Safeguarding all personal data not only upholds data subjects’ rights but also cements trust and good employee relations. Special category data must be treated with more protection because it is sensitive, but information about gender does not automatically fall into this category and in many cases will fall into a data-lacuna. A recent case reminds us that employers nonetheless need to take great care with gender identity data.

Under the GDPR, special category personal data is a category of data to which more stringent processing conditions apply. This includes data revealing ethnic origin, religious or philosophical beliefs, trade union membership and political opinions, generic and biometric data and data concerning health, sex life, and sexuality. These types of data are singled out because their (mis)use could create risks to an individual’s fundamental rights and freedoms.

Special or not?

Information about gender identity is not automatically special category data when we look at the strict GDPR definition. The ICO explains that instead, whether gender identity data is special category will depend on the circumstances:

“For example, if the information also reveals specific details about the person’s health status or medical care, or an organisation uses it to make specific inferences about health, that would involve special category data. If there’s no specific information or inference about someone’s health (or any other specific category such as sexual orientation or sex life), it isn’t special category data. But in many cases information about someone’s gender identity is still likely to be particularly sensitive”.

However, the ICO also acknowledges that information relating to whether “a person identifies as non-binary or another gender type” may be “considered special category data”, although does not explain why.

Applying the data principles

Gender identity data will also engage the seven data principles under the GDPR:

  • Lawfulness, fairness and transparency: in order to satisfy these, there must be a lawful and good reason for processing, that has been identified, considered, and communicated. This is particularly relevant if an individual holds a gender recognition certificate (see further below).
  • Purpose limitation: processing must not use the data beyond the specific legitimate purpose.
  • Data minimisation and storage limitation: seeking, processing and retaining more information than is necessary does not “safeguard the rights and freedoms of the data subject”.
  • Accuracy: this may be undermined if you retain inaccurate information and fail to rectify it.
  • Integrity and confidentiality (security): to meet this requirement, appropriate measures must be in place to keep the data confidential and safe.
  • Accountability: you must take proactive measures to comply with your obligations, for example by implementing policies and conducting assessments, so you actively ensure transparency and compliance.

Treating gender identity data as special category data will not only better protect the data subject but also minimise legal risk for the employer. This means that gender identity data should only be processed when there is both a lawful basis and a special condition (commonly in order to meet your obligations in relation to employment/engagement in so far as it is authorised by law or a collective agreement).

Employers should also be aware that any interrogation into the precise nature of this data (such as querying with the data subject whether it is health data or sexual orientation data) is very likely to harass and discriminate against the individual under the Equality Act 2010.

Additional protection under the Gender Recognition Act (GRA)

The Gender Recognition Act enables people to change their gender for all legal purposes, by being issued with a Gender Recognition Certificate (GRC). Not all trans* people have a GRC, nor is it a prerequisite for protection under the Equality Act.

However, for people who do have one, it offers additional legal protection as it is an offence for anyone who has received information in an “official capacity” about the person’s GRC / gender history to disclose that information. “Official capacity” would include people in HR or IT.

This is another reason why it is essential that staff who may see gender identity data know their obligations and liabilities.

The case of Miss AB v Royal Borough of Kingston upon Thames, in which an employment tribunal ruled that Miss AB was directly discriminated against by her employer, because of her being trans, is a reminder of the risks of failing to handle someone’s gender identity data properly and with the sensitivity it merits.

The case of Miss AB v Royal Borough of Kingston upon Thames

In this case, Miss AB gave notice to her employer, the Council, that she was intending to transition some eight months before she did so. She then ran into difficulties with her manager, whom she emailed alleging they were discriminating against her following her transition. Her manager replied the same day, saying this was “untrue, insulting, totally unacceptable and he now required a full apology”.

No steps were taken to investigate her allegations, because they were considered by the Council to have no merit. No effort was made to support her, no concern was shown for her wellbeing and all the focus was instead upon her manager. She was again instructed to apologise and told that if she failed to formalise her complaints (with evidence) disciplinary action would be taken against her. Despite her replying to say that she would formalise it, no one, including HR, ever treated her complaint as a formal grievance.

