Code of Practice on employment practices

Having complied with the notification requirements of the DPA and ensured that the register entry reflects precisely the way in which personal data is processed in the business, an employer is left with what is the most important aspect of data protection, namely compliance with the eight data protection Principles.

We are going to consider each of the Principles in turn and consider their significance in the context of payroll. First, however, it is important to consider the Information Commissioner's own guidance on how the Principles apply in the broader context of employment. The Employment Practices Data Protection Code of Practice and a Supplementary Guidance booklet may be downloaded from the Information Commissioner's website.

The Code of Practice has four parts.

Part 1 of the Code of Practice looks at Recruitment and Selection and explains how the eight Principles apply to the processing of personal data in advertising, handling applications, verifying details provided by applicants, short-listing, records of interviews, pre-employment vetting, and retention of recruitment records.

Part 2 of the Code looks at Employment Records and relates the Principles to sickness and accident records, pension and insurance schemes, equal opportunities monitoring, references, disclosure requests, disciplinary, grievance and dismissal records, and the retention of such records.

Part 3 of the Code considers the difficult area of Monitoring at Work, i.e. observing employees in order to check their performance or conduct. It explains the application of the Principles to "systematic monitoring", e.g. the routine scanning of e-mail messages, and "occasional monitoring", e.g. the use of CCTV where an employee is suspected of theft.

Part 4 of the Code concentrates on how the Principles apply to the processing of Information about Workers' Health. This is not about sickness and accident records - they are covered in the Part 2 Employment Records - but about the issues the arise when the employment involves medical examinations and testing, perhaps because there are health risks attached to the employment.

Personnel departments should be using all four parts of the Code of Practice, but payroll departments will have a particular interest in Part 2 - Employment Records.

The Code of Practice looks at a wide range of situations in employment and explains how the Data Protection Principles are applied. Each of the Principles will now be considered in turn, but the points made relate specifically to payroll processing and the handling of payroll records.