The Information Commissioner’s Office (ICO) has issued guidance on the processing and retention of employment records – from common examples of employment records and the likely lawful bases for processing, to how long an employer can lawfully keep such records and how to deal with data access requests from employees. Employment records will often constitute personal data (where they uniquely identify an individual), and therefore UK data protection laws will apply to the processing of such documents. The guidance should help employers to comply with various obligations imposed on them under such laws.
Types of employment records
Examples of relevant employment records given by the ICO are:
- Personnel files;
- Sickness and injury records;
- Disciplinary and grievance records;
- Training records;
- Appraisal or performance review records;
- Payroll information;
- Pension information;
- Interview notes;
- Emails;
- References;
- Equality and diversity information (e.g., information about ethnicity, religion, disability and sexual orientation).
Lawful processing
An employer must only process personal data where:
- It is fair to do so;
- They have a lawful basis for doing so (such as pursuant to the employment contract) which is documented; and
- They are transparent with their processing and inform the employee how they are using their personal data (i.e. through an Employee Privacy Notice).
Special category data
There are specific rules for special category personal data, such as equality and diversity information, where an additional special category condition (under Article 9 of the GDPR) must be identified in order for the employer to legally process the information (see section below). Similar additional rules apply for criminal offence data too.
Where possible, personal data collected for equality and monitoring purposes should be anonymised and it must not be used for any other purpose.
Consent and other lawful bases for processing
The ICO’s guidance reiterates that consent by an employee is not likely to be a valid lawful basis to allow the employer to process their data. Consent must be freely given which is unlikely to be possible in an employer/employee relationship given the imbalance of power. The ICO therefore advises against using consent, unless confident of being able to demonstrate it has been freely given – i.e. where the worker has been given a genuine choice over how their information is used. Consent can also be withdrawn by the employee at any time. Therefore an alternative lawful basis is always preferable, such as:
- in order to perform the employment contract;
- to comply with a legal obligation (HMRC tax duties);
- for the employer’s legitimate interests or those of a third party (where a balancing assessment of the legitimate interest and the employee’s rights had been carried out);
- more unusually for the employee’s vital interests or those of a third party, such as if there is a medical emergency.
For special category data (sc) and criminal offence data (co), relevant special conditions may include
- where an employment, social security or social protection law applies (sc and co);
- in relation to a legal claim (sc and co);
- for a matter of substantial public interest, such as for equality of opportunity/treatment, to prevent fraud or for occupational pensions (sc/co);
- preventing/detecting unlawful acts (co).
For special category and criminal offence data, an “appropriate policy document” should be used to document the basis. The ICO has produced a template to assist.
Sharing personal data
Care must always be taken when sharing personal data with third parties. The ICO’s guidance specifically sheds light on sharing personal data in relation to pension and insurance schemes and for mergers and acquisitions.
Pension and insurance schemes:
- Employees should be kept informed of the personal data that is being shared with the provider – consider doing so in the Privacy Policy.
- Only relevant information should be shared – no more than is necessary for the scheme.
- If special category personal data is being shared, a special category condition must apply and be documented (e.g. for sickness or other health information).
- Access to the information should be restricted on a need-to-know basis and staff must be aware of their responsibilities.
Mergers and acquisitions:
- It is common practice that employee information will be shared as part of the due diligence process.
- Only relevant information should be shared – no more than is necessary to meet TUPE requirements and ensure the smooth transfer of management of staff.
- Employees should be notified (for example in the Privacy Policy) that their personal data may be shared with third parties in relation to a possible sale, merger or reorganisation of the business, and which of their employment records may be shared.
- Affected staff members must also be informed when the company responsible for their personal data (the controller) changes.
- Relevant personnel involved in making the transfer must be aware of their compliance obligations, including to ensure transfers are made securely and the information kept up to date.
Data minimisation and accuracy
Employers must only collect and keep the minimum amount of personal information required. Anything more is likely to be unlawful. An employer should therefore always be clear about their reason for processing and keeping the relevant information. Periodic checks of the information held is recommended.
Employees must also be asked to regularly check the personal data held about them to make sure it is accurate and up to date. Changes must be made as required.
Retention periods
Employers must only keep personal data for as long as is reasonably necessary. No set time limits are imposed by data protection laws. This will depend on the context and relevant purpose. The ICO is clear that a “one size fits all” approach will not work. Other legal or regulatory requirements should be considered simultaneously, such as health and safety rules concerning certain records, and tax laws.
The ICO recommends a retention policy is created to deal with the types of records held, what they are used for and how long they are kept.
Once no longer necessary, records should be anonymised or deleted. Where disposing of the records, this must be carried out securely and effectively.
An employee also has a right to ask that their personal data be erased but, in an employment context, usually only where the information is no longer necessary for the purpose for which it was collected or where it was collected on the basis of consent.
While held, employment records must also be kept securely and must only be accessible to those who are authorised.
Privacy Policy
The guidance states that you must tell your employees the following:
- your purposes for collecting and using their personal information;
- your lawful basis;
- your condition for processing (if it includes special category or criminal offence information);
- your retention periods for the information;
- who, if anyone, you plan to share their information with;
- their rights over their information; and
- details of where you got their personal information, how you are going to use it and who you will disclose it to.
We recommend including this information in an Employee Privacy Policy which is given to the employee at the start of their employment and/or as part of the staff handbook. Existing employees should also be given a copy of this document if they have do not already have one.
Data Subject Access Requests (SARs)
Employees have the legal right to make a SAR and obtain copies of the personal information their employer holds about them. A response should be sent without delay and within one month of receiving the SAR, though this timeframe can be extended by a further 2 months where the SAR is complex or the employee has sent multiple requests. The employer can also ask the employee to clarify their request where unclear and in this case the time limit for responding is paused.
Where the employee’s personal data includes personal data about a third party this can be redacted.
Other laws
The ICO advises that this guidance should be considered alongside other relevant legal obligations, such a health and safety regulations, employment law rules and other industry standards.
For advice on and assistance with the matters dealt with above, please get in touch.
Madeleine Rhodes mrhodes@redfernlegal.com
