Disclosure Dilemma? Information Commissioner’s Office issues guidance on data protection.

Meet the team:

Share this post: linkedin Twitter facebookshare Email
Posted in:Corporate and Commercial|October 3, 2014 | Join the mailing list

The Information Commissioner’s Office (ICO) has recently published new guidance for employers to help them understand their data protection obligations in light of the amendments to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (TUPE).

TUPE applies when there is a “relevant transfer” which can be either:

• the “transfer of an undertaking” (briefly, the transfer of an “economic entity” which retains its identity after the transfer); or

• a “service provision change” (where one party contracts out a service it used to perform itself or where it contracts in a service that used to be provided to it by a third party or where there is a change in the identity of the third party contractor providing
a  service).

When TUPE applies, the employees who work in that undertaking or in the provision of that service have certain employment protections. The main implication is that their employment transfers, on the same terms and conditions and without any break in continuous
service, to the party who will be continuing the business of the undertaking or providing the service in future (the “transferee”).

There are also obligations on the current employer (the “transferor”) to provide information to the transferee about the employees whose employment will, under TUPE, transfer.  For transfers taking place on or after 1 May 2014, the transferor must provide this
information no less than 28 days in advance of the transfer (subject to an exception where special circumstances make this impractical). 

Data Protection

Transferors need to be aware that they must comply with the Data Protection Act 1998 (DPA) when disclosing personal information about employees. The information they must disclose typically includes name, age and employment particulars, together with details
of collective agreements and any disciplinary, grievance or legal action related to the employee. The DPA allows this disclosure because the disclosure is required by law. However, according to the ICO’s guidance, transferors must still be careful with the
data they release, for instance in the early stages of a sale process (where the information is released to more than one potential transferee) or in case TUPE may not actually apply to the transfer or if the transferee requests more information than TUPE

The guidance says that personal information should be disclosed without obvious identifiers (for example names) wherever possible. Personal information which identifies the employee should only be disclosed with the employee’s consent or after appropriate safeguards
have been enacted, such as ensuring that it will only be used in connection with the relevant transfer and that it will not be kept afterwards.

According to the ICO, transferors aren’t required to seek an employee’s consent before handing over their employment records to the transferee, provided the transfer of that information is necessary. However, any unnecessary information should be deleted or
securely destroyed prior to this. Similarly, employers may keep some personal information about former employees if this is necessary for business purposes (such as dealing with liabilities), but anything not required should be deleted or destroyed.

Good Practice Tips

The ICO guidance provides good practice tips for employers, such as the need to consider data protection at an early stage of the TUPE transfer process. Employers are also advised to inform employees of any information concerning them that will be handed over
upon transfer. Ideally, employer and employee should be in agreement over the information that needs to be passed on. The ICO’s guidance document can be found by

clicking here

It is important for any employer involved in a business transfer to fully understand the rights of their employees, as well as their own legal obligations, under both TUPE and the DPA and employers should always seek legal advice well in advance of a proposed
transfer, as not doing so could result in significant liabilities which, with the proper advice, could have been avoided.

For more information about any of the above or for practical commercial advice on this or any
other aspect of employment law, please contact Kim Freeman-Smith of the Berg Employment Team on 0161 829 2599 or email her at

Follow us on Twitter: @Berg_HR

(The information and opinions contained in this article are not intended to be comprehensive, nor to provide legal advice. No responsibility for its accuracy or correctness is assumed by Berg or any of its partners or employees. Professional legal advice should
be obtained before taking, or refraining from taking, any action as a result of this article.)

Join our mailing list

More from berg


"Her advice was absolutely first class, timely and ensured I received the best possible settlement in the circumstances"

Employment Client, Anonymous.

"We have used berg in the past, their professional support and guidance was fantastic"

Neil Ashton, Operations Director, Packaging Automation Limited.