GDPR implications of providing employee information in a TUPE situation
Posted in : First Tuesday Q&A NI on 4 June 2019 Issues covered:In a TUPE transfer, the transferor (former employer) must provide the transferee (new employer) with employee liability information in relation to the transferring employees as set out under Regulation 11 of the Transfer of Undertakings (Protection of Employment) Regulations 2006 (“TUPE”) This includes:
-
the identity and age of the employee;
-
the written employment particulars required to be given to the employee under article 33 of the Employment Rights (Northern Ireland) Order 1996;
-
information on any disciplinary procedure taken in relation to the employee or grievance procedure taken by the employee within the previous two years;
-
information on any court or tribunal case, claim or action brought by the employee against the transferor within the previous two years, or any court or tribunal case, claim or action arising out of the employee's employment that the transferor has reasonable grounds to believe the employee may bring against the new employer; and
-
information about any collective agreement that will have effect after the transfer in relation to the employee.
It is not possible for the transferor to contract out of this obligation. The tribunal can award the new employer compensation starting at a minimum of £500 per employee for whom the information was not provided.
The above information constitutes “personal data” under the GDPR. Therefore, a lawful basis for processing must be satisfied under Article 6 of the GDPR. As the information is being provided in accordance with the transferor’s statutory obligation under TUPE, the transferor can rely on Article 6(1)(c) (legal obligation) of the GDPR to process the data.
In any event, the transferring employees should have received the transferor’s privacy notice which should explain all instances when their personal data may be processed in the course of their employment with the transferor.
However, if the transferor is providing personal information above and beyond the employee liability information set out under Regulation 11 of TUPE, it will need to ensure it satisfies one of the other lawful bases for processing under Article 6(1) of the GDPR (and potentially also under Article 9 if the personal data is sensitive in nature). It will also need to consider the data protection principles such as data minimisation and such information may need to be redacted or anonymised.
More from the First Tuesday Q&A
-
Are Employees Automatically Entitled to Bank and Public Holidays?
Posted in: First Tuesday Q&A NI on 06 September 2023
-
What are the Potentially Fair Reasons for Dismissing an Employee?
Posted in: First Tuesday Q&A NI on 06 September 2023
-
How Can Employers Ensure Their Workplace is GDPR Compliant?
Posted in: First Tuesday Q&A NI on 06 September 2023
-
What is the Legal Position on Maximum Office Temperatures?
Posted in: First Tuesday Q&A NI on 07 August 2023
-
What Remedies are Available to a Claimant Pursuing a Tribunal Claim of Unfair Dismissal?
Posted in: First Tuesday Q&A NI on 07 August 2023
Disclaimer:
The information in this article is provided as part of Legal-Island's Employment Law Hub. We regret we are not able to respond to requests for specific legal or HR queries and recommend that professional advice is obtained before relying on information supplied anywhere within this article.