21 January 2008

Although employers can rely on implied or express confidentiality provisions to protect their company’s secrets, they must bear in mind the Public Interest Disclosure Act, which affords protection to whistle-blowers in certain circumstances (PIDA). Employees also have rights under the Data Protection Act (DPA), which has many practical implications on day to day management activities. 
    
Historically, it has been established by the courts that an employee who breaches an implied or express duty of confidentiality can defend their actions if the disclosure is made in the public interest. In 1998 this principle found its way to the statute books in the form of PIDA under which workers, who disclose certain information, can now seek protection from dismissal or any other detriment. However, PIDA is very prescriptive and will only apply in limited circumstances.

To be covered under PIDA the worker must have a reasonable belief that the information disclosed reveals evidence of a past, current or future activity which amounts to any of the following: 

• A criminal offence
• A breach of a legal obligation
• A miscarriage of justice
• Danger to the health and safety of any individual 
• Damage to the environment
• A deliberate concealment of information about any of the above

In addition, the disclosure must be made to the employer, a legal adviser or a Minister of the Crown (although there are some exceptions) and normally the worker must be acting in good faith. It is important to remember that employees do not need to have a minimum period of service in order to bring a claim and, in the event of successful claim, compensation is uncapped. However, the Court of Appeal has confirmed that the protection afforded under PIDA only applies to the disclosure of the information and not to the workers actions or behaviour in connection with that disclosure. In Bolton School v Evans (2006) it was held that an employee had not been subjected to an unlawful detriment when he was disciplined for hacking into the computer system, after having raised his concerns that the security was inadequate, even though this was done to demonstrate those concerns.

Another important piece of legislation regulating the disclosure of information is the DPA. The DPA, although complex in nature, has the practical purpose of providing that information which falls into the definition of personal data is processed fairly and lawfully and, in particular, should not be disclosed unless certain conditions are met. Furthermore it enables an individual to access certain information which is held about them.

In most cases, employers will require the employee’s consent to disclose information about them to a third party. There is a distinction between “consent” and “explicit consent”, which is required when the information is classed as sensitive personal data, such as information concerning the person’s racial or ethnic origin or their physical or mental health.

A practical way of obtaining consent may be the inclusion of an appropriately worded data protection clause in the contract of employment. However, it is important that the consent is “freely given”. Therefore an individual should not be forced to give his/her agreement to this clause in order to take up an offer of employment.  In addition, the clause should make it clear that the employee is giving his consent unless, and until, that consent is withdrawn. 

Under the DPA it may be possible to disclose information about an individual, which amounts to personal data but not sensitive personal data, without their consent. Consent will not be required if at least one other condition of fair and lawful processing is met. In an employment context, the other conditions that employers are most likely to seek to rely on include:

• Where the processing is necessary for the performance of any contract to which the data subject is party.
• Where the processing is necessary for compliance with any other legal obligation to which the data controller is subject or necessary for the purposes of the legitimate interests of the data controller

If the information does amount to sensitive personal data, the employer must also satisfy an additional condition. For example, this can include that the processing is necessary to exercise or perform any right or obligation conferred or imposed by law in connection with employment.

Although employees are entitled under the DPA to request to see a copy of information held about them, there are some exemptions to what must be disclosed. Employers are entitled to keep secret information relating to: 

• Management forecasting or planning
• Negotiations with an employee, if disclosure would prejudice those negotiations
• Confidential references given by you in respect of:
  • education, training or employment
  • appointment to any office
  • provision of any service by the data subject

Note, only the employer providing the reference (not the recipient) can claim the benefit of the exemption.  This means that an employee could, in theory, see the reference from his ex-employer in the hands of his prospective employer.

Employers will however need to take care, before giving an employee access to information that identifies third parties, such as in the case of confidential references and statements in connection with disciplinary or grievance procedures where the witness wishes to remain anonymous.  Employers must decide whether, on balance, the employee's right to know what information is held about him/her outweighs the right to privacy of the third party. The overriding rule is that you should supply as much information as possible without disclosing the identity of the third party. For example it may be possible to conceal the identity by the omission of names or other identifying particulars. 

In the case of confidential statements, employers will need to find a balance between protecting the identity of witnesses who wish to remain anonymous and giving the employee a fair hearing. In the event of legal proceedings a tribunal may however order disclosure, therefore, anonymity should never be guaranteed. The tribunal will consider if disclosure is necessary for the fair disposal of proceedings and will take into account the importance of safeguarding the anonymity of the witness who will have to return to the workplace. A genuine fear of reprisal may be a good enough reason to keep a secret.

As this and last week’s article show, both employers and employees have certain obligations to keep matters between them confidential. Revealing information which was intended to be kept secret may give rise to a breach of trust and confidence and have other legal consequences.