Many of you will be aware of the obligations imposed on employers by the TUPE Regulations when one business is buying another or when an out-sourced contract is awarded to a new supplier or brought back in-house. In such circumstances, with a few exceptions, the Regulations operate to protect the employment of the employees employed by the business being bought or engaged on the contract being outsourced and their employment will automatically transfer to the new business on the same terms and conditions.
One of the obligations imposed by the Regulations is that they require the existing employer to provide the new employer with certain information about the terms and conditions of employment of the transferring staff, so that the new employer knows the liabilities it is taking on. This information needs to be provided to the new employer at least 28 days before the transfer (or as soon as possible thereafter if this is impractical).
The information that needs to be provided to the new employer before a transfer takes place is:
It has long been a concern of employers that the provision of such information to the new employer may be a breach of the Data Protection Act 1998 which requires employers to keep their employees’ data confidential. This concern is heightened in a competitive tendering situation where several businesses are trying to win an outsourced contract: in this circumstance the existing employer will not wish to disclose employee data to all of the potential new employers, especially given that such data may be commercially sensitive as well as personal.
However, the Information Commissioner’s Office has recently issued new guidance on how to balance an employer’s duties in relation to employee personal data and an employer’s duties under the TUPE Regulations to provide certain information to a new employer in advance of a transfer.
In summary, the disclosure of information is permitted under the Data Protection Act as it is required by law provided that those disclosing the information, and also those in receipt, follow the data protection principles. As TUPE was introduced with the aim of protecting the rights of the employee on a transfer and it will be necessary for a new employer to have this information in order to ensure that their rights are protected, clashes between data protection and TUPE obligations only seldom arise. However, there are nevertheless penalties and consequences for employers who don’t comply with their obligations.
One of the main points made in the new guidance is that, wherever possible, the employer should anonymise information before it is released and if additional information is to be disclosed (i.e. information beyond that listed above), consent should be obtained from the employees concerned. It is good practice to ensure that employees are informed that their personal information will be sent to the new employer and also to ensure that the new employer is informed that the information should only be used for the purposes of the transfer and should be held in accordance with the data protection principles.
The old employer will also have obligations in relation to retaining personal information after a transfer: they will be permitted to keep personal information after the transfer, predominantly to allow them to deal with any liabilities that may arise. However, they will also have to ensure that there is a justifiable need to keep the information and only keep it for as long as is necessary.
If you have any queries in relation to the Data Protection Act or the TUPE Regulations, or the interaction between the two, please do get in touch.
The new Guidance from the Information Commissioner’s Office can be found here: