The United Kingdom’s Information Commissioner's Office (“ICO”) has released new guidance on the disclosure of employee data during a takeover or transfer of a

business or where there is a “service provision change” (e.g., an outsourcing, re-sourcing or insourcing).

Under regulation 11 of the Transfer of Undertakings (Protection of Employment) Regulations 2006 (“TUPE”) sellers, organisations outsourcing for the first time or outgoing service providers are required to provide certain employee information, known as “employee liability

information”, at least two weeks before the transfer is completed.

Employee liability information comprises: name and age; employment start date; statutory particulars of employment[1]; information of any disciplinary action taken, or grievance or employment claim brought, in the past two years; and details of any employment claims there are reasonable grounds to believe the employee may bring.

When TUPE came into force two years ago, the ICO confirmed that section 35 of the Data Protection Act 1998 (“DPA”), which allows the disclosure of personal data where the disclosure is required by law, permitted transferors to provide employee liability information without breaching the

DPA. The new guidance confirms that the information can be provided to comply with TUPE but advises companies when disclosing employee liability information under regulation 11 of TUPE nonetheless to take care to comply with data protection principles. For example, companies providing information should ensure that the information is accurate, up-to-date and secure, and companies receiving the information should only use the information for the purposes of TUPE, such as assessing possible liabilities to those employees or planning how they are going to be adopted

into the business.

(See article for more information).