Location: Northern Ireland
Rep.of Ireland
Location: Northern Ireland
Rep.of Ireland
Home / Articles First Tuesday Q&A NI

GDPR implications of providing employee information in a TUPE situation

Posted in : First Tuesday Q&A NI on 4 June 2019
Arthur Cox
Arthur Cox
Issues covered:

In a TUPE transfer, the transferor (former employer) must provide the transferee (new employer) with employee liability information in relation to the transferring employees as set out under Regulation 11 of the Transfer of Undertakings (Protection of Employment) Regulations 2006 (“TUPE”) This includes: 

  1. the identity and age of the employee;  

  1. the written employment particulars required to be given to the employee under article 33 of the Employment Rights (Northern Ireland) Order 1996;  

  1. information on any disciplinary procedure taken in relation to the employee or grievance procedure taken by the employee within the previous two years;  

  1. information on any court or tribunal case, claim or action brought by the employee against the transferor within the previous two years, or any court or tribunal case, claim or action arising out of the employee's employment that the transferor has reasonable grounds to believe the employee may bring against the new employer; and  

  1. information about any collective agreement that will have effect after the transfer in relation to the employee. 

It is not possible for the transferor to contract out of this obligation. The tribunal can award the new employer compensation starting at a minimum of £500 per employee for whom the information was not provided. 

The above information constitutes “personal data” under the GDPR. Therefore, a lawful basis for processing must be satisfied under Article 6 of the GDPR. As the information is being provided in accordance with the transferor’s statutory obligation under TUPE, the transferor can rely on Article 6(1)(c) (legal obligation) of the GDPR to process the data.  

In any event, the transferring employees should have received the transferor’s privacy notice which should explain all instances when their personal data may be processed in the course of their employment with the transferor.  

However, if the transferor is providing personal information above and beyond the employee liability information set out under Regulation 11 of TUPE, it will need to ensure it satisfies one of the other lawful bases for processing under Article 6(1) of the GDPR (and potentially also under Article 9 if the personal data is sensitive in nature). It will also need to consider the data protection principles such as data minimisation and such information may need to be redacted or anonymised.  

Back to Q&A's This article is correct at 04/06/2019
Disclaimer:

The information in this article is provided as part of Legal-Island's Employment Law Hub. We regret we are not able to respond to requests for specific legal or HR queries and recommend that professional advice is obtained before relying on information supplied anywhere within this article.

Arthur Cox
Arthur Cox

The main content of this article was provided by Arthur Cox. Contact telephone number is 028 9023 0007 or email belfast@arthurcox.com

View all articles by Arthur Cox