Giving bad references about a former employee may create employment, reputational and data protection risks without a valid basis.