The new note was issued by the ICO on 4 June 2008. It is intended to offer guidance to help organisations comply with the Data Protection Act when providing information about their employees under the Transfer of Undertakings (Protection of Employment) Regulations (TUPE). TUPE ensures that employees’ terms and conditions of employment are preserved when a business or undertaking is transferred to a new employer. To achieve this, TUPE requires that certain information is provided to the new employer before the transfer takes place. This will include details of pay, contracted hours, holiday entitlement and any details of disciplinary or grievance action relating to that employee. The Data Protection Act does not prevent the transfer of this information as it is a requirement by law. However, both parties must comply with the Act when handling the information, for example ensuring it is accurate, up-to-date and secure.
Phil Jones, Assistant Commissioner at the ICO, said: ‘Organisations should consider their data protection obligations early in the transfer process and only transfer the information required by the new employer. Additionally, if not prevented by insider trading restrictions, employees should be told that their information is going to be passed on.’
The note is available on the ICO web site (www.ico.gov.uk) but is reproduced below for the assistance of SCL members.
‘This good practice note explains what organisations need to do to comply with the Data Protection Act 1998 (the Act) when providing information about their employees under the Transfer of Undertakings (Protection of Employment) Regulations 2006 (commonly known as TUPE).
The situation
TUPE is designed to preserve employees’ terms and conditions of employment when either a business or undertaking is transferred to a new employer, or there is a ‘service provision change’ (for example, contractor A takes on a contract to provide a service for a client from contractor B and the same staff provide the service). These transfers or changes in service provision are referred to as ‘relevant transfers’.
TUPE requires that the new employer is provided with specific details about their new workforce in advance of any transfer or change in service provision. Some employers are unsure how they can comply with both the Act and TUPE when disclosing personal information about their employees.
What information must be given to the new employer?
TUPE requires that the following information (known as ‘employee liability information’) must be given to the new employer before the transfer takes place.
• Identity (usually the name) and age of the employees who will transfer.
• Information contained in their ‘statements of employment particulars’, such as written statement of pay, hours of work, holidays and so on (usually contained in the employee’s offer letter or contract of employment).
• Information about any relevant collective agreements.
• Details of any disciplinary action taken against an employee in the last two years.
• Details of any grievance action raised by an employee in the last two years.
• Details of any legal action (before the court or employment tribunal) brought against the employer by an employee in the last two years and information about any potential legal action.
Employers must provide this information at least two weeks before the transfer is completed. If special circumstances make this impractical, employers should supply it as soon as possible.
Can employers disclose this information under the Act?
Employers must disclose the information required under TUPE and face penalties if they do not. The Act allows this disclosure because it is required by law. However, both parties must take care to comply with data protection principles when handling this personal information. For example, they should make sure that the information is accurate, up to date and secure. The new employer must be careful to use the information only for the purposes of TUPE, such as assessing possible liabilities or planning how employees are going to be adopted into the business.
Can employers disclose information when TUPE obligations do not apply?
There may be situations when employers receive requests for information about their transferring workforce in addition to that required by TUPE. For example:
• some transfers are outside the scope of TUPE (such as share takeovers);
• in the early stages of the sale of a business there may be a number of potential bidders, only one of whom will become the eventual new employer but all of whom need the information to assess whether to pursue the purchase; or
• the prospective new employer may request more information than is required under the TUPE regulations.
Wherever possible, the employer should release information that is anonymous or, at the very least, should remove obvious identifiers such as name. Employers should only disclose this extra information with the consent of the individuals concerned, or put in place appropriate safeguards to make sure that the information will only be used in connection with the proposed business transfer and will not be kept once it has been used for this purpose.
You can find more information on handling requests for information in relation to employment records in our Employment Practices Code, which is on our website (www.ico.gov.uk).
Can employment records be given to the new employer?
It is likely that once the transfer has taken place the new employer will need a large proportion of an individual’s employment record to manage the workforce and run the business. The former employer would not need the employees’ consent to the transfer of their personal information if it was necessary for the purpose of the transfer and business needs of both parties. The new employer should consider whether all the information in the personnel files is needed and delete or destroy securely any unnecessary information.
Can the former employer keep personal information after a transfer?
The former employer will normally have to keep some personal information about former employees, for example, to deal with any liabilities. The Act will allow this as long as the former employer has a justifiable need to keep the information and only keeps it for as long as necessary. The former employer should delete or destroy securely any information they do not need to keep.
Recommended good practice
• Think about data protection early in the TUPE process.
• Agree what information you should transfer, and how, well before a transfer takes place.
• Make sure those responsible for negotiating the transfer of staff are aware of their responsibilities to comply with data protection principles, for example, to keep personal information up to date and secure.
• Make sure you transfer enough information to meet your TUPE obligations and to allow the new employer to run the business and manage the staff. However, both parties should make sure that excessive and irrelevant information is not transferred.
• Make sure any information handed over is used only for the purposes of TUPE until the transfer of staff is completed.
