Performance Review Confidentiality Breaches: Legal Framework and Case Laws

1. Introduction

Performance review confidentiality breaches arise when an employer, manager, human resources officer, or another employee improperly accesses, discloses, circulates, or uses an employee’s appraisal information. Such information may include annual performance appraisal reports (APARs), annual confidential reports (ACRs), performance ratings, promotion assessments, disciplinary comments, salary recommendations, and records of professional conduct.

Confidentiality is important because performance reviews can affect an employee’s reputation, career advancement, remuneration, and professional relationships. Unauthorised disclosure may expose an employee to humiliation, workplace discrimination, retaliation, or reputational harm.

Under Indian law, there is no single comprehensive statute dealing exclusively with confidentiality breaches involving workplace performance reviews. The applicable legal principles arise from constitutional privacy protections, the Digital Personal Data Protection Act, 2023, the Right to Information Act, 2005, employment contracts, service rules, principles of natural justice, and relevant judicial decisions. The applicability of a particular provision depends on the employer, the information involved, and the circumstances of disclosure.

2. Meaning and Forms of Confidentiality Breaches

A performance review confidentiality breach occurs when appraisal information is accessed, disclosed, or used without proper authority or a lawful basis.

Common examples include:

Unauthorised circulation: Forwarding an employee’s appraisal report to colleagues who have no legitimate need to access it.

Public disclosure: Publishing individual performance scores, rankings, or critical comments on an unrestricted internal portal or public platform.

Managerial gossip: Revealing confidential appraisal remarks during informal workplace discussions.

Improper access: Accessing another employee’s performance records without an authorised work-related purpose.

Disclosure to prospective employers: Sharing confidential appraisal details with an outside organisation without a valid legal basis or appropriate authorisation.

Misuse of digital records: Downloading, copying, or transmitting performance data through unauthorised email accounts, messaging applications, or storage systems.

Retaliatory disclosure: Publicising negative appraisal comments to embarrass an employee after a workplace disagreement or complaint.

Not every disclosure constitutes a legal violation. Disclosure to an authorised reviewer, a competent disciplinary authority, a court, or another legally entitled recipient may be legitimate. The central questions are whether the disclosure was authorised, necessary, proportionate, and consistent with applicable law and policy.

3. Legal Framework in India

A. Constitutional Right to Privacy

Article 21 of the Constitution protects life and personal liberty, and the Supreme Court has recognised privacy as a fundamental right. Professional information can attract privacy protection where disclosure intrudes upon an individual’s legitimate privacy interests.

However, Article 21 ordinarily operates against the State and other actors within the scope of constitutional obligations. A private-sector employee’s claim will generally require consideration of applicable legislation, contractual duties, and other legal remedies rather than assuming that every private employer is directly subject to Article 21.

B. Digital Personal Data Protection Act, 2023

Performance evaluations maintained digitally may contain personal data relating to an identifiable employee. The Act provides a framework governing the processing of digital personal data, subject to its scope, commencement, applicable rules, and statutory exceptions.

An organisation should assess the lawful basis for processing, its applicable obligations, permitted purposes, security safeguards, and any duties arising from a personal-data breach. The Act should not be treated as automatically imposing every obligation in every employment situation without examining the provisions in force and the relevant facts.

C. Right to Information Act, 2005

Section 8(1)(j), as applicable, addresses disclosure of personal information under the RTI framework, subject to the governing statutory language and applicable exceptions. Section 11 provides a procedure relevant to certain third-party information.

Importantly, confidentiality does not necessarily mean that an employee can never access their own appraisal record. Access by the employee concerned must be distinguished from disclosure to an unrelated third party. Public-sector disclosure questions also depend on the applicable RTI provisions and judicial interpretation.

D. Contractual and Employment Obligations

Employment contracts, confidentiality agreements, staff handbooks, service rules, and information-security policies may restrict access to personnel records. Unauthorised disclosure can constitute a breach of an applicable contractual or workplace obligation, depending on the wording, circumstances, and available remedies.

E. Natural Justice and Fair Appraisal

Where performance ratings affect promotion, career progression, or other service benefits, fairness and proper communication of relevant entries may be required under applicable service law. Confidentiality cannot ordinarily be used as a blanket justification for concealing an employee’s own appraisal information where disclosure is legally required.

