New ICO guidance on employment practices and data protection

The Information Commissioner's Office (ICO) has released its long-awaited updated guidance on Employment Practices and Data Protection, a comprehensive resource that is particularly useful for schools and academies. 

This guidance is timely, given the complexities schools face with managing data protection concerning employee records and the sharing of employee information.

Key highlights

The updated guidance covers in detail most of the main aspects of employment records management and the links between data protection laws, including the lawful basis for processing personal data, the extent of, and how long information about employees should be retained.

It provides guidance on the circumstances in which workers’ personal information can be shared with other people or organisations, including what employers need to consider when providing references.

The guidance also covers equal opportunity monitoring, recommending that data collected from job applicants should be stored separately to facilitate its use as statistical information only, ensuring that the data collection is not excessive.

TUPE requirements

Another significant aspect covered is the Transfer of Undertakings (Protection of Employment) Regulations (TUPE), which is highly relevant for schools undergoing outsourcing or academy transfers. 

The guidance helps to clarify the circumstances in which an employer may, during their due diligence process, share additional information beyond what is required by the TUPE Regulations, for example during the preliminary stages of a proposed transfer.

Subject Access Requests 

One area that we support many schools and academies with relates to the right of employees to access to employment records and personal data. It's increasingly common for employees to issue a subject access request (SAR) during grievance, disciplinary, or dismissal processes.

The guidance clarifies that employees do retain the right to access their personal data during these times and emphasises the need for managers to be prepared for such requests.

Understanding and navigating complexity

While the ICO's guidance serves as a robust resource, navigating the intricacies of employment data protection can still be daunting for many schools and academies. The guidance, although comprehensive, often requires further unpacking and practical application within the specific contexts of educational institutions.

There are complexities regarding employee SARs, and decisions regarding the withholding or redaction of some information, with application of data protection ‘exemptions’ to the right of access proving particularly challenging. In addition, the sharing of employee information for disciplinary and safeguarding purposes can often require dedicated advice, tailored to the specific circumstances.

Our employment and data protection specialist teams work together closely to offer specialised legal advice to help navigate these complex areas. This expertise in data protection and employment law ensures that schools and academies can confidently manage their compliance obligations and safeguard against potential legal pitfalls.

For more detailed support and resources, schools and academies can refer to our dedicated pages:

Data protection guidance for schools and trusts

HR services for schools and academies