Research Service of the German Bundestag: Data collection of diversity features in companies mostly unlawful

This is the conclusion of an expert opinion by the Scientific Service of the German Bundestag.

Such “diversity monitoring”, which is already practiced in the US and the Anglo-Saxon economic areas, is now to reach European and German companies as well. In particular, German subsidiaries of international groups are increasingly confronted with these requests and quotas. Such collection and processing of data on diversity factors, however, currently violates data protection standards. Furthermore, the collection of such characteristics in the recruitment process and the subsequent hiring of a specific talent due to certain diversity features violates the German General Equal Treatment Act (“AGG”).

What are the consequences for German businesses?

Most information to be collected in this context constitutes special categories of personal data pursuant to Art. 9 GDPR and is therefore subject to special protection. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the processing of data concerning health or data concerning a natural person’s sex life or sexual orientation is generally prohibited and, for good reason, only permitted within very narrow limits. The legal bases according to which special categories of data can be processed are in most cases not applicable to companies, which is why they are mostly subject to the employees’ consent. Due to the superior / subordinate relationship, however, any consent in the context of an employment is subject to particularly strict requirements. Therefore, it is of particular importance to transparently demonstrate which data are processed for what purpose. Likewise, the voluntary character must be guaranteed, and the employees must not suffer any disadvantages should they reject the collection of data. If applicants do not give their consent, it is questionable whether the collection of data makes any sense as it is based, with regard to the persons not giving their consent, upon incomplete data.

Furthermore, the Research Service correctly states that even an (subsequent) anonymization is not helpful as the previous collection of data requires a legal basis. It is thus advisable to involve the data protection officer at an early stage in order to avoid the imposition of severe fines due to data protection violations. Furthermore, the large-scale collection of data requires a data protection impact assessment.

Currently, the employer’s legitimate interests cannot justify the collection of sensitive employee data. Further developments regarding a future obligation to provide evidence of a company’s diversity remain to be seen.