Last month the ICO published new online guidance on keeping employment records, another useful addition to their detailed advice on Employment practices and data protection.
It aims to support organisations with practical advice on how to balance the need to keep staff records with an individual’s privacy rights
All staff are in scope, including contractors, gig or platform workers, or volunteers, as well as employees.
The new guidance interlinks with several other sections of the ICO’s online guidance, which covers both data protection generally (on issues such as consent as a lawful basis) as well as a number of employment-specific topics, such as their detailed guidance on using information about workers’ health and monitoring workers.
Information sharing during mergers, acquisitions, and TUPE transfers
The new guidance addresses topics which often arise in practice, and which were not covered in the regulator’s previous published guidance, the Employment Practices Code.
Helpfully, it discusses how to handle staff records during mergers, acquisitions, business reorganisation or insolvency.
In a TUPE situation, for instance, where an organisation might be asked to share personal information about workers that falls outside the scope of legally required ‘employee liability information’, the guidance reminds organisations how they must identify and document another lawful basis, with ‘legitimate interests’ being the most suitable.
Further, if the additional information includes any ‘special category’ personal data, an additional ‘condition’ for processing is needed. It recommends completing a Data Protection Impact Assessment (DPIA) before any disclosure is made, particularly where that includes any special category data, and recommends that consideration is given to pseudonymisation in such situations.
Safeguards are a requirement for sharing in these circumstances to ensure that any unsuccessful bidders can only use personal data received in connection with the proposed business transfer and do not retain it once used for that specific purpose.
Sharing personal data
There is a comprehensive section on when organisations can share workers’ personal information with other people or other organisations.
Already such situations are in scope of the Statutory Code of Practice on Data Sharing from 2021. But it appears there are topics where the regulator is keen to minimise common misunderstandings about what is and what is not allowed.
Again there is a section to remind organisations that in a health emergency situation, personal data can be shared externally – a topic addressed recently in ICO guidance on information sharing in mental health emergencies at work, published in 2024.
Also the new guidance covers issues which in practice can often prompt complaints from staff claiming it is a personal data breach, such as sharing of employment information outside of the organisation where it relates to suspected criminal activity, such as fraud.
Sharing ‘special category’ information with pension providers, and situations where organisation’s advertisements and self-promotion on social media incorporates images and information about staff, are also covered.
Resources
As always, the guidance concludes with some practical checklists for organisations to help applying the guidance in the various situations discussed, which also include organisations maintaining records for equality monitoring purposes, or using outsourced ‘third parties’ for employment functions (such as external payroll or an external HR consultant).
If you have any questions on any of the issues raised in the above article, please contact Sean Morris