Fair Work Action Plan 2022 and Anti-Racist Employment Strategy 2022: data protection impact assessment

5. Assessment of Anti-Racist Employment Strategy

A number of measures within the ARES will involve the processing of personal data. Full details of the measures are not yet known; however, it is expected that public and private sector employers will be encouraged to collect, analyse and disseminate data regarding employees for the purposes of ethnicity pay gap reporting or for using data to inform policy and practice.

The type of data processed will include data on employee protected characteristics, pay and other sensitive data. Sensitive data could take the form of qualitative data such as the experience of bullying and harassment within the workplace. The Information Commissioner's Office (ICO) regards employees as vulnerable individuals due to potential power imbalances meaning "they cannot easily consent or object to the processing of their data by an employer". Data originating from 'vulnerable individuals' is considered personal and highly sensitive.

The measures set out in the ARES refer to processing quantitative data metrics including protected characteristics such as ethnicity, disability, religion and gender, and other personal data including earnings and absence from work data. Qualitative data will also potentially be collected such as case studies, staff testimonies, exit interviews and staff surveys.

Personal data regarding ethnicity is classified as a special category of personal data under the GDPR. When processed, such data may create significant risks to employees' fundamental rights and freedoms, for example, resulting in unlawful discrimination. The GDPR is designed to protect individuals. The GDPR does not prevent the collection of ethnicity data, however, it is important organisations consider the GDPR requirements that must be addressed before starting such collection.

Therefore, there is potential for issues to arise when collecting, publishing, and disseminating data related to ethnicity and pay gaps, particularly for smaller organisations. During engagement, stakeholders expressed particular concerns regarding pay gap data, especially when sharing intersectional analysis for groups with one or more protected characteristics such as racialised minority women.

In addition, in the ARES, it is made clear that employers must comply with GDPR and seek support from the third sector or partners where necessary to support them with data management. Upcoming technical guidance from UKG and to other resources is also signposted that supports employers with data management.

The provisional DPIA score for the ARES is minor negative.