The Information Commissioner's Office (ICO) has published new guidance on what employers need to do to comply with the Data Protection Act 1998 (DPA) when disclosing personal information about their employees under TUPE.
The guidance aims to help employers understand their obligations and also provides a list of good practice tips.
TUPE requires that the new employer is provided with specific information about transferring employees by the old employer before a transfer takes place. The DPA permits these disclosures because they are required by law.
The guidance states that wherever possible personal information should be anonymised. At the very least obvious identifiers such as names should be removed. This extra information should only be disclosed with the employee's consent or if appropriate safeguards have been put in place.
The guidance provides that employee's employment records can be given to the new employer without the employee's consent provided they are necessary for the purpose of the transfer and the business needs of both parties. Any unnecessary information should be deleted or destroyed securely before the files are given to the new employer.
The former employer can keep some personal information about former employees as long as there is a justifiable need to do so and it is only kept for as long as necessary. Any information the former employer does not need to keep should be deleted or destroyed securely.
The guidance also provides a list of good practice tips. These include:
- Thinking about data protection early in the TUPE process
- Agreeing what information is to be transferred well before the transfer takes place
- Telling employees that information concerning them is being passed to the new employer