Outside IR35 Public sector - Recruitment agency asking for NI Number on ltd company compliance form I've successfully landed a role in the public sector. I was told by the agency it is outside IR35. I've been sent a lot of documents to complete. Amongst them is a Ltd company compliance form. This form asks for my Nation Insurance Number number along with Ltd company details. The form states the information must be sent to HMRC. Why would my NI number be required if the role is outside IR35? Whilst I have nothing to hide (I take salary and not dividends) I worry that taking this role will be put me on a targeted list for HMRC to harass later down the road.
Being outside of IR35 means one is considered a (self-employed) contractor, not an employee, and as such will not have income tax and national insurance contributions deducted under PAYE. HMRC require the NINO and Ltd Co details to cross-reference the payments declared in the public sector's accounts with the Ltd Co's accounts to ensure (a) they match, (b) the correct tax and NIC is paid by the relevant entities, and (c) to confirm the identity and/or status in the Ltd Co of the recipient of the payments.
The question reads: I see an NDA as a pseudo-public document, something you need to read in detail before you acknowledge and opt-in to limit rights (discussion of topic/tech). Unfortunately for this view, the law normally sees an NDA as a private contract, except when it is alleged that it violates public policy. If an NDA explicitly or implicitly includes itself in the list of things not to be disclosed, then posting it would be a violation of the contract. In such a case the party posting the agreement would be subject to whatever consequence the agreement specifies for violation, unless that person had a valid defense. The operator of a web site where the document might be posted would not normally ne a party to the agreement, and so would not be liable for hosting it, unless some other limitation applies, beyond the NDA itself. An NDA can indeed be a significant limitation on the signer's freedom to discuss certain topics, and a person would be wise to consider it in detail, and perhaps consult a lawyer, before signing one. But that does not mean that the person should post or distribute it publicly, nor that the person is automatically entitled to consult NDAs that others have signed. There are sufficient sample NDA forms available that a person can compare an offered NDA with other possibilities, and get an idea if an offered NDA goes beyond the usual terms.
I'd rather not, but this might be compliant if you make sure that the personal data under your responsibility remains secure and protected even if it is processed abroad. Since the UK has left the EU, it is sometimes necessary to distinguish between implications of the EU GDPR and the UK GDPR. These are functionally equivalent, but in the matter of international data transfers the practical details have diverged. In my answer that you cited, I argued that any website processes personal data, and is thus potentially in-scope for the GDPR. If you cause another organization to process this personal data outside of the UK, you are performing an international data transfer (called “restricted transfer” in UK guidance). For example, such non-UK processing occurs if you use cloud services that run outside of the UK. The UK ICO has guidance on international data transfers. As in an EU GDPR context, you can only perform the transfer if the data remains suitably protected, or one of the exceptions applies. The data remains suitably protected if the target country was attested and “adequate” level of data protection, or if you have implemented appropriate safeguards. As of 2022, the list of countries considered adequate is generally equivalent to the EU list of adequacy decisions. Notably, the US is no longer on that list after the Schrems II decision that invalidated the Privacy Shield Agreement. Since this decision was made before Exit Day, it also applies in the UK. This leaves “appropriate safeguards” for UK→US restricted transfers. In the linked ICO page, read the section Is the restricted transfer covered by appropriate safeguards?. In brief, you will need to perform a Transfer Impact Assessment, and sign Standard Contractual Clauses with the US data importer. In a Transfer Impact Assessment (TIA), you check that the data remains protected despite the transfer into a country without an adequate level of data protection. There is no official guidance on conducting a TIA, but the IAPP has a template and the EU EDPB has recommendations on supplemental measures to protect data transfers, which might reduce the risk and affect a TIA in your favor. It's worth noting that the EDPB recommendations were written in the wake of the Schrems II ruling, and can be summarized as “compliance is impossible when using US-based cloud services”. But this is your assessment, and TBH it seems the UK is a bit more relaxed than the EU in this regard. The Standard Contractual Clauses (SCCs) are a pre-formulated contract that binds the foreign data importer to handle the data properly. In essence, this translates relevant aspects of the UK GDPR into contract law. Many service providers already provide a Data Processing Agreement that includes SCCs by reference, but you'll have to make sure that these contracts have been entered in a legally binding manner. Sometimes these apply automatically as part of the terms of service, sometimes you need to explicitly sign these documents. But SCCs are one detail where UK GDPR compliance and EU GDPR compliance diverges a bit. The old EU SCC templates from 2004/2010 can no longer be used and have been replaced. For compliance with the EU GDPR, the new 2021 SCCs must be used. For compliance with the UK GDPR, you have two options. You can either use the 2022 International Data Transfer Agreement (IDTA), or you can use the 2021 EU SCCs along with the 2022 UK International Data Transfer Addendum which modifies the EU SCCs in some details. Don't want to deal with TIAs and SCCs? Switch to a hosting provider that only processes the personal data under your control in the UK, or in a country with an adequacy decision (e.g. EU, Canada, Israel).
