Employers want to make sure that the employee they've selected for a job is the right fit, which includes verifying some parts of the employee's story. This is what references are for, but companies also use references to assess a prospective employee's qualifications and ask for the referee's opinion.
That can create trouble in the form of lawsuits if the employee doesn't get the job. For this reason, companies need to have reference policies in place, governing what supervisors can -- and can't -- tell a former employee's prospective boss.
No Normative Information
Only standard-issue HR information, no opinions on an employee's competency or qualifications, should come through a reference. True, the difficult burden of proving a former employee didn't get a new job because of your reference lies with the employee, but a disgruntled employee could still make you litigate it. (Or, alternatively, the new company could sue if the old manager didn't mention something important, as in the case of an anesthesiologist whose former employee didn't tell his new one that he was fired for using narcotics at work.) Having a neutral policy that applies to everyone means the legal department will sleep better at night.
It's OK to Give Out Factual Information
We've heard horror stories about companies, desperately afraid of lawsuits, that refuse to give any information out about former employees, including factual information like when they left, what their salaries were, and whether they actually worked there. That's legal in some states, but it's also bordering on unreasonable and can also negatively impact a former employee if a potential employer can't verify that they ever worked there. Rest assured that providing facts isn't going to land you in hot water. (Some states, like California, provide legal defenses to a few specific questions that prospective employers can ask.)
What About Personal References?
Even though employees can't give out opinionated professional references, little is stopping them from giving out opinionated personal references. The only real distinction between the two is that the latter don't involve company letterhead or a company email address. This way, the employee making the reference is saying, "Hey, I'm talking about Bill Smith in my capacity as his friend, not as his work colleague or boss."
There should still be a policy governing personal references, though, emphasizing that company letterhead shouldn't be used, and that the person giving the reference should state that his or her opinion isn't that of the company. (A little advice on how to write a good reference -- and avoid personal liability -- couldn't hurt, either, as well as how to turn someone down for a recommendation.)