GDPR implications of providing employee information in a TUPE situation
In a TUPE transfer, the transferor (former employer) must provide the transferee (new employer) with employee liability information in relation to the transferring employees as set out under Regulation 11 of the Transfer of Undertakings (Protection of Employment) Regulations 2006 (“TUPE”) This includes:
the identity and age of the employee;
the written employment particulars required to be given to the employee under article 33 of the Employment Rights (Northern Ireland) Order 1996;
information on any disciplinary procedure taken in relation to the employee or grievance procedure taken by the employee within the previous two years;
information on any court or tribunal case, claim or action brought by the employee against the transferor within the previous two years, or any court or tribunal case, claim or action arising out of the employee's employment that the transferor has reasonable grounds to believe the employee may bring against the new employer; and
information about any collective agreement that will have effect after the transfer in relation to the employee.
It is not possible for the transferor to contract out of this obligation. The tribunal can award the new employer compensation starting at a minimum of £500 per employee for whom the information was not provided.
The above information constitutes “personal data” under the GDPR. Therefore, a lawful basis for processing must be satisfied under Article 6 of the GDPR. As the information is being provided in accordance with the transferor’s statutory obligation under TUPE, the transferor can rely on Article 6(1)(c) (legal obligation) of the GDPR to process the data.
In any event, the transferring employees should have received the transferor’s privacy notice which should explain all instances when their personal data may be processed in the course of their employment with the transferor.
However, if the transferor is providing personal information above and beyond the employee liability information set out under Regulation 11 of TUPE, it will need to ensure it satisfies one of the other lawful bases for processing under Article 6(1) of the GDPR (and potentially also under Article 9 if the personal data is sensitive in nature). It will also need to consider the data protection principles such as data minimisation and such information may need to be redacted or anonymised.
Continue reading
We help hundreds of people like you understand how the latest changes in employment law impact your business.
Please log in to view the full article.
What you'll get:
- Help understand the ramifications of each important case from NI, GB and Europe
- Ensure your organisation's policies and procedures are fully compliant with NI law
- 24/7 access to all the content in the Legal Island Vault for research case law and HR issues
- Receive free preliminary advice on workplace issues from the employment team
Already a subscriber? Log in now or start a free trial