Quitting before the start date: is the non compete enforceable? The non-compete is unenforceable unless the employer has provided you with material information that you can use to the detriment of the employer. Even in that case, the non-compete as outlined in your description seemingly exceeds the legitimate interests of the employer (see art. 2089 of the Civil Code of Québec). This means that the non-compete clause would be curtailed in court because the employer cannot prove that his business (or market share) encompasses the area depicted in the clause. The reason of being of non-compete clauses is to protect the employer from a potential misuse of information the employee obtained pursuant to his employment, such as trade secrets and information about clients. The fact that you are a fresh graduate suggests that you are dealing with just some typical intermediary who really has no &quot;trade secrets&quot; and who is not providing you with key information, let alone for a job that is scheduled to start five months later. Non-compete clauses that are overly broad contravene public policy in that they would singlehandedly exclude civilians from the labor market and disproportionately impair free trade.
If the employee has the choice - bonus and membership, or no bonus - then I expect the offer to be legal. Since it is a real bonus and part of your salary you will have to pay income tax on it. What might be illegal, but not your concern, is if your company tells investors how well the company is doing, and how well the membership scheme is doing, when in reality 80% of members are employees paying effectively nothing.
How should I proceed? I am asking law friends to recommend some employment lawyers, but other than this, can I do anything else? You definitely don't need an employment lawyer for this. From a legal standpoint, the matter is very simple: If you grant their request (whether by signing or otherwise expressing your acceptance), you would be waiving any remedies currently available to you for their breach of contract. The company's attempt to override its contract with you is quite naive, but the company can always (and evidently does) try to get away with its liability nonetheless. I would not be surprised if the company subsequently tries harder to intimidate you, but that does not change your legal position &amp; merits unless you sign the waiver the company is pursuing. Asking for your post-termination availability reinforces the notion of company's poor planning and subpar management.
