Re: Bad references
AFAIK, it's nothing to do with the reference which is "illegal" (as pointed out above). The legal conundrum can come from possible libel/slander*.
If you have evidence to back up what you say, you are entitled to say it. However, as with anything, if you say something bad about a person they can take you to court for libel/slander and (AFAIK) you must prove that what you said was accurate. According to Wikipedia:
In the common law of libel, the claimant has the burden only of proving that the statement was made by the defendant, and that it was defamatory. These things are generally relatively easy to prove. The claimant is not required to prove that the statement was false. Instead, proving the truth of the statement is an affirmative defence available to the defendant.
So, if you can prove that what you say is true, by all means say it. If you cannot, or just don't want to risk a lawsuit, just refuse to give a reference. This will be taken as a bad reference anyway, so does pretty much the same job. This is why companies rarely give a bad reference: Purely because they can't be arsed with a lawsuit, and refusing to give a reference has the same effect with no risk.
* I can never remember which way round these are.