The ICO’s Employment Records Guidance

The Information Commissioner’s Office (“ICO”) has published its final guidance on ‘Employment practices and data protection: keeping employment records’. The guidance is aimed at employers and intends to help them understand their obligations under the UK GDPR and the Data Protection Act 2018 when handling employment records. It also sets out good practice in this regard.

The guidance highlights that data protection law does not prohibit employers from collecting, holding, or using employee records but it strikes a balance between an employer’s need to keep employment records and every worker’s right to a private life.

It is designed to be used alongside other published ICO guidance on data protection and employment, with specific references to detailed ICO guidance on ‘information about workers’ health’, ‘monitoring workers’, and other related topics.

Key themes from the ICO Employment Records Guidance

The key themes from the guidance are collecting, keeping and using employment records. With difficult questions such as, how much personal data can be held, whether a worker’s consent can be relied on, whether it can be shared under the TUPE regulations or with new employers, being answered.

The guidance utilises practical tools such as checklists and examples to assist employers in evaluating and improving their data protection practices.

There are five checklists covering:

• Collecting and keeping employment records
• Outsourced employment functions
• Equality monitoring
• Pension and insurance schemes
• Mergers and acquisitions.

The final guidance is available here. We recommend that schools review the guidance and begin to reflect upon their current practices.