Guidance to help employers comply with the DPA when providing employee liability information to transferees under regulation 11 of TUPE 2006.

Can the seller disclose the employee liability information under the DPA?
Disclosure is permitted by section 35 of the DPA. However, both parties should take care to comply with data protection principles when handling this personal information. For example, they should ensure that the information is accurate, up to date and secure. Also, the buyer must only use the information for the purposes of TUPE, for example, to assess its possible liabilities to the transferring employees.

Can the seller disclose information when regulation 11 TUPE obligations do not apply?
Employers may receive requests for information about their workforce where TUPE does not apply, for example, due diligence requests in share purchases or where TUPE applies and the buyer requests information in addition to the employee liability information. In these circumstances, wherever possible, employers should only release information that is anonymous. The seller should also obtain employees' consent to disclosure of this personal information or put in place appropriate safeguards to ensure that the information is only used in connection with the proposed transaction and will not be kept afterwards.

Can employment records be given to the buyer?
The buyer will need employment records to manage its new workforce. The seller will not need to obtain the employees' consent to the transfer of their personal information to the buyer, provided that it is necessary for the purposes of the TUPE transfer and the business needs of both parties. The buyer should delete or destroy securely any unnecessary information.

Can the seller keep personal information after the transfer?
The seller will normally have to keep some personal information about former employees after the transfer, for example to deal with any liabilities in relation to former employees. This is permissible under the DPA, provided that there is a justifiable need and the information is deleted or securely destroyed when it is no longer needed.

Recommended good practice
Think about data protection early in the TUPE process. 
* Agree what information you should transfer, and how, well before a transfer takes place.
* Make sure those responsible for negotiating the transfer of staff are aware of their responsibilities to comply with data protection principles, for example, to keep personal information up to date and secure. 
* Make sure you transfer enough information to meet your TUPE obligations and to allow the new employer to run the business and manage the staff. However, both parties should make sure that excessive and irrelevant information is not transferred. 
* Make sure any information handed over is used only for the purposes of TUPE until the transfer of staff is completed. 
* Tell employees that their information will be passed to the new employer. This may not always be possible if, for example, "insider trading" restrictions apply. 
* Consider whether personal information could be anonymised before providing any information which is not required by TUPE. 
* Make sure, once the transfer of staff has been completed, that employment records are accurate, relevant and up to date and any unnecessary information is destroyed securely.

Comment
The good practice note provides confirmation that sellers will not breach the DPA by providing the employee liability information to buyers and complying with disclosure obligation imposed upon them under regulation 11 of TUPE 2006.

There are, however, a number of practical issues to be considered and issues on which sellers should seek specific advice; one of which being should employees' consent be obtained in relation to the disclosure of information that does not fall within regulation 11 of TUPE?

In light of this and other uncertainty, it is advisable for employers to ensure that employees' contracts of employment inform them of the possibility of the transfer of their records to a potential buyer. However, the acknowledged difficulty with this approach is that there is a potential argument that consent given by an employee in this way is not freely given because the employee is not properly informed about the data that is being processed.
Wrong. If Gran authorises you by phone or letter to discuss her bill and the company accepts that, there is no problem.

If your business requires further advice and assistance on Data Protection issues please contact Richard Fox on 01603 281127. Richard is a general commercial solicitor, practising data protection and e-commerce law.