ICO highlights data protection obligations for employers dealing with TUPE disclosures

The UK's Information Commissioner's Office (ICO) has produced updated guidance which confirms that employers are obliged to disclose employee details to those individuals' new employers under revised TUPE rules that came into force earlier this year. However, the watchdog identified a number of issues businesses should be aware of to ensure that their disclosure of employee data complies with the Data Protection Act (DPA).

TUPE protects employees if the business in which they are employed changes hands, by moving them and any liabilities associated with them from the old employer to the new employer.

"TUPE requires that the new employer is provided with specific details about their new workforce in advance of any transfer or change in service provision," the ICO's guidance (6-page / 235KB PDF) said. "Some employers are unsure how they can comply with the DPA and TUPE when disclosing personal information about their employees. The DPA permits these disclosures because they are required by law. But parties must comply with the data protection principles when handling personal information."

Changes to the TUPE regime which took effect on 31 January mean that certain 'employer liability information', such as employees' pay, hours of work and holiday rights, as well as details of disciplinary action or their involvement in employment disputes must now generally be provided to the employees' new employer at least 28 days before they are transferred to the new business.

The ICO said, though, that businesses should note that new employers may ask for more information about employees than is required to be provided under the TUPE regime and ensure that "excessive and irrelevant information is not transferred".

The watchdog said that businesses will be able to pass on individuals' employment records to a new employer after a transfer of the employee has taken place without requiring that employee's consent to do so. However, it warned that the disclosure of all the details on those files is necessary and determine whether some of the personal data should be deleted or destroyed before the files are shared.

Businesses can retain details about old employees under the TUPE regime but only until it is no longer necessary for the information to be held and providing there is "a justifiable need to keep the information", the ICO said. It said that it may be necessary to retain former employees' personal data "to deal with any liabilities".

The ICO advised businesses to think about data protection compliance when engaging in the TUPE process and added that anonymising data may help businesses to avoid disclosing personal information that they are not required to disclose under the TUPE regime.