Data Protection and TUPE
The Information Commissioner’s Office has published Guidance Notes on Disclosure of Information under TUPE. These are only short and confirm a number of practical matters which employers involved in TUPE transfers will frequently have to deal with. They are available on the ICO website. Information contained within the guide includes:
- Wherever possible, the employer should release information that is anonymous or, at the very least, should remove obvious identifiers such as name.
- Employers should only disclose this extra information with the consent of the individuals concerned, or put in place appropriate safeguards to make sure that the information will only be used in connection with the proposed business transfer and will not be kept once it has been used for this purpose.
- The former employer does not need the employees’ consent to the transfer of the personal information if it was necessary for the purpose of the transfer and business needs of both parties.
- The former employer will normally have to keep some personal information about former employees, for example to deal with any liabilities. The DPA permits this, as long the former employer has a justifiable need to keep the information, and only keeps it for as long as necessary. The former employer should delete or destroy securely any information they do not need to keep.
- The new employer should consider whether all the information in the personnel files is needed and delete or destroy and unnecessary information.
It also lists some good practice tips to reflect the aims above.