Under the Data Protection Act 1998, confidential references which you give are exempt from disclosure. This means that you can legitimately refuse to supply the ex-employee with a copy of the reference.
Obviously, if you are happy to let him see what you have written, then you should disclose it, especially if you are satisfied it is just and true (see further below). Unfortunately, however, the exemption does not cover references received by a prospective employer. Thus, the ex-employee is free to make a request for access to the reference recipients.
In considering whether to disclose the reference, a prospective employer should either obtain your consent or it must be reasonable in all the circumstances to dispense with your consent.
If you want to try and prevent disclosure, you should mark future references 'private and confidential' and include a statement that it should not be disclosed to the ex-employee without your prior written consent. It is not clear what action your ex-employee is threatening under the Data Protection Act 1998. It is assumed his threatened action is, first, in respect of obtaining a copy of the reference, in which case the provisions set out above apply. His next action would be a negligence claim through the civil courts.
You owe a duty of care to the ex-employee in providing a reference to a prospective employer. Your duty is to take reasonable care in the preparation of the reference and you will be liable to the employee in negligence if you fail to do so and the employee suffers loss or damage as a result.
Your obligation is to provide a true, accurate and fair reference. The reference must not give a misleading impression. However, as long as the reference is accurate and does not tend to mislead, there is no obligation on you to set out great detail or to be comprehensive.
Essentially, this means you must be able to substantiate the comments you have made in the reference with hard evidence and you must not give misleading information, whether by the selective provision of information or by the inclusion of information in a manner that would lead a reasonable recipient to draw a false or mistaken inference. For example, you should not allude to an employee's misconduct if you have never carried out an investigation into that misconduct and you do not therefore have reasonable grounds for believing in that misconduct.