data protection issues and business transfers

The Data Protection Act 1998 (“DPA”) imposes a number of obligations on data controllers to ensure that data is processed correctly. Its principles sit somewhat uncomfortably with the provisions in the Transfer of Undertakings (Protection of Employment) Regulations 2006 (“TUPE”) and, more specifically, regulation 11 which requires the transferor of a business to provide the transferee with information about individual transferring employees no later than 14 days before the transfer. The information must include employees’ identity, age, details of remuneration and disciplinary record. Under the terms of TUPE a failure to provide this information will expose the seller to claims by the buyer.

In an attempt to clarify the position, the Office of the Information Commissioner (“ICO”) has published guidance for complying with the requirements of both the DPA and TUPE.

The ICO’s guidance states that disclosures of employee information made under TUPE will fall under permitted exceptions contained in the DPA. However, information provided must be accurate, up to date and secure in order to be covered by the permitted exceptions. The guidance also provides that transferors will not need to obtain the consent of employees when transferring their information to transferees, provided that it is necessary for the purposes of the TUPE transfer. Where TUPE does not apply (e.g. a share sale), the guidance advises that sellers release only anonymous information about employees, preferably with their consent. As an alternative to seeking every individual’s consent to the disclosure of information, appropriate undertakings as to the use and confidentiality of such data should be given by the buyer to the seller.

The guidelines are available in full on the ICO’s website, www.ico.gov.uk. As transferors will be obliged to provide detailed information under TUPE 14 days prior to any transaction, it may well be preferable to provide the information in full from the outset, with the transferee providing appropriate undertakings as to how the information will be used.