Disclosure of employee information under TUPE

20140602

Version: 2.0

ICO lo

Disclosure of employee information

under TUPE

Data Protection Act

Contents

Introduction ............................................................................. 2

Overview ................................................................................. 2

TUPE ....................................................................................... 2

What information must be given to the new employer? ................. 3

Can employers disclose this information under the DPA? ............... 3

Can employment records be given to the new employer? .............. 4

Can the employer keep personal information after a transfer? ........ 4

Good practice tips .................................................................... 5

More information ...................................................................... 6

Disclosure of employee information under TUPE

20140602

Version: 2.0

Introduction

1. The Data Protection Act 1998 (the DPA) is based around eight

principles of good information handling. These give people

specific rights in relation to their personal information and place

certain obligations on those organisations that are responsible for

processing it

2. An overview of the main provisions of the DPA can be found in

The Guide to Data Protection.

3. This is part of a series of guidance, which goes into more detail

than the Guide, to help data controllers to fully understand their

obligations and promote good practice.

4. This guidance explains what organisations need to do to comply

with the DPA when providing information about their employees

under the Transfer of Undertakings (Protection of Employment)

Regulations 2006 as amended by the Collective Redundancies

and Transfer of Undertakings (Protection of Employment)

(Amendment) Regulations 2014 (known as TUPE).

Overview

TUPE requires that the new employer is provided with specific

details about their new workforce in advance of any transfer or

change in service provision. Some employers are unsure how they

can comply with the DPA and TUPE when disclosing personal

information about their employees.

The DPA permits these disclosures because they are required by

law. But parties must comply with the data protection principles

when handling personal information.

TUPE

5. TUPE is designed to preserve employees’ terms and conditions of

employment when either a business or undertaking is transferred

to a new employer, or there is a ‘service provision change’ (for

example, contractor A takes on a contract to provide a service

for a client from contractor B and the same staff provide the

service). These transfers or changes in service provision are

referred to as ‘relevant transfers’.

Disclosure of employee information under TUPE

20140602

Version: 2.0

What information must be given to the new employer?

6. TUPE requires that the following information (known as

‘employer liability information’) must be given to the new

employer before the transfer takes place.

 Identity (usually the name) and age of the employees

who will transfer.

 Information contained in their ‘statements of employment

particulars’, such as written statement of pay, hours of

work, holidays and so on (usually contained in the

employee’s offer letter or contract of employment).

 Information about any relevant collective agreements.

 Details of any disciplinary action taken against an

employee in the last two years.

 Details of any grievance action raised by an employee in

the last two years.

 Details of any legal action (before the court or

employment tribunal) brought against the employer by

an employee in the last two years and information about

any potential legal action.

7. Following amendments to the TUPE regulations in 2014, for

transfers which take place on, or after 1 May 2014, employers

must provide this information at least 28 days before the

transfer is completed (previously 14 days). If special

circumstances make this impractical, employers should supply it

as soon as possible.

8. For more general information about the amendments introduced

by the Collective Redundancies and Transfer of Undertakings

(Protection of Employment) (Amendment) Regulations 2014, see

the ACAS leaflet, ‘2014 changes to TUPE’ (www.acas.org.uk).

Can employers disclose this information under the DPA?

9. Employers must disclose the information required under TUPE

and face penalties if they do not. The DPA allows this disclosure

because it is required by law. However, both parties must take

care to comply with data protection principles when handling this

personal information. For example:

Disclosure of employee information under TUPE

20140602

Version: 2.0

 some transfers are outside the scope of TUPE (such as

share takeovers);

 in the early stages of the sale of a business there may be a

number of potential bidders, only one of whom will become

the eventual new employer but all of whom need the

information to assess whether to pursue the purchase; or

 the prospective new employer may request more

information than is required under the TUPE regulations.

10. Wherever possible, the employer should release information that

is anonymous or, at the very least, should remove obvious

identifiers such as name. Employers should only disclose this

extra information with the consent of the individuals concerned,

or put in place appropriate safeguards to make sure that the

information will only be used in connection with the proposed

business transfer and will not be kept once it has been used for

this purpose.

11. For more detail on handling requests for information in relation

to employment records, see the ICO Employment Practices Code

on www.ico.org.uk.

Can employment records be given to the new employer?

12. It is likely that once the transfer has taken place the new

employer will need a large proportion of an individual’s

employment record to manage the workforce and run the

business. The former employer would not need the employees’

consent to the transfer of their personal information if it was

necessary for the purpose of the transfer and business needs of

both parties. The new employer should consider whether all the

information in the personnel files is needed and delete or

destroy and unnecessary information.

Can the employer keep personal information after a

transfer?

13. The former employer will normally have to keep some personal

information about former employees, for example to deal with

any liabilities. The DPA permits this, as long the former

employer has a justifiable need to keep the information, and

Disclosure of employee information under TUPE

20140602

Version: 2.0

only keeps it for as long as necessary. The former employer

should delete or destroy securely any information they do not

need to keep.

Good practice tips

 Think about data protection early in the TUPE process.

 Agree what information you should transfer, and how,

well before a transfer takes place.

 Make sure those responsible for negotiating the transfer

of staff are aware of their responsibilities to comply with

the data protection principles, for example, to keep

personal data up to date and secure.

 Make sure you transfer enough information to meet your

TUPE obligations and to allow the new employer to run

the business and manage the staff. However, both parties

should make sure that excessive and irrelevant

information is not transferred.

 Make sure any information handed over is used only for

the purposes of TUPE until the transfer of staff is

completed.

 Tell employees that their information will be passed to the

new employer. This may not always be possible, if for

example, ‘insider training’ restrictions apply.

 Consider whether personal information could be

anonymised before providing any information which is not

required by TUPE.

 Make sure, once the transfer of staff has been completed,

that employment records are accurate, relevant and up to

date, and any unnecessary information is destroyed

securely.

Disclosure of employee information under TUPE

20140602

Version: 2.0

More information

15. Additional guidance is available on our guidance pages if you

need further information on other parts of the DPA.

16. This guidance has been developed drawing on ICO experience.

Because of this it may provide more detail on issues that are

often referred to the Information Commissioner than on those

we rarely see. The guidance will be reviewed and considered

from time to time in line with new decisions of the Information

Commissioner, Tribunals and courts.

17. It is a guide to our general recommended approach, although

individual cases will always be decided on the basis of their

particular circumstances.

18. If you need any more information about this or any other aspect

of data protection, please contact us, or visit our website at