Hi, sorry I was offline by the time you had replied. The school should have only contacted the new employer if they had been asked to provide a reference. Legally there is nothing preventing them from contacting anyone else, just as you are free to contact whoever you wanted, but they have to be careful that any information they provide does not breach data protection rules and that it is also accurate.
I would not say there is a data protection issue here because the information they would have shared is something that is public so it is not like it was entrusted to them for confidential safekeeping. However, they have not been accurate with what they said and they have potentially caused issued for him by providing false information to a third party. This could be negligent on their part and if he had suffered losses as a result then he could have taken matters further. This was not the case here but it could be a potential issue in the future.
So it would be best if he contacts them and makes it clear that without a formal reference request they should not be contacting parties in the future and also that if they were to provide a reference it should be truthful and accurate and the information they provided here was not. Finally, he needs to be clear that if they provide false information again and he suffers losses as a result, he would be pursuing them for negligence.
This is your basic legal position. I have more detailed advice for you in terms of the steps he needs to follow should he have to pursue them for negligence in the future, which I wish to discuss so please take a second to leave a positive rating for the service so far (by selecting 3, 4 or 5 stars) and I can continue with that and answer any further questions you may have. Don’t worry, there is no extra cost and leaving a rating will not close the question and we can continue this discussion. Thank you