ICO issues guidance on disclosing employee information under TUPE

The Information Commissioner’s Office (“ICO”) has issued guidance this month for how businesses should comply with their obligations under the Data Protection Act 1988 (“DPA”), when providing information about their employees under the Transfer of Undertakings (Protection of Employment) (Amendment) Regulations 2014 (“TUPE”).

By way of reminder, where a business transfer or service provision change takes place, TUPE seeks to safeguard the rights of employees of the transferred business. As part of the transfer process, the outgoing employer is required to provide the incoming employer with information about their new workforce prior to the transfer. This includes the type of information found in Contracts of Employment, as well as details of any ongoing disciplinary or grievance mattes.

Clearly this can cause some concern for employers who are conscious of remaining compliant with their obligations under the DPA, especially when the identities of the transferring employees and otherwise confidential details of any disciplinary and grievance matters are disclosed.

This is particularly the case where a number of potential bidders for a business or a contract exist, whom the outgoing employer may need to liaise with.

The ICO’s guidance is useful to employers in that it:

• Provides a reminder of what information must be provided under TUPE;
• Gives assurances of when such disclosures of information will be permissible under the DPA (thereby avoiding a breach);
• Offers examples of situations where caution should be taken in complying with data protection principles; and
• Provides advice on the circumstances in which a former employer can keep an employee’s personal information, and the basis on which this should take place.

Additionally, the guidance gives ‘good practice tips’ for employers to consider such as:

• Ensuring that any information handed over is only used for the purposes of TUPE until the transfer is completed;
• Informing employees that their data will be passed on to the new employer; and
• Considering whether personal information could be anonymised where possible, subject to the obligations under TUPE.

Employers should ensure that they take a cautious approach to such processes, and it is disappointing that the guidance is not overly extensive. As such, risks will remain where information is disclosed but falls outside of the scope of what is legally required under TUPE.

Employers affected can access the guidance via the ICO’s website and should speak to their usual Irwin Mitchell contact to discuss any specific concerns.