The Information Commissioner's Office issued, on 21 May 2008, its good practice note explaining the steps employers need to take to satisfy the Data Protection Act 1998 (the Act), when providing information about transferring employees under the Transfer of Undertakings (Protection of Employment) Regulations 2006 (TUPE).

TUPE now requires that "employee liability information" be provided by the present employer to the new employer at least two weeks before the transfer is completed. The information provided must include: 

  • identity and age of the employee; 
  • those particulars of employment that an employer is obliged to give to an employee under section 1 of the Employment Rights Act 1996; 
  • information relating to any disciplinary or grievance within the previous two years; 
  • information of any court or tribunal case brought within the previous two years or that the employer has reasonable grounds to believe that an employee may bring; and 
  • information of any collective agreement that will have effect in relation to the employee after the transfer.

In reality, especially in a contracting-out situation, details of the transferring employees are generally provided earlier as part of the due diligence process and in the majority of cases this information is provided pursuant to contractual obligations. Employers must take great care to anonymise information provided in these circumstances and to obtain employees' consent to release of information where it amounts to personal data, as well as obtaining the agreement of contractors to using the data for the purposes of TUPE only.

In respect of the "employee liability information", employees' consent is not necessary to the disclosure of identifying information as the disclosure is a requirement of law. Nevertheless, both parties must still comply with data protection principles when handling personal data.

The practice note provides that once the transfer has taken place, it is likely that the new employer will need a large proportion of the employee's personnel file. In these circumstances, the former employer does not need the employee’s consent to the transfer of their personal information if that information is necessary for the purpose of the transfer and business needs of both parties. There is a mixed picture in existence with regard to whether personnel files are being transferred to the new employer and, given the pressures of a TUPE transfer, spring-cleaning of personnel files is not a top priority. However, this practice note sets out an employer's Data Protection Act obligations clearly in the circumstances of TUPE.