Companies are increasingly trying to create a diverse and inclusive environment for their workers. One of the tools for doing this is worker surveys that include questions about sexual orientation, religious belief, health and other sensitive information that is not necessary for carrying out their direct job duties. The data obtained often fails to produce the expected result. On the contrary, this increases discrimination in the workplace or even has huge financial consequences for the company. This article explores what to focus on when it comes to worker surveys including questions about diversity and inclusion in the workplace.
Whenever a company’s surveys gather data on a worker’s race or ethnicity, political, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation (“special categories of data”) a preliminary research should be carried out on the legislation and case law applicable in the relevant territory. What is legal in one country might be illegal in another. You also need to determine the goals and legal bases of data processing under the General Data Protection Regulation (GDPR).
Questionnaires containing especially private answers to questions usually aim to find out whether the worker is feeling good and whether there is any discrimination in the workplace, using various algorithms combined with other answers.
No doubt, securing the anonymity of a questionnaire is the most important stage in gathering, aggregating and storing data and undertaking any other data processing activities. However, the mere fact that a person is not required to give their name or email address does not mean the questionnaire is anonymous. For example, if a company has one accountant, who gives details of their position and sexual orientation, for example, it’s clear this person may be indirectly identified. Or, for example, a question about the length of service at the company or its department, which is relatively popular in questionnaires, combined with questions about gender, position, age and other seemingly general questions, narrows down the circle of persons, so the person may be identified. IP addresses, too, are considered personal data under GDPR, in particular if a unique link is sent to the worker for completing the questionnaire. Identifying a person directly or indirectly is always treated as personal data processing under GDPR.
So, in especially small territories, companies or departments, precautions should be taken when it comes to the structure of questions and the algorithm being used, in order to mitigate the risk of the person being identified. For example, length of service or gender details may be aggregated in human resources, and questions directly identifying a department should be avoided to prevent the algorithm from analysing how many Catholics or Muslims are working in IT, for example. When it comes to structuring your questions, it’s better to go for general questions such as “Where do you see the most inequality/ Where do you see the most discrimination/ Areas in need of major inclusion measures” and avoid direct questions such as “State your sexual orientation/ religious belief/ political affiliation/ whether you are a disabled person”.
If there is any risk of workers being indirectly identified, the company should bear in mind that personal data processing is taking place and all the required steps should therefore be taken in this respect.
If the company sees the risk that the questionnaire is not anonymous and data processing is taking place, the company has a number of obligations under GDPR, including to inform the data subject. If the questionnaire comes with the required statement of data processing, then it’s clear the questionnaire will not achieve the expected result because it’s unlikely that the worker will be willing to take part in the survey.
To determine the purpose, you also need to evaluate the affected circle of persons in proportion to the rest of workers, i.e. whether interference in the private life of all workers is proportionate to one individual being discriminated. It might be better to choose some other known ways that help eliminate the existing inequalities in the workplace.
If the company has real facts or details of explicit discrimination against minorities, you should assess whether and how the data obtained might change the existing inequalities. You should also evaluate the affected circle of persons in proportion to the rest of workers, i.e. whether interference in the private life of all workers is proportionate to one individual being discriminated. It might be better to choose some other known ways that help eliminate the existing inequalities in the workplace.
If you still choose a questionnaire, this should be a voluntary one, making it possible to reply “I don’t want to answer” or “Skip this question”. Giving answers voluntarily would restrict replying to the person whose interests are infringed and avoid the aggregation of information on all workers.
GDPR states that special categories of data may be processed only if there is one of the article 9(2) exclusions, including (i) consent has been received or (ii) processing is required to carry out the data controller’s statutory obligations.
In an employment relationship, the data subject’s consent is rarely considered an adequate legal basis because the worker in relation to the employer is seen as the weaker party, so there is doubt as to whether the worker gave consent voluntarily or whether the employer forced it.
More companies are invoking their legal obligations because more European countries are demanding that employers gather and publish data on diversity mainly for gender.
In Italy, for example, legislation passed in November 2021 requires employers with more than 50 workers to submit a report every two years, giving certain information, including the number of men and women, the number of men and women hired, and any pay and job disparities. In Spain, when drawing up an “equality plan”, ethnicity data must be considered if that may affect workers’ right to equality. From 7 March 2022, equality plans are mandatory for all Spanish companies employing more than 50 workers. Poland permits the processing of special categories of data on workers if this is initiated by the worker, not the employer.
In Latvia, the employer is permitted to gather only information that is objectively associated with the existence of an employment relationship and the job or that is required by law (SKC- 454/2012). So, if the employer is unable to objectively show that the data obtained is required for the performance of job duties or if this is not expressly prescribed by law, the company must not gather special categories of data on its worker, unless data is indeed gathered anonymously and it’s not possible to identify the respondent directly or indirectly.
Embracing diversity may give the company a number of economic benefits, including help it attract and retain talent, promote innovation and boost productivity, for example:
Yet inappropriate aggregation of diversity data may increase discrimination risks, not mitigate them. For example, studies show that LGBT workers are more than twice as likely to experience discrimination in the workplace than their non-LGBT colleagues. Discrimination against sexual orientation adversely affects both the individual and the company because it causes more burnout and less engagement, which leads to work delays and resignations.4
So it’s important for the company to secure absolute anonymity of a questionnaire combined with other answers to prevent those from causing the respondent to be identified and subjected to potential discrimination because of the questionnaire. We recommend framing questions about an inclusive environment in a way that does not require the respondent to provide special categories of data (examples described above).
In view of this and assuming that a questionnaire cannot be made absolutely anonymous in relatively small territories like Latvia because combining several answers may indirectly identify the person, we would advise against gathering special categories of data on workers unless the law expressly provides for this. Remember, a single complaint from a data subject may cause the company to face a huge penalty (up to EUR 20 million or 4% of the group’s total turnover, whichever is the higher).
_______________________
1Phillips, K. W., Liljenquist, K., & Neale, M. A. (2009) Personality and Social Psychology Bulletin
2McKinsey, Delivering Through Diversity: Diversity and financial performance, 2017
3Harvard Business Review, 2016
4Sexual Orientation Diversity and Inclusion in the Workplace: A Qualitative Study of LGB Inclusion in a UK Public Sector Organisation, 2022
If you have any comments on this article please email them to lv_mindlink@pwc.com
Ask question