The Tribunal found that her manager’s reaction was “more than just unreasonable”, because it was “so extreme”. Miss AB was signed off sick, suffering “huge stress and trauma” as a result of the bullying; she experienced such severely intrusive thoughts that her GP considered whether she needed to be sectioned under the MHA.

Council’s policies and procedures

On considering her claim, the employment tribunal considered the policies and procedures the Council had in place to support transitioning staff. Despite the Council employing around 4,500 people (including around 60 in HR), the employment tribunal found that it had put “nothing” appropriate in place for trans employees. More specifically, the tribunal found:

  • Despite the introduction of the Equality Act in 2010, the Council’s Dignity at Work policy was not updated between 2006 and the end of 2021. The policy was not only out of date but also simply incorrect, for example by incorrectly aligning sexual harassment with trans harassment.
  • The Claimant’s pension records, the Customer Relationship Management tool, the complaint system, the Council’s directories, including the public-facing online one, and email systems were not updated (so also revealed her “deadname”) for nearly 2 years. A “deadname” is someone’s former name, often associated with trans and non-binary people who have changed their name. She was unable to contact anyone internally to ask for this to be rectified without outing herself.
  • Her office pass was not updated for 2 years, meaning she could not attend work nor use a printer without being deadnamed and misgendered. When it was finally reissued with her correct name, she found a post-it note with her deadname on her locker. The Council never investigated this.
  • She had issues obtaining a vehicle pass, which required her to contact an external party, who deadnamed and misgendered her on calls. Miss AB’s deadname was used in an email because an old server had cached it.

In summary, the Tribunal found the Council’s policies and practices “woefully inadequate” and it could “understand why Miss AB felt badly let down by her employer.” Miss AB was given an award, specifically to compensate her injury to feelings relating to the deadnaming, of £21,000 (in the middle Vento band) with interest (at 8%) on this from the first date of discrimination – totalling £25,423.

It is not clear whether Miss AB had a GRC, but if so, the numerous disclosures and deadnaming incidents would very likely have been criminal offences.

Practical steps for employers

The steps that the Council has now put in place are in fact good examples of best practice to avoid this kind of discrimination occurring in the first place:

  • Policies: The Council now has an appropriate policy in place, which was developed with Miss AB and reviewed with the staff LGBT+ network. You should check and review your own policies, preferably with the involvement of members of the LGBT+ community even if there is no formal network in your organisation. It is also worth checking your data protection policies to ensure that any trans or non-binary data you are processing is adequately considered and protected.
  • IT systems: The ruling is a prompt to check IT and administrative systems and ensure they are GDPR and GRA compliant. The Council is now going to offer people who wish to change gender markers a choice between having a new account or amending their existing one. Have a look at your records and processes – be it checking no old servers are going accidentally to cache inaccurate / historic information; or whether you have inclusive honorifics as an option in your record-keeping systems.
  • Co-ordinating with 3rd parties: Great care should be taken with external providers when someone transitions, so we suggest you identify with an individual how you can support them (which may include you doing it yourself) in contacting third parties to update their records. This will potentially capture a wide range of people, from clients to service providers, eg private health insurers or outsourced payroll. Ideally this would all be covered in a transitioning plan which will also ensure that the burden of amending is not placed on the individual and certainly not that they will face discrimination at work.
  • Dialogue and apology: The Council did not treat Miss AB’s complaints seriously, or as part of a grievance procedure. Had they heeded the warning signs, and spoken to her to understand her experience and how better to support her, the situation may never have escalated as it did. The employment tribunal noted that no apology had ever been offered to her (although Miss AB had been instructed to apologise herself). Acknowledging a failing and saying “sorry” for it, as part of a formal grievance or not, can go a long way.
  • Training: Specific training (via e-learning, with a way of checking whether people had attended it) has now been implemented at the Council. This is a very sensible step, especially for HR teams. If you would like to talk to our dedicated client training team on how we can support with this, please contact them at Lucy.hendley@lewissilkin.com. 

*In line with the Equal Treatment Bench Book guidance, we will use the word “trans” to describe the protected characteristic of gender reassignment, as the words used in the Equality Act are “widely considered to be out-of-date and stigmatising”.

Miss AB v Royal Borough of Kingston upon Thames judgment available here

Authors