4. Important Judicial Decisions: At Least Six Case Laws

The following decisions of the Supreme Court and High Courts of India establish important principles concerning confidentiality, access to appraisal records, privacy, and fair performance evaluation. Some decisions directly address disclosure of service records, while others concern communication of appraisal entries rather than an unauthorised leak.

1. Girish Ramchandra Deshpande v. Central Information Commissioner (2013) 1 SCC 212

Court: Supreme Court of India.

Facts: The applicant sought information concerning another government employee’s service career, disciplinary records, adverse remarks, and related personal information under the Right to Information Act, 2005.

Legal issue: Whether another employee’s service and disciplinary records could be disclosed to a third party without sufficient justification.

Judgment: The Supreme Court treated the requested service-related and disciplinary information as personal information protected under Section 8(1)(j) of the RTI Act as it then stood. Disclosure could be justified where the requisite larger public interest was established.

Relevance: This is a leading authority supporting the confidentiality of individual employment records. It demonstrates that a person's performance and disciplinary history should not ordinarily be disclosed to unrelated third parties merely because they request it.

Principle: Personal employment records deserve protection against unwarranted disclosure, subject to applicable statutory exceptions.

2. R.K. Jain v. Union of India (2013) 14 SCC 794

Court: Supreme Court of India.

Facts: The dispute concerned access to information relating to another public servant, including official service and vigilance-related records.

Legal issue: Whether information concerning another employee could be disclosed under the RTI Act without adequately considering that employee’s privacy interests.

Judgment: The case reinforced the protection afforded to third-party personal information and the need to apply the statutory disclosure framework, including the relevant third-party procedure where applicable.

Relevance: Where a manager or employee circulates another person's appraisal report without authorisation, this decision provides an analogous principle supporting the importance of protecting personal service information.

Principle: Access to employment records must be assessed under the applicable law; public availability or curiosity alone does not automatically justify disclosure.

3. Canara Bank v. C.S. Shyam (2018) 11 SCC 426

Court: Supreme Court of India.

Facts: The case concerned a request for information about bank employees, including service particulars, transfers, and other employment-related information.

Legal issue: Whether employment-related information concerning individual employees could be disclosed under the RTI Act without establishing the applicable legal justification.

Judgment: The Supreme Court applied the principles governing personal information and rejected disclosure of the requested employee-related information in the circumstances of the case.

Relevance: Performance review documents may contain personal ratings, comments, disciplinary assessments, and promotion recommendations. The decision supports a cautious approach to requests for another employee's individual records.

Principle: Employment information is not automatically open to disclosure merely because it is held by an employer or public institution.

4. Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal (2020) 5 SCC 481

Court: Supreme Court of India, Constitution Bench.

Facts: The proceedings concerned disclosure of information relating to public authorities and judges, including issues involving personal information, transparency, and privacy.

Legal issue: How the right to information should be balanced against privacy and confidentiality interests.

Judgment: The Court recognised that professional records, including performance evaluations, annual confidential reports, and disciplinary proceedings, can constitute personal information deserving protection from unwarranted invasion of privacy. Disclosure requires consideration of the governing law and the relevant public-interest circumstances.

Relevance: This decision offers particularly strong support for treating performance appraisals as sensitive personnel records. It also demonstrates that confidentiality must be balanced against legitimate transparency requirements rather than applied absolutely.

Principle: Personal and professional information requires a legally justified, proportionate approach to disclosure.

5. Dev Dutt v. Union of India (2008) 8 SCC 725

Court: Supreme Court of India.

Facts: A government employee challenged the consequences of an appraisal entry that had not been communicated to him and affected his promotion prospects.

Legal issue: Whether an appraisal entry that could adversely affect career progression must be communicated to the employee concerned.

Judgment: The Court held that entries in an annual confidential report must be communicated to the employee within a reasonable period so that the employee can make a representation where appropriate.

Relevance: This case establishes an important distinction between confidentiality from unauthorised third parties and legitimate access by the employee whose performance is being assessed. An employer cannot rely on the label “confidential” to deny access where service law requires communication.

Principle: Appraisal confidentiality must not undermine fairness, transparency, or an employee’s opportunity to challenge a consequential assessment.

6. Sukhdev Singh v. Union of India (2013) 9 SCC 566

Court: Supreme Court of India.

Facts: The dispute concerned the communication of annual confidential report entries and their effect on the employee’s service prospects.

Legal issue: Whether appraisal entries must be communicated even when they are not formally classified as adverse.

Judgment: The Supreme Court affirmed the principle in Dev Dutt that every entry in an ACR must be communicated within a reasonable period.

