The ICO calls for views on data protection and employment practices

The ICO recognises that much has changed since it published the employment practices code, the supplementary guidance and the quick guide (together the "Current Guidance"). The ICO wants "to make sure that [its] new guidance addresses the changes in data protection law, reflects the changes in the way employers use technology and interact with staff and meets the needs of the people who use [its] guidance products."

Interested parties should carefully reflect on various factors that have had an impact on employment practices in recent years. To assist with this, we have highlighted below some of the key developments.

Data protection legislation

Since the publication of the Current Guidance in 2011 the data protection landscape has changed significantly.  Substantial developments include the introduction of the GDPR in 2018 as well as the new Data Protection Act 2018, followed by Brexit and incorporating the GDPR into domestic law (typically known as the “UK GDPR”). 

This has led to a complete overhaul of the UK's data protection regime and employers' obligations and responsibilities in relation to the collection and use of personal data have significantly increased. Employers must ensure compliance with the UK GDPR when storing or processing the personal data of their employees, workers, former employees or workers, consultants and candidates and any failure to comply could result in penalties of up to 4% of turnover or €20 million.

Other developments

The ICO encourages respondents to outline other developments (aside from data protection law changes) that have had an impact on employment practices in recent years.

For example, employers were faced with unprecedented challenges to suddenly facilitate remote working when the Covid-19 pandemic struck, and many are now looking at new hybrid working models going forward. 

In order to deal with the increased risk of data protection breaches, employers have had to adopt new security standards and impose policies that comply with data protection legislation. In addition, employers have had to find ways of keeping track of their employees, without violating the employees' rights to privacy. It is important that the ICO's New Resource takes account of these developing practices.

Next steps

The Current Guidance is split into the following topic areas:

(i) recruitment, selection and verification;

(ii) employment records;

(iii) monitoring at work; and

(iv) information about workers' health.

It is envisaged that the New Resource will adopt a similar approach and the ICO encourages respondents to consider recent developments and the implications they have had on each of these specific topics. All interested parties (i.e. employers, professional associations, recruitment agencies, employment dispute resolution bodies, workers, volunteers and employees) are encouraged to respond.

The deadline for responding to the consultation is midnight on 21 October 2021 and responses can be submitted here.

If you would like to discuss your response to the consultation or have any questions on the topic covered in this alert please contact Paul Reeves, Katie Hewson, Leanne Raven or your usual Stephenson Harwood contact.