In a TUPE situation is the transferor required to obtain its employees' consent before passing on information about them to the transferee?
No, although the transferor must consider the implications of the Data Protection Act 1998 when disclosing information in the context of a TUPE transfer.
The Information Commissioner's Employment practices data protection code sets out a number of good practice recommendations to enable employers to comply with the requirements of the Act. These provide, amongst other things, that wherever practicable transferors should ensure that information handed over to another organisation in connection with a prospective acquisition, merger or business reorganisation is anonymised, and that workers are advised that their employment records are to be disclosed to another organisation before an acquisition or merger takes place. Furthermore, if the acquisition or merger goes ahead the employer should ensure that workers are aware of the extent to which their records are to be transferred to the new employer.
The Supplementary guidance that accompanies the Code provides that, where an employer is under a legal obligation to disclose workers' records to a third party, it is relieved of the obligation to inform workers of that disclosure where to do so would breach commercial confidentiality, for example by leaking the fact of the transfer or the identity of the transferee.
Under the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246), a transferor is under a legal obligation to disclose certain information about the transferring employees to the transferee prior to completion of the transfer. It will, therefore, be covered by the legal obligation exemption in respect of the disclosure of this information. To the extent that the transferor provides information over and above this, it should still be able to rely on one of the other conditions in sch.2 to the Data Protection Act 1998 in order to ensure that it processes data fairly and lawfully. The most relevant one in the context of a TUPE transfer is likely to be the "legitimate interests" condition, ie where the processing is necessary for the purposes of legitimate interests pursued by the data controller (in this case the transferor) or by the third party to whom the data is disclosed (the transferee). It is, however, advisable for the transferor to obtain formal assurances from the prospective transferee with regard to use and safekeeping of the information and its return if the transfer does not proceed.