Sex is not “special category” data

The new Code of practice on services, public functions and associations from the Equality and Human Rights Commission (EHRC), which was laid before Parliament on 21st May, is largely helpful and clear about how the protected characteristics of sex and gender reassignment interact with the unlawful acts of discrimination, harassment and victimisation as set out in the Equality Act.

But the draft code includes a new section on asking about sex (towards the end of Chapter 13) that is wrong about the law. This section should never have been laid before Parliament and it should be disregarded. We will be writing to the Minister for Women and Equalities, Bridget Phillipson, and to the chair of the EHRC, Mary-Ann Stephenson, calling for this section to be withdrawn.

It appears to have been added at the last minute following feedback from the government Office for Equality and Opportunity (OEO) insisting that there are “limited circumstances in which it may be legitimate for service providers to ask about a service user’s sex” and stressing the importance of training staff on the relevant procedures and protocols.

In an “additional impact assessment”, the OEO expressed particular concern that asking people what sex they are will result in “involuntary disclosure” that they are trans. This perspective can be understood only through the lens of transactivism, which imagines that people recognise others as men or women based on “gender identity”, while a person’s sex is deeply private. It says:

“New guidance explains how service providers can request information about an individual’s sex at birth. This may force trans people to “out” themselves in public or professional settings. Similarly trans people have expressed concern – as in the Good Law Project litigation against EHRC – that having to use disabled toilets will ‘out’ them.”

This directly contradicts both reality and the Supreme Court’s clear interpretation of the law. The Supreme Court recognised that knowing whether someone is male or female is generally straightforward, while “there is no obvious outward means of distinguishing between a person with the protected characteristic of gender reassignment who has a GRC and a person with that characteristic who does not”, or indeed between a person with the protected characteristic of gender reassignment and any other member of their sex, since this protected characteristic does not “require any physiological change or even any change in outward appearance”.

The new guidance claims that information on sex is, or should be treated as, “special category” data:

“13.175 Information about sex is sensitive and should be treated as special category personal data.”

and

“13.182 Information about sex is likely to constitute special category data for the purposes of the Data Protection Act 2018 (DPA) and UK General Data Protection Regulations (GDPR).”

Special-category data is personal data that attracts extra protection in law. It includes information on individuals’ health, philosophical beliefs, sex life and sexual orientation. It is covered under Article 9 of the UK GDPR. The idea that sex is special-category data has been advanced by the Good Law Project. (See our previous blogpost about sport and special-category data.)

If sex was special-category data, it would come under stricter data security requirements that would impose a duty of accountability on service providers and their staff and contractual partners. Mishandling such data can lead to serious breaches of privacy and significant legal penalties. When a business discovers that it has been subject to a data breach, it is required to notify data-protection authorities within 72 hours and also to notify the data subject.

It is simply outside the EHRC’s mandate to issue guidance about data protection, and doing so at the government’s insistence undermines the EHRC’s statutory independence. This advice in any case is wrong. And it undermines the rest of the guidance, recreating the problem which the For Women Scotland judgment solved and harming women’s rights.

1. The section is outside the EHRC’s mandate

The EHRC code of practice is issued under the Equality Act 2006, which allows the commission to issue a “code of practice in connection with any matter addressed by the Equality Act 2010”. It requires that the code is designed to ensure or facilitate compliance with the act or an enactment made under that act, and to promote equality of opportunity.

The section on asking about sex goes well beyond this mandate. There are no specific provisions on asking about sex in the Equality Act. The correct regulator to produce guidance on data protection is the Information Commissioner’s Office.

2. The section is wrong about data-protection law

It is true that sex is personal information and that data-protection legislation can apply. But it is wrong to say that it is sensitive or special-category data. Article 9 (1) UK GDPR defines special categories of personal data as being personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data and data concerning health or a person’s sex life or sexual orientation. It does not include sex.

The Information Commissioner has said that information about someone’s “gender identity” might be special-category data, depending on the circumstances:

“For example if the information also reveals specific details about the person’s health status or medical care, or an organisation uses it to make specific inferences about health.”

The Information Commissioner goes on to say:

“If there’s no specific information or inference about someone’s health (or any other specific category such as sexual orientation or sex life), it isn’t special category data.”

Sex (whether someone is a man/male or a woman/female) simply isn’t special-category data. And data on a person’s sex simply doesn’t reveal whether they identify as trans.

Sex is ordinary personal data that can be used routinely (similarly to other personal information such as a person’s name or age). In any case purely oral information – such as the reply to a question about whether someone is a man or woman in order to direct them to the correct facilities – would not come under data protection at all. As the judge said in the case of Scott v LGBT Foundation about oral information:

“That is not what the DPA is concerned with: it is a very specific scheme based around records and processing. There are other areas of law (in particular, the law of confidentiality) which are the appropriate vehicle for making such complaints if they are well-founded.”

3. The section incorrectly requires a spurious human-rights balancing test

Paragraph 13.161 says:

“Personal data includes information about a person’s sex which may also be protected under Article 8 of the European Convention on Human Rights (ECHR). In particular, it is important to be aware that some people, including some trans or gender non-conforming people, may wish to keep such information private as far as possible and may find it distressing to be asked about their sex.”

