Can employers gather and analyse information for equality monitoring purposes under the GDPR?
Under the General Data Protection Regulation (GDPR), employers will be able to gather and analyse information about employees for equality monitoring purposes, provided that they have a legal basis for the processing and, where applicable, the rules relating to processing special categories of personal data are met.
Data that employers gather for the purpose of monitoring equal opportunities will often fall within the special categories of data under the GDPR, ie where it relates to employees' racial or ethnic origin, religious or philosophical beliefs, health or sexual orientation. The Data Protection Act 2018, which supplements the provisions of the GDPR, includes a limited provision that specifically allows these types of special category data to be processed for the purpose of monitoring equality of opportunity or treatment between different groups. An employee can require the employer to stop processing his or her data for that purpose by giving the employer written notice. The employer can rely on this provision only if it has an appropriate policy document in place, setting out the safeguards it has implemented for processing special category data and its policies on for how long the data will be retained.
The provision in the Data Protection Act 2018 will not apply to all processing that an employer may wish to carry out for equality monitoring purposes. For example, employers may wish to monitor equality of opportunity based on employees' gender or whether or not they have taken family-related leave. This data would not fall into the special categories of data under the GDPR or the Data Protection Act 2018. Where the provision of the Data Protection Act 2018 does not apply, the employer could rely on the processing being necessary for its legitimate interests as its legal basis for processing. In this case, the employees would have the right to object to the processing.
Alternatively, equal opportunities monitoring is one of the rare examples of where it may be appropriate for an employer to rely on employees' consent as the legal basis for processing their data. This is because employees can have a genuine choice about whether or not to provide the information and there should not be any adverse consequences for those who choose not to provide it. An employer may decide to base its equality monitoring programme on consent, to give employees more control over how their data is used. Employees can withdraw their consent at any time.
Depending on the nature of an equality monitoring exercise, it may be possible to anonymise the personal data before processing it. Provided that there is no way of identifying an individual to whom the data relates, the GDPR would not apply. Total anonymisation when gathering equality data would not be possible for a monitoring programme where it is necessary to track individuals, for example ongoing monitoring of data on promotions or resignations with reference to race.