7

I am a former manager at company Z. A couple of years ago I accepted a management position at company A. Both A and Z companies are part of a larger contract, with Company A being prime. I was approached by another manager from company Z regarding one of my former employees in company Z. They wanted to know what information I might have regarding this employee and their behavior and actions and any discipline, writeups, emails or performance discussions that were held while I was manager. I still have all of the details about this individual but I do not feel comfortable sharing when I am no longer their manager. Am I obligated to share these details? By the way - the current manager of this employee has not asked for the info.

13
  • 25
    Why is this information regarding this employee in your personal possession? Commented Aug 13, 2021 at 21:50
  • 10
    @Solar Mike I would expect such information regarding an employee to stay on work computers/work network. Not to get transferred/copied to a personal computer/storage of the OP. Commented Aug 13, 2021 at 22:03
  • 14
    This is an issue when you discuss this topic on an international question and answer site. From a GDPR and information security standpoint it's an absolute no-go to own information about former employees on a private PC Commented Aug 14, 2021 at 1:25
  • 3
    I didn't understand what you mean by, "Both A and Z companies are part of a larger contract, with Company A being prime". Are both companies related (perhaps part of a larger corporate group, or are they separate legal entities? Or do you mean you have a common project on which both company A and Z are working? And are they asking for your professional asseement about a former employee, or actual documents?
    – sfxedit
    Commented Aug 14, 2021 at 8:05
  • 3
    The OP says they "have the information". They do not say its all in written form. I have a huge amount of information about people who worked for me - legal names, status, work bonuses, pay, address and phone numbers, performance praise and issues. None of it's covered by GDPR, because its all personal recollection. If someone approached me as an ex manager for "any information on X's behaviour, actions, writeups, and performance", id assume they wanted my recollections/impressions. Because anything formally written would be on file and seen already. So they want the personal feel.
    – Stilez
    Commented Aug 14, 2021 at 10:55

6 Answers 6

15

You aren't responsible for sharing anything with a company you no longer work for. I suggest that anything negative you say/write about the employee could be seen by the employee as slander/libel.

My suggestion is to say, "I'm not comfortable sharing information about people who no longer work for me."

8
  • 3
    @JoeStrazzere true statements can still be libelous. Truth is a legal defence, but is taken into account with many other factors and does not automatically excuse a person from libel
    – coagmano
    Commented Aug 14, 2021 at 9:58
  • 7
    Truth is an absolute defence in some jurisdictions. The OP may well be in the USA. But they (or others) equally may not.
    – Stilez
    Commented Aug 14, 2021 at 10:47
  • 4
    @JoeStrazzere sorry, no. Truth is not an absolute defence to a libel claim. See for example publicising a spent conviction in the UK hub.unlock.org.uk/knowledgebase/…
    – rhialto
    Commented Aug 14, 2021 at 11:08
  • 1
    @JoeStrazzere In the US, a truthful statement can't be defamatory because it's been held that any truthful statement is protected by the Constitution. That is not the case in all other countries, I believe in Germany for example it can be defamatory to say something about someone that is true but is disclosed purely to harm them. Commented Aug 14, 2021 at 16:35
  • 1
    @rhialto British defamation law was changed quite a lot, both in terminology and in substance, by an Act of Parliament of 2013. The source you link uses the pre-2013 terminology, so I fear it may be talking about the pre-2013 substance. Commented Aug 14, 2021 at 19:09
7

If you're based in the UK/EU, then even possessing this information (as a former manager) would be a criminal offence. You should have returned it or destroyed it on leaving or within a reasonable timespan afterwards. Holding it 'for a couple of years' is a big no-no.

Additionally, passing it on to another company ("processing it") without the explicit permission of the individual or any justifiable reason to do so would also be a specific offence.


Under the GDPR (General Data Protection Regulations), your possession and sharing of this data certainly breaches at least four of the six "points" that allow data to be held on an individual;

  1. Be collected and processed only for specified, explicit and legitimate purposes
    As a former manager, you no longer have a legitimate reason to be holding data on behalf of that company.

  2. Be accurate and kept up to date (any inaccurate data must be deleted or rectified without delay)
    I assume you're making no efforts to keep this data up-to-date

  3. Not be kept for longer than is necessary for the purposes for which it is processed
    As you've left, it's clear that you no longer need it for the purpose for which it was collected.

  4. Be processed securely.
    I assume this data is held on your own personal network and that you're making no effort to secure it properly.

As you're no longer a "Data Controller" (or authorised as a "Processor") for your previous company, you have no legitimate right to be processing data on their behalf. The liability would be on you, not them.


Your response to their query should be to advise them to contact the individual's (and your) former company if they want that sort of information, that you don't hold any information about their performance and that you're not comfortable discussing their private information.

Oh, and delete their records before someone hacks your email and splashes their private details all over the Internet.