Relevance: The case reinforces that appraisal records have both a confidentiality dimension and a fairness dimension. The employer must protect records from unauthorised outsiders while communicating relevant entries to the employee as required by law.

Principle: Confidentiality is not a justification for withholding appraisal information from its lawful recipient.

7. Pankaj Prakash v. United India Insurance Co. Ltd., Civil Appeal Nos. 5340–5341 of 2019, decided on 10 July 2019

Court: Supreme Court of India.

Facts: The employee challenged the non-communication of appraisal entries that affected consideration for promotion.

Legal issue: Whether uncommunicated appraisal entries could form the basis of a promotion decision without giving the employee an appropriate opportunity to respond.

Judgment: Applying Dev Dutt and Sukhdev Singh, the Court recognised the employee’s legitimate grievance and directed consideration of representations concerning the relevant entries.

Relevance: The case illustrates why appraisal information must be handled through authorised channels. An employee’s right to receive their own assessment is distinct from a third party’s attempt to obtain confidential records.

Principle: Lawful access and procedural fairness must be preserved while protecting employment information against improper disclosure.

5. Legal Consequences of a Confidentiality Breach

Depending on the facts and applicable law, an employee affected by an unauthorised disclosure may pursue one or more of the following remedies:

Internal grievance: Report the breach to human resources, the compliance department, or the designated grievance officer.

Disciplinary action: Request an investigation and appropriate action against the person responsible, in accordance with applicable service rules or workplace policies.

Data-protection remedies: Where the Digital Personal Data Protection Act, 2023, applies and the relevant provisions are in force, pursue remedies available under that framework.

Contractual remedies: Rely on enforceable confidentiality obligations or employment policies where the facts establish a breach.

Defamation proceedings: Consider a claim where the disclosure involves legally actionable defamatory statements, subject to the applicable requirements and defences.

Judicial remedies: In an appropriate case, seek an injunction, damages, or other relief available under the applicable law.

A confidentiality breach does not automatically establish entitlement to compensation. The claimant must establish the relevant legal basis, the breach, and any required elements of loss or injury.

6. Practical Measures for Employers

Employers can reduce the risk of confidentiality breaches by implementing the following safeguards:

Restrict appraisal access to authorised personnel with a legitimate business need.

Apply role-based access controls, authentication, and audit logs to digital appraisal systems.

Prohibit unauthorised forwarding, downloading, photographing, or publication of appraisal documents.

Establish written policies governing retention, disclosure, and secure destruction of appraisal records.

Train managers and HR personnel in privacy, confidentiality, and appropriate information handling.

Investigate suspected breaches promptly, preserve relevant evidence, and document corrective action.

Establish a process through which employees can access and challenge their own appraisals in accordance with applicable law.

7. Challenges in Enforcing Confidentiality

Several practical difficulties arise when enforcing performance review confidentiality. Digital documents can be copied and circulated rapidly, while informal disclosures may leave little documentary evidence. Employers must also balance confidentiality with legitimate reporting, investigations, statutory disclosure obligations, and employees’ rights to access their own records.

Another challenge is determining whether the disclosure was genuinely unauthorised. Sharing an appraisal with a competent reviewing authority may be lawful, whereas forwarding the same document to unrelated colleagues may violate policy or applicable legal duties. Context, purpose, recipient, and the nature of the information are therefore critical.

8. Conclusion

Performance review confidentiality breaches raise important concerns involving privacy, professional dignity, employment obligations, and fair workplace administration. Indian judicial decisions, particularly Girish Ramchandra Deshpande, R.K. Jain, Canara Bank v. C.S. Shyam, and CPIO, Supreme Court of India v. Subhash Chandra Agarwal, support the protection of personal employment information against unjustified disclosure. Conversely, Dev Dutt, Sukhdev Singh, and Pankaj Prakash demonstrate that confidentiality cannot be used to deny employees access to appraisal entries that must legally be communicated to them.

The governing principle is that performance reviews should remain confidential against unauthorised disclosure while remaining accessible to persons legally entitled to receive them. A sound legal and organisational framework must protect privacy without obstructing accountability, lawful transparency, or procedural fairness.

Note: The cases discussed are Indian authorities. Several address access to or disclosure of service records rather than a direct claim for damages arising from a workplace appraisal leak. Their application to a specific dispute depends on the facts, the employer’s status, the law in force, and the remedy sought.