Understanding diversity data gathering is key - Euan Smith

Public sector organisations in Scotland have long been required to gather and utilise employee diversity data and the requirement to publish gender pay gap data was extended to large UK employers in 2017. Notwithstanding any legal requirements to do so, with an increased focus on Environmental, Social and Governance (ESG) policies, the gathering of diversity data continues to be key for growing Scottish businesses. Not only does the publishing of such data satisfy investors who value ESG diversity factors, it is also vital in designing and monitoring effective diversity and inclusion strategy.

As Scottish businesses continue to expand overseas, it is likely they will seek to collect diversity data not only on their Scotland-based employees but also those located elsewhere. However, there are pitfalls in doing so that could land such businesses in hot water due to the differences in data and equality laws in other jurisdictions, even if done on an anonymous basis.

Examples from a number of other jurisdictions illustrate some of the challenges.

In Denmark, the Anti-Discrimination Act provides that attributing any relevance whatsoever to age, national, social and ethnic origin, sexual orientation, religion, political review, race or colour is illegal. As a result, the Act also strictly prohibits requesting, obtaining, receiving or making use of information on any of these characteristics in connection with or during employment. Employers based in Denmark do not, therefore, generally gather such data even on an anonymous basis to minimise any risk of violating the Anti-Discrimination Act.

Euan Smith, partner, law firm Eversheds Sutherland

France does not recognise the categorisation of people based on race or ethnicity and as a result, the collection of processing race and ethnicity data is prohibited by the French constitution and French data protection laws. Seeking such data from employees could result in a fine or prison sentence. If an employer wants to gather similar diversity information, they would instead need to focus on gathering data which may reveal geographical or cultural origins, such as nationality and first language, but such data would not be comparable to other locations. Due to the cultural context of universalism in France, such monitoring is far from typical.

In the United Arab Emirates (UAE), some personal data is considered sensitive under the UAE’s Federal Decree Law No. 45/2021 which is incredibly similar to EU GDPR. Under this decree, sensitive personal data is defined as data which directly or indirectly reveals a person’s family, ethnicity, political or philosophical views, religious beliefs, criminal record, biometric data or their health. Whilst sexual orientation is not specifically mentioned within this category of data, same sex relationships and gender reassignment are not recognised in the UAE. Collecting sexual orientation or gender identity data could therefore be incredibly risky for any employee who may incriminate themselves. Seeking to collect such personal data could also have consequences for the reputation of the business given the cultural and legal context.

Whilst these are just three examples of the many different statutory regimes in place across the globe, they demonstrate how difficult it can be to navigate diversity data collection on a global scale. Eversheds Sutherland has developed an online tool - Diversidata - which provides users with tailored advice depending on the type of data they wish to gather and in what jurisdictions, as well as practical guidance on the cultural landscape in place. No matter what tools Scottish businesses utilise in collecting diversity data from overseas, they must remain live to the nuances present to avoid possible criminal sanctions, reputational damage or employee data privacy concerns. There are also various restrictions in place in respect of transferring such data overseas which must be borne in mind.

Euan Smith, partner, law firm Eversheds Sutherland