Purely a hypothetical scenario:
UK employer is an agency with various teams that provide services - some of which are digital - to a third party.
The employees create accounts on the third party's systems in order to do this.
The employer or the third party then request that the employee hands that password to a boss/manager/IT type person for whatever reason.
No password policy has been shared with the employee.
Where does the employee stand if they didn't feel right handing over a password? We don't know why. Let's assume they weren't very careful and used a password that they also use for personal accounts or something. There was no password policy after all.
Let's say that the employee isn't being given a chance to change the password first. Also, the third party could easily have IT reset the employee's password (obviously), begging the question why they even need the employee's password beyond what they say is standard procedure.
Where do they stand? Can the employee refuse to share the password?