimate but they must be done properly. That means contacting only referees you nominated (unless you consent otherwise), keeping information confidential, and handling personal data in line with the Privacy Act. 

In the recruitment process, reference checks are a valuable and common tool for employers to verify your experience, and check that you’re a good fit. But in New Zealand, those checks must respect your privacy.  If you only nominated certain referees, a potential employer doesn’t have the legal right to contact other people you know without your permission. If they do, it can amount to a breach under the Privacy Act and you may have the right to find out what was said, and even pursue a complaint.

If you believe your employer or potential employer has breached your privacy when checking references or making decisions about your employment, get in touch for a free consultation.

Online form

Disclaimer: The information provided in this blog is for general informational purposes only and should not be considered legal advice. While we strive to keep the information accurate and up to date, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the blog or the information, products, services, or related graphics contained on the blog for any purpose. Any reliance you place on such information is therefore strictly at your own risk. For specific legal advice tailored to your situation, please contact a qualified legal professional.