Disclosure Limits for Supervisors

1. Introduction

Disclosure limits for supervisors refer to the legal and practical restrictions on the information that a supervisor may disclose about employees, particularly information concerning performance, disciplinary proceedings, complaints, health, personal matters, confidential investigations, wages, and workplace grievances.

A supervisor generally has access to employee information because of their managerial position. However, that access does not give unlimited authority to disclose the information to colleagues, outsiders, customers, other departments, or social-media platforms.

The fundamental principles are confidentiality, legitimate purpose, necessity, proportionality and data protection.

2. What Information May Be Subject to Disclosure Restrictions?

Supervisors may handle information such as:

• Employee performance reports
• Disciplinary allegations
• Show-cause notices
• Investigation reports
• Complaints of harassment
• Medical information
• Leave records
• Salary information
• Personal contact details
• Family information
• Attendance records
• Workplace grievances
• Confidential business information
• Whistle-blower complaints
• Internal investigation material
• Performance-improvement plans

Disclosure of such information should normally be limited to persons who have a legitimate need to know.

3. Supervisor's Duty of Confidentiality

A supervisor may have confidentiality obligations arising from:

1. The employment contract.
2. Company policies.
3. Confidentiality or non-disclosure agreements.
4. Data-protection legislation.
5. Privacy principles.
6. Common-law duties.
7. Specific workplace legislation.
8. Orders or directions of courts or tribunals.

Therefore, a supervisor should not assume that information can be freely shared merely because it was obtained during employment.

4. Need-to-Know Principle

A practical rule is the need-to-know principle.

Information should generally be disclosed only to persons who require it for a legitimate organisational or legal purpose.

For example:

Appropriate disclosure:

A supervisor informs HR that an employee has repeatedly violated the company's attendance policy.

Potentially inappropriate disclosure:

The supervisor tells the employee's colleagues about the employee's personal medical condition to explain why the employee was absent.

The second disclosure may be unnecessary because the colleagues do not need the medical information to perform their work.

5. Disclosure During Disciplinary Proceedings

A supervisor may be required to provide information concerning misconduct to HR or a disciplinary authority.

However, the information should ordinarily be:

• accurate;
• relevant;
• based on facts;
• limited to the disciplinary issue;
• supported by available evidence; and
• communicated through the appropriate process.

A supervisor should avoid unnecessarily circulating allegations before the disciplinary process has been completed.

6. Disclosure in Harassment Complaints

Confidentiality becomes particularly important in sexual-harassment and workplace-harassment complaints.

Information concerning:

• the complainant;
• respondent;
• witnesses;
• allegations;
• statements;
• evidence; and
• findings

should not be casually disclosed to unrelated employees.

Under the POSH framework, confidentiality requirements apply to proceedings and related information.

A supervisor who discusses an ongoing complaint with unrelated colleagues may potentially compromise the integrity of the investigation and cause additional harm to the parties involved.

7. Employee Medical Information

Medical information is particularly sensitive.

A supervisor may need to know that an employee is:

• medically unfit for work;
• on approved medical leave; or
• entitled to a workplace accommodation.

However, the supervisor may not necessarily need to know the employee's detailed diagnosis or medical history.

The principle should be:

Disclose what is necessary for managing the employment relationship, not unnecessary medical details.

8. Salary and Financial Information

Supervisors may have access to information concerning:

• salary;
• incentives;
• bonuses;
• deductions;
• bank details; and
• compensation reviews.

Such information should be handled confidentially and disclosed only where there is a legitimate business or legal reason.

Particular care should be taken with bank-account information and other financial identifiers.

9. Performance Information

Performance information may be shared internally when necessary for:

• performance management;
• promotion decisions;
• appraisal;
• disciplinary proceedings;
• training; or
• workforce planning.

However, supervisors should avoid publicly humiliating employees by discussing poor performance with unrelated colleagues.

For example, announcing in a team meeting that a particular employee is "the worst performer because of personal problems" may go beyond legitimate performance management.

10. Privacy and Data Protection

The right to privacy is recognised as a constitutional right in India.

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right under Article 21 and the Constitution.

This has significant implications for employee information.

Employers and supervisors should consider:

• purpose of collection;
• purpose of disclosure;
• necessity;
• proportionality;
• security; and
• legitimate organisational interests.

The Digital Personal Data Protection Act, 2023 also provides a statutory framework concerning processing of digital personal data.

11. Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

A nine-judge Constitution Bench of the Supreme Court recognised privacy as a fundamental right.

The judgment explained that privacy includes protection of personal information and individual autonomy.

Importance: Supervisors handling employee personal information must recognise that privacy is a constitutionally protected interest and that unnecessary disclosure can raise serious legal concerns.

2. R. Rajagopal v. State of Tamil Nadu (1994)

The Supreme Court recognised the individual's right to privacy and discussed restrictions concerning publication of private information.

The Court recognised that private matters generally receive protection from unjustified public disclosure.

Importance: The case provides an important foundation for understanding why personal employee information should not be unnecessarily disclosed.

3. Mr. X v. Hospital Z (1998)

The Supreme Court considered privacy and confidentiality in the context of medical information.

The Court recognised the importance of confidentiality while also considering circumstances in which disclosure may be justified by a legitimate public interest.

