I am in the position where I applied for a job in my current institution and did not get the position. I think one of my referees may have provided a negative reference. I know that Universities (or companies) are under no obligation, normally, to show a candidate the reference letter they received for them. However, I am already employed by them in a different role and therefore couldn't I ask for a copy of the reference letter under the DPA? i.e. my employer must provide any information they have on the system about me upon request.
While the question is about whether you are legally entitled to see the letter, I will take the liberty to comment on the question of "should you want to see the letter".
The questions are this: (i) What are the costs associated with requesting the information? (ii) What are the benefits?
As for the costs: Your university (i.e., the people in your department) is likely going to be aggravated by the request. They asked someone for a letter of recommendation, which is generally requested under the assumption that these letters will remain confidential because that is the only way letter writers will be candid. So it is embarrassing for a department to have to let a letter writer know that they will have to make the letter available to the candidate. It is also aggravating to the letter writer themselves, who believed that they can give candid advice. Nobody is going to be happy to break the promise of confidentiality, and people will talk about it because it is so aggravating. It will cost you in terms of your position in the department and your community.
So what are the benefits? Likely none other than you knowing that you shouldn't take that one person as a letter writer again -- but you already suspected that. There is nothing you stand to gain from learning what was in that letter that would help you in the future.
In other words, asking to see that letter is all cost and no benefit. Just don't do it.
Your university should have a procedure regarding the data request. For example, I found these three websites from UK universities regarding this topic:
These all state that you are allowed to request an overview of which data is stored regarding you, and get access to all that data as well.
Furthermore, this website states that job interview documents also fall under the DPA:
Yes, job applicants have the right to see interview notes if the notes are either transferred to computer or form part of a "relevant filing system". The UK General Data Protection Regulation (retained from EU Regulation 2016/679 EU) (UK GDPR) gives job applicants and other data subjects the right to request copies of personal data that an employer holds about them.
So if these reference letters are stored in a university system, you should be allowed to obtain them. However, it is possible that these documents have been removed after the interview process ended.
Whether or not you are already employed by this institution shouldn't make a difference.
This question would probably be a better fit on law.stackexchange.com but as you've asked it here I'll provide the legal answer.
Yes, you can ask (taking the question literally).
That doesn't mean that they have to give it to you though.
Your general rights of access to personal data come from Article 15(1) - (3) of the GDPR.
This is subject to various exceptions. Of relevance here is paragraphs 18 and 24 of schedule 2 of the Data Protection Act 2018 (the "DPA") (emphasis mine):
24 - The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of (a) the education, training or employment (or prospective education, training or employment) of the data subject [...]
18 - In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR) - [...] (c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers) [...]
In fact, they might be obligated not to give you a copy of the reference. That's because the reference is also personal data belonging to the person who wrote it. Giving you a copy means "processing" the data (per the definition of processing in Article 4(2) of the GDPR), and a data controller can only process data to the extent that they have a lawful basis for doing so. In this case the only likely lawful basis is that they have the consent of the person who wrote the reference.
Because of this, there is an additional exemption in the DPA which is applicable here. I'm mentioning this only for completeness; the first exemption is sufficient. Paragraph 16 of schedule 2 of the DPA provides (emphasis mine):
1 - Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
2 - Sub-paragraph (1) does not remove the controller’s obligation where (a) the other individual has consented to the disclosure of the information to the data subject, or (b) it is reasonable to disclose the information to the data subject without the consent of the other individual.
3 - In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including (a) the type of information that would be disclosed, (b) any duty of confidentiality owed to the other individual, (c) any steps taken by the controller with a view to seeking the consent of the other individual, (d) whether the other individual is capable of giving consent, and (e) any express refusal of consent by the other individual.
4 - For the purposes of this paragraph (a) “information relating to another individual” includes information identifying the other individual as the source of information; (b) an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from (i) that information, or (ii) that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.
Frame challenge. Others have explained why requesting to see the reference letter through the data protection act may be a bad idea.
Other suggestion: arrange a confidential meeting with the person who you suspect may have written a poor reference, and ask them if they think they wrote a strong reference letter. There are essentially three possible responses you might get: yes, no, or decline to answer. The answer may or may not be truthful. Make sure your question does not come across as pressing for information they might not want to share. You may or may not get wiser, but the costs will be much lower (perhaps close to zero) than the costs for going through the data protection act.