Outsourcing Contract

[sarahstacey]

Hi,

 

Just checking my logic here.

 

Our school is outsourcing our cleaning to cleaning company.

 

Our present cleaners will now be employed by them.

 

We have asked permission of the cleaners to share their details with the new company so they can set up there pay etc.

 

Do we need to do anything from a GDPR perspective? The staff will no longer work for us.

 

Thank you for any advice

[Ditto]

Hi,

 

Just checking my logic here.

 

Our school is outsourcing our cleaning to cleaning company.

 

Our present cleaners will now be employed by them.

 

We have asked permission of the cleaners to share their details with the new company so they can set up there pay etc.

 

Do we need to do anything from a GDPR perspective? The staff will no longer work for us.

 

Thank you for any advice

Assuming they have all given consent, beyond having that documented you are most likely to be compliant. You may need to ensure the new employer has taken steps to ensure the data is properly protected. I guess you need to also think about data retention - once they have moved over, do you have any need to retain the data? There may be an argument for a short period of time, but not endlessly.

 

On the topic of consent, it is of course just one of the lawful basis - see https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ for others. In this case, I wonder if you really needed consent and whether you had a legitimate interest, but having gone down the consent route, I think it's on longer relevant. I would be interested to hear an opinion from @GrumbleDook though.

[Koldov]

Is their employment being transferred under TUPE legislation which means you would need to provide these 'details'?

 

When TUPE applies (specifically the section 'service provision changes'):

 

https://www.gov.uk/transfers-takeovers

 

In the section 'Information about employees during transfers' it states:

 

"An employer must provide the new employer with information about employees"

 

and lists the details you would normally include, so I'm not sure you even need to ask permission...

 

I can only imagine that sharing these details is not in contravention of any GPDR legislation, but await a more informed opinion (or some facts).

 

If this is not under a TUPE agreement, then it might be a different discussion.

[sarahstacey]

Thank you for your help.

 

Yes, this is under TUPE, so we are covered by that.

[sarahstacey]

Assuming they have all given consent, beyond having that documented you are most likely to be compliant. You may need to ensure the new employer has taken steps to ensure the data is properly protected. I guess you need to also think about data retention - once they have moved over, do you have any need to retain the data? There may be an argument for a short period of time, but not endlessly.

 

On the topic of consent, it is of course just one of the lawful basis - see https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ for others. In this case, I wonder if you really needed consent and whether you had a legitimate interest, but having gone down the consent route, I think it's on longer relevant. I would be interested to hear an opinion from @GrumbleDook though.

 

Thank you for your reply, yes, I was thinking whether we need to 'ensure the new employer has taken steps to ensure the data is properly protected'

[GrumbleDook]

Thank you for your reply, yes, I was thinking whether we need to 'ensure the new employer has taken steps to ensure the data is properly protected'

 

You do, but there is a clear purpose and lawful basis, and should you be concerned about the protection of the data you need to raise it with the person managing the TUPE process (after a check with your DPO, of course). You may be told it is an accepted risk. Get that in writing.