As Supreme Court judge Lord Reed explains in a recent helpful speech on proportionality:

“The UK has what is sometimes called a “dualist” system, which means that international and domestic law operate on different planes. Treaties such as the Convention are binding on the UK on the international plane, but they do not form part of the law of the UK unless Parliament passes legislation to implement them. This is a necessary corollary of Parliamentary sovereignty.”

As Lord Reed says, domestic law continues to be the first port of call for anyone whose rights have been infringed. UK GDPR is the primary domestic legislation that codifies and enforces the fundamental right to data protection, which stems from Article 8.

Individual service providers are not required to go beyond data-protection law and treat oral information or data on sex as special-category data, or to undertake human-rights analysis before processing information in line with GDPR or DPA.

The claim that asking for information on a person’s sex is a breach of Article 8 is widely made by transactivists, as on the TransLucent “Article 8 carry card”.

The Article 8 argument was also used by the government unsuccessfully to try to defend the Office for National Statistics’ decision, in the run-up to the most recent census, to direct people to answer the sex question according to their preferred sex rather than their actual sex. This decision was overturned in court after a challenge brought by women’s-rights activists.

It is neither necessary nor possible to consider the unknowable mental state of individuals before collecting or acting on routine information. Although it may be true that some people find it distressing to be asked about their sex, a service provider cannot know or guess which people they will be (and the information that an individual suffers from such feelings is in itself sensitive).

If a person wants to keep a piece of personal information private in any given situation, whether because of feelings of distress or other reasons, they can “prefer not to say”. However, refusal to give information or to allow it to be recorded where it is needed may mean the person is unable to access a service. This is not a breach of Article 8, any more than it is a disproportionate breach of privacy to require a person to confirm they are over 18 to buy alcohol, or to explain the basis on which they have parental responsibility to enrol a child in school and then to recognise that relationship (as a father or mother) in daily interactions with that school and others with a duty of care in relation to that child.

4. The section undermines safeguarding

An organisation that follows the guidance and treats sex as “special category” data will need to apply this to everyone.

But sex is often relevant for everyday life, formal and informal risk assessment, duty of care and safeguarding, as well as for decisions concerning consent and propriety. Sex forms the basis of many ordinary interpersonal relationships, in particular sexual relationships and parenthood.

Creating an environment where people are expected to treat sex as sensitive “special category” data, to pretend they don’t know what sex other people are, to believe that it is reasonable for people to be offended if asked to confirm their sex and to assume that any individual might not be the sex they appear to be makes it impossible to enforce sex-based rules and creates an environment where ordinary safety and safeguarding are compromised.

It forces people to pretend they don’t know what a man and a woman look like, that men are statistically more likely to undertake violent or predatory behaviour and that women are the targets for specific types of male violence. Neither the Equality Act nor UK GDPR requires this kind of wilful stupidity.

A man who has gained access to a female-only space is not simply a man within the ordinary male risk profile: he is a man who demonstrably possesses the additional risk factor of not respecting rules that exist to protect women. What is relevant is his sex: the fact that he is a man. The fact that he may be trans, non-binary, gender fluid, gender non-conforming or suffering from gender dysphoria is irrelevant (and may well be sensitive information).

Recording such factors or specific concerns would involve much greater processing of personal information than simply asking people to confirm their sex or to leave the space if they do not wish to, without processing any personal data.

5. This section is likely to cause unlawful harassment related to sex

The guidance extrapolates from its misunderstanding of Article 8 and UK GDPR to suggest that service providers and their staff must ask themselves several complex questions before deciding that it is proportionate to challenge a man in a women’s facility and ask him to leave. After thus tying itself up in knots, it warns (at 13.170):

“It is unlikely to be either practical or appropriate to approach any particular individual to make enquiries about their sex in relation to facilities, such as toilets, which are incidental to the primary service.”

There is no legal basis for this instruction, which in effect licenses men to enter women’s facilities and claim that it is inappropriate, possibly unlawful and a breach of their human rights to challenge them.

Telling staff supervising single-sex spaces that they must second-guess themselves when they become aware of a man engaging in the deviant behaviour of accessing a female-only space, or risk breaching data-protection law, will lead to unwanted conduct related to the protected characteristic of sex that is likely to meet the definition of harassment in the Equality Act. It “violates a person’s dignity or creates an intimidating, hostile, degrading, humiliating, or offensive environment”.

Section 111 of the Equality Act 2010 makes it unlawful to instruct, cause, or induce another person to commit an act of discrimination, harassment, or victimisation. For the past 15 years men with the inappropriate desire to use women’s spaces have cited legally incorrect advice previously given by the EHRC, which was inserted in the now-superseded 2011 version of the code of practice after consultation with transactivist groups.

It is utterly insulting, and could well be an act of inducement of mass harassment against every woman in Britain, that the OEC has pressured the EHRC to insert a misstatement of the law into its new guidance that will lead to service providers wrongly viewing sex as “special category data” and making it difficult to challenge and remove men from women’s changing rooms and toilets.