3
  • 1
    Be aware the OP says they were asked what information they have - I'd interpret that to mean personal memory, not automatically related to written information. This answer would only apply to written stored data.
    – Stilez
    Commented Aug 14, 2021 at 10:50
  • 3
    @Stilez - "They wanted to know what information I might have regarding this employee and their behavior and actions and any discipline, writeups, emails or performance discussions that were held while I was manager. I still have all of the details about this individual" That seems relatively conclusive that he's talking about written stored info, presumably in an email or document folder. But sure. If it's all in his head then he just has to worry about the ethical ramifications of sharing possibly faulty recollections.
    – Richard
    Commented Aug 14, 2021 at 11:29
  • GDPR contains no such concept as being "registered as a data holder". And what do you have in mind when you suggest OP might be personally liable? In the UK's transposition of GDPR, I suppose it's just about possible that OP could face charges under section 170(1)(c) of the Data Protection Act 2018, but even then, I think OP could (depending on the terms of their employment contract and their previous communications with company Z) mount a decent defence under section 170(3)(b), especially in the light of the recent request from the still-serving manager at company Z. Commented Aug 14, 2021 at 12:16
4

I would not give them any information, they don’t have any contract with you.

Also, having info that could be seen as originally belonging to them still in your possession may leave you open to charges of taking it wrongly. Even though you had the rights to it at the time.

Also, if it is personal data then perhaps you should give it to the person it is about. What data protection applies in your country.

If you have it on your personal storage and they can’t be sure it exists and they are asking on the off-chance then I would say “sorry, all personal info was removed when I left”.

Note: IANAL.

1
  • You serious? This is akin to asking the crime investigation unit to hand over their investigation data to the criminal they're investigating.
    – Jack
    Commented Aug 14, 2021 at 11:45
3

You should refer them to Company Z and instruct them to request the information from Company Z. This is Company Z's data, and it's up to them, not you, to decide whether to share this information. And if Company Z wants to share it, they should do so themselves. If you were still employed by Company Z, and someone in another company just randomly asked you for personnel files, would you hand them over?

If they've lost the information and would like you to share your own copy, you're not obligated to do so, but it would be the polite thing to do. But if you decide to do so, you should not share it with Company A directly. Give it to Company Z, and have them decide what to do with it. If the employee finds out that their information was shared, they may have grounds for a lawsuit, and you should avoid giving them any grounds for naming you as a defendant.

And going forward, it's generally a bad idea to retain information from an employer after your employment ends.

2
  1. It's not personal information. It's employment related information. They didn't ask you for details on their height, weight, marital status, religion, ethnicity, etc. They asked you for information regarding their behavior and actions as an employee, disciplinary action, etc. None of that is personal information.

  2. If company A and company Z are separate legal entities and are not owned by the same legal entity then I'd decline their request for information.

1

Personnel information is considered proprietary and in some cases possibly privileged in a sense (certainly at least in an internal authorization to access sense). It's work product that belongs to the company it was done for, in an information property sense.

You worked for company Z. You no longer work for company Z. Your change of employment was not simply an internal move between departments. Theoretically, any proprietary information you had related to company Z should have been turned over (or already stored appropriately, like in the employee's file in a location managed by HR) with whatever remained in your possession directly destroyed (if company Z already had copies).

Now, you can't just forget everything you knew. But you can decide that you don't want to be accountable for disclosing information that might still be privileged, that any appropriate people at company Z should have access to themselves already, and then potentially be in a situation where there is some form of liability attached due to doing so. Libel is not the only concern here, and honestly this quickly turns into a "you should consult an attorney first" situation if you do plan on disclosing anything to a member of your former employer that was properly turned over appropriately to your former employer at the end of your employment.

Just as a simple example, where I work certain personnel file details are required to be deleted after a certain amount of time ("letters", etc) in relation to employees under the collective bargaining agreement/contracts. Certain states (in the US) have laws regarding employment interference and similar things where non libelous communication can still be contended as such. A third party (you, now) disclosing information that resulted in the employee's job loss (or even failure to be promoted/achieve an internal promotion) that had been previously expunged from their file, knowing that disclosing it might result in an outcome like that, could conceivably be pursued under employment interference laws, even with a truthful disclosure.

You could certainly tell whoever is contacting you who they should talk to at company Z, instead.

"All of the appropriate information would be in their file with HR, everything I'm aware of in regards to them was properly recorded there, you need to contact whoever the appropriate person is now in Z's HR", for example. That's always going to be the safest route if you had turned everything over/stored it properly. You no longer work at Z, this should be handled internally at Z, and if anything it's a very strong red flag that it's not. Personally I'd be inclined to contact legal or HR at a former employer if some other employee (manager level or not) of theirs came to me asking for information like this, but that's up to you whether you want to get that involved.

Caveat: if, instead, you retained personnel files that were not properly turned over (yours is the only copy), and company Z knows this, you could talk to an attorney for the right way to turn them over that keeps you protected with some kind of signoff that indemnifies you, even if it was "just a mistake/forgot". But technically it should be turned over in that case, just it should be done correctly, which this doesn't sound like.

If you do think this is something that needs to be disclosed to company Z by yourself for whatever reason, you should have Company Z contact you through a proper channel as well (legal or HR). Not someone who you, as no longer working for them, can't be sure is actually supposed to be given this information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .