Recent changes to the Transfer of Undertakings (Protection of Employment) Regulations 2006, for transfers which take place on or after 1st May 2014, require employers to provide employee personal data and related information to the new employer at least 28 days before the transfer is completed.
Whilst the disclosure of employee information is required by law this does not override the application of the Data Protection Act 1998 (DPA).
To help employers understand how to comply with the DPA when transferring employees personal data the UK Information Commissioners Office (ICO) has published guidance entitled "Disclosure of Employee Information under TUPE".
Whilst TUPE requires certain information (known as "employer liability information") to be disclosed before the transfer takes place, the employer must take steps to ensure that the receiving party does not use the employer liability information for purposes other than the acquisition of the business and transfer of employees and must have in place adequate procedures to ensure that the personal data is kept secure.
Employers must make sure that their employees are aware that personal data will be transferred in the course of a disposal and this is something that could well be part of the employee handbook.
Wherever possible the employer should not transfer more employee personal data than the law requires and to the extent that additional information is disclosed then steps must be taken to anonymise it wherever possible.
If the employee personal data is being shared with a buyer that is an entity outside of the EU then care needs to be taken to ensure that further protections are in place in respect of such a transfer.
One mechanism might be to put in place a data sharing agreement to enable the employer to remain in full compliance with the Data Protection Act 1998.