Hi
We are looking to collect gender data from our membership base. If we ask for “male/felmale/prefer not to say” my understanding is that we are not governed by GDPR.
However if we ask “male/female/non-binary/prefer not to say” does the Non Binary option take us into GDPR and then Special Category data please?
Thank you for your help.
BlueBottle
I have to say I agree with Dominga that this would not be special category, however you do need to be careful and ensure you have a documented purpose and lawful basis for processing.
Additionally, I would advise taking specialist advice before including non-binary as the ONLY option beside male and female. You may consider this as part of the consultation phase in a DPIA. Speak to your members and see what they say, take their views into consideration and learn from them.
HellenB
As Dominga says, it is very dependent on how you phrase the question and also that you need to have a clear reason for asking it.
For instance, knowing the gender identity might enable you to create initiatives to increase inclusivity. But if you don’t have a clear reason for processing this data then you shouldn’t be collecting it.
Once you add in an option such as non-binary then you are into special category data territory and that is explicit consent under Art 9
Dominga Leone
Hi Hellen. Why do you evaluate non binary as being special category? I was quite sure it is not special category. This isn’t me contradicting you by the way, just really curious and most open to being wrong
HellenB
Hi Dominga
I would define it as such because it isn’t a biologically assigned gender (unless an individual is intersex or has a medical condition), it is a self-determined gender assignment and therefore individuals who define themselves in this way deserve additional safeguards because they may be subject to prejudice as a result of their declaration.
Does this make sense?
Dominga Leone
Thanks for answering Hellen. I am still not sure I see this as special category, as it is neither a health condition nor an indication of sexual orientation or preference, it is just an expression of not identifying with a social construct of either male or female. It is interesting to hear other people’s views on this, as it is a complex topic that I am far from an expert in and I can understand why some might consider it necessary to treat it as special category. Interestingly, gender identity was listed as special category in the early drafts of GDPR and then removed, which reinforced my assumptions on this topic. I hope more is released on this matter and that Supervisory Authorities are clear on their views – I am sure we will see debate on this matter in the forthcoming years. Thanks again.
HellenB
You are absolutely right in that it is very complex.
Maybe a simpler way would be to think about the one defining factor for all sensitive data – that all of them ‘could’ result in prejudice/affect human rights.
Defining yourself as a ‘man’ or a ‘woman’ will have a nominal affect (in theory!) but there are those who think that defining yourself as ‘non-binary’ is an affectation and will attach other labels to you including suppositions about your sexuality, sex life etc.
Henry
We had a very similar discussion when changing HR systems, and sought the advice of the ICO. They were uncharacteristically helpful over the phone and took a similar view to Hellen – it is clear that data regarding genders other than those assigned at birth deserve further protection and that at a pinch, they might consider that data to fall within the sex-life/orientation category.
Not perfect, I know, but does seem odd that it wasn’t included given the issue’s prevalence and potential for harm.
Stonewall also produced some good guidance on this, especially regarding using substantial public interest as an Art. 9 condition for processing. If anyone’s interested, I can email them a copy.
Dominga Leone
I should add though, that in line with data minimisation principles, you must ensure you can justify the use of capturing gender identity. There must be a specified purpose and a good rationale for why it is necessary and proportional to use this for your purpose.
Dominga Leone
I would say it is not special category data. Gender identity is different from sexual orientation/preference and I don’t think an organisation can deduce or make assumptions about someone’s sexual orientation just from their gender identity. Unless you have other data from which it could be inferred, I think you are fine.