Importance: The case is particularly relevant to supervisors handling employee medical information. Confidentiality is important, but it is not necessarily absolute in every circumstance.

4. District Registrar and Collector, Hyderabad v. Canara Bank (2005)

The Supreme Court examined privacy concerns relating to access to confidential financial information.

The judgment emphasised that privacy interests can arise in relation to financial and personal information.

Importance: It supports the principle that access to confidential information does not automatically mean unrestricted authority to disclose it.

5. Girish Ramchandra Deshpande v. Central Information Commissioner (2012)

The Supreme Court considered whether personal information relating to an employee could be disclosed under the Right to Information framework.

The Court treated service-related personal information, including matters such as disciplinary proceedings and assets, as personal information deserving protection, subject to the applicable statutory exceptions.

Importance: This case is highly relevant to employment confidentiality and demonstrates that employee service records cannot ordinarily be disclosed without considering privacy protections.

6. Canara Bank v. C.S. Shyam (2018)

The Supreme Court again considered requests for disclosure of employee-related information under the RTI Act.

The Court emphasised the privacy interests associated with individual employee information.

Importance: It reinforces the principle that employment records and personal employee information should not be disclosed indiscriminately.

7. Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal (2019)

The Supreme Court examined the relationship between transparency and privacy under the RTI framework.

The Court recognised that competing rights may need to be balanced and that privacy cannot simply be disregarded in favour of disclosure.

Importance: The case provides a useful framework for balancing legitimate disclosure requirements against individual privacy.

8. State of Maharashtra v. Madhukar Narayan Mardikar (1991)

The Supreme Court discussed the protection of personal dignity and privacy in circumstances involving sensitive personal information.

Importance: The decision demonstrates the broader judicial recognition that personal dignity and privacy deserve legal protection, particularly where disclosure could cause unjustified harm.

12. Confidentiality vs Legitimate Disclosure

Confidentiality does not mean that a supervisor can never disclose employee information.

Disclosure may be justified when required for:

• an internal investigation;
• disciplinary proceedings;
• a court order;
• statutory reporting;
• compliance obligations;
• workplace safety;
• prevention of serious misconduct;
• HR decision-making; or
• another legitimate organisational purpose.

The important question is:

Is the disclosure necessary and authorised for a legitimate purpose?

13. Disclosure to HR

A supervisor can normally share relevant employee information with HR where HR needs the information to perform its employment-related functions.

For example, if an employee repeatedly violates workplace rules, the supervisor may provide HR with:

• attendance records;
• incident reports;
• relevant communications;
• dates of misconduct; and
• witness information.

However, irrelevant personal information should not be added merely because the supervisor possesses it.

14. Disclosure to Other Employees

Disclosure to colleagues should generally be restricted.

For example, if an employee is undergoing disciplinary proceedings, a supervisor should ordinarily avoid telling unrelated colleagues:

"She is under investigation because of a personal complaint."

Instead, the supervisor can simply state, where operationally necessary:

"Please coordinate the assigned work with HR until further notice."

This protects confidentiality while allowing business operations to continue.

15. Disclosure to External Parties

Supervisors should be particularly careful when dealing with:

• customers;
• vendors;
• former employees;
• journalists;
• competitors;
• social-media users; and
• members of the public.

An individual supervisor normally should not disclose confidential employee information externally unless authorised or legally required.

16. Social Media

Posting employee information on social media can create serious privacy and employment-law problems.

Examples include posting:

• an employee's disciplinary notice;
• screenshots of private messages;
• medical information;
• termination documents;
• allegations of misconduct; or
• photographs accompanied by embarrassing personal information.

Even if the supervisor believes the information is true, publication may still be inappropriate if there is no legitimate reason for public disclosure.

17. Consequences of Improper Disclosure

Improper disclosure may potentially result in:

• internal disciplinary action against the supervisor;
• breach of confidentiality claims;
• privacy-related proceedings;
• employment disputes;
• reputational damage;
• compensation claims where legally available;
• regulatory consequences; or
• loss of employee trust.

The consequences depend upon the nature of the information, applicable law and circumstances of disclosure.

18. Practical Rules for Supervisors

Before disclosing employee information, a supervisor should ask:

1. Is the information relevant?
2. Does the recipient need to know it?
3. Am I authorised to disclose it?
4. Is there a legal requirement to disclose it?
5. Can I disclose less information while achieving the same purpose?
6. Does the information contain sensitive personal data?
7. Could disclosure harm the employee unnecessarily?
8. Am I using an appropriate and secure communication channel?

If the answer to these questions is unclear, the supervisor should normally consult HR, legal counsel or the designated compliance officer before disclosure.

Conclusion

Supervisors occupy a position of trust because they frequently have access to confidential employee information. Their authority to access information for managerial purposes does not automatically create unlimited authority to disclose it.

Indian judicial decisions, particularly Puttaswamy, R. Rajagopal, Mr. X v. Hospital Z, Girish Ramchandra Deshpande and Canara Bank v. C.S. Shyam, demonstrate the importance of privacy, confidentiality and controlled disclosure.

The best approach is to follow the need-to-know, purpose limitation, necessity and proportionality principles. Information should be disclosed only to the appropriate person, for a legitimate purpose, and only to the extent reasonably necessary.