This should probably be handled under TUPE — The Transfer of Undertakings (Protection of Employment) Regulations 2006 as amended by The Collective Redundancies and Transfer of Undertakings (Protection of Employment) (Amendment) Regulations 2014. Those regulations apply to "a transfer of an undertaking, business or part of an undertaking or business situated immediately before the transfer in the United Kingdom to another person where there is a transfer of an economic entity which retains its identity" Broadly, there must be some consultation but you cannot be forced to change the terms of your contract to your material detriment (for example, the date of the month you are paid might change, but your work and salary would not). This consultation should establish that there is no material detriment (carry on reading here). Regulation 13 provides (2) Long enough before a relevant transfer to enable the employer of any affected employees to consult the appropriate representatives of any affected employees, the employer shall inform those representatives of— (a) the fact that the transfer is to take place, the date or proposed date of the transfer and the reasons for it; (b) the legal, economic and social implications of the transfer for any affected employees; (c) the measures which he envisages he will, in connection with the transfer, take in relation to any affected employees or, if he envisages that no measures will be so taken, that fact; and (d) if the employer is the transferor, the measures, in connection with the transfer, which he envisages the transferee will take in relation to any affected employees who will become employees of the transferee after the transfer by virtue of regulation 4 or, if he envisages that no measures will be so taken, that fact. (6) An employer of an affected employee who envisages that he will take measures in relation to an affected employee, in connection with the relevant transfer, shall consult the appropriate representatives of that employee with a view to seeking their agreement to the intended measures. If you refuse to accept the transfer you are deemed to have resigned (Regulation 4(8)), unless the "transfer involves or would involve a substantial change in working conditions to [your] material detriment", where you can be deemed to have been dismissed (Regulation 4(9)), and potentially unfairly dismissed. That would be for an Employment Tribunal to decide. But you cannot exit the successor company except in accord with your contract, including any notice period. The 2014 amended Regulations deal principally with the issue of redundancy after transfer, which is specifically allowed for "economic, technical or organisational reasons", such as the new company deciding to rationalise operations in a location 300 miles away from your normal base. In those circumstances you can be made redundant if you don't move with your job or accept redeployment. [This is what happened to me.] Note that every TUPE transfer is unique, and while yours will be subject to the Regulations, the wrinkles in your particular case (a) aren't present in your question and (b) will best be answered by a specialist employment lawyer, particularly as to whether any necessary changes to your contract are to your "material detriment".
Can an employer be required to provide an escort from office to vehicle? No, at least, not on the theory articulated in the question. I can imagine some circumstances where it is conceivable that there might be a duty arising from some other source, like an OSHA regulation applied to a firing range business, or an express contract with the employee (some employers provide an escort as a matter of right in the evenings or at other high risk times, as an employee benefit, especially college and university employers, in part, because they have worker's compensation liability while an employee is still on a large campus, in part because it helps attract employees who may feel vulnerable, and in part because of an attitude that the employer wants its employees to be safe at dangerous times of day and this shows that the employer cares about them), or a court injunction related to a labor-management dispute where the employee is a scab. There is no such employer duty, but an employer does have strict liability in almost every case (there are some minor exceptions for very small employers and criminal conduct by an employee who is injured when the criminal conduct is clearly outside the scope of duty of the employee) for injuries and death in the course of employment from any cause whatsoever pretty much (including criminal actions of third-parties) which is generally fully insured by worker's compensation insurance. The exact details of when someone ceases to be at work for worker's compensation/employer liability is buried in case law and regulations (for overtime and minimum wage purposes, the standard is "portal to portal" but workers compensation/employer liability need not be identical, although once you are clearly no longer on the employer's premises and commuting after a day's work is done or before a day's work starts, you are clearly not covered). But, any place where there is employer liability at all, it would be worker's compensation covered. Usually, if the employer is required to have worker's compensation but doesn't, the employer likewise has strict liability for the same harms, but the damages that may be awarded are not limited to those that worker's compensation policies would cover. This leaves the employee with at risk travel between the office and the vehicle. It seems reasonable as well that as the employer prohibits the employees self defence, they would be responsible for the employees defence between office and some safe location (i.e. vehicle). This theory pretty much always loses. An employee walking in an ordinary, non-wartime environment without a firearm is not "at risk" in a meaningful sense, any more than someone who didn't choose to carry a firearm who goes about their daily life (or is prohibited from carrying one due to past conduct such as a felony or a domestic violence protection order or a domestic violence misdemeanor or a condition of parole, probation or bond pending criminal charges). Also, the employee is not being prohibited from engaging in any kind of self-defense or protective action whatsoever (or from asserting self-defense rights if a firearm is carried contrary to an employer rule) just from carrying a firearm at that particular moment (on pain of losing a job, not forfeiting a legal affirmative defense under criminal statutes), which is one of many means by which a person can protect themselves from crimes.