Data Protection Impact Assessment and Article 9 analysis

The scored index is ordinary personal data

Every variable contributing to the background index is ordinary personal data under the UK GDPR. Parental occupation, parental education, free school meal eligibility, childhood housing tenure, household financial circumstances, school type and class size are none of them within the Article 9 categories, and none of them is a protected characteristic under the Equality Act 2010.

This is the central design property of the instrument. It means the scored index can lawfully inform workforce policy under Article 6 alone. The lawful basis is Article 6(1)(f), legitimate interests, being the employer's interest in understanding and correcting structural inequity in its own pay and progression systems. A legitimate interests assessment is completed with each client during onboarding.

A point that is frequently misunderstood

Sex is not special category data. Article 9 covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, data concerning health, and data concerning sex life or sexual orientation. Sex itself is not in that list and is processed under Article 6 in the ordinary way. Disability is not a listed category either, and is processed as data concerning health, which is listed.

The classification in full

Why an assessment is required

A DPIA is required where processing is likely to result in a high risk to the rights and freedoms of individuals. This processing meets several recognised screening triggers, and we treat the assessment as mandatory rather than discretionary in every case.

Systematic description of the processing

Nature.Employees are invited to complete a voluntary questionnaire about parental occupation, parental education, childhood material circumstances and schooling, with an optional equality monitoring section. Responses are pseudonymised at the point of collection. The employer separately provides workforce records covering job level, tenure, compensation, performance rating, function and, where in scope, recruitment and progression history. The two datasets are joined by a pseudonymous identifier inside a controlled analytical environment. Statistical models estimate the association between background and outcomes at population level. Aggregate findings are produced. The identifier mapping is destroyed at the agreed retention date.

Scope.Employees within an agreed population, normally a defined business unit or the whole organisation. Candidate data, where the hiring module is in scope, is collected voluntarily at application and firewalled from every hiring decision.

Context.The employment relationship carries an inherent imbalance of power, which is why the survey is voluntary at question level, why no individual output exists, and why consent is deliberately not used as the lawful basis. Consent obtained by an employer from an employee is rarely freely given, and relying on it here would be the weaker and less honest choice.

Purpose.To identify and keep under review whether equality of opportunity exists within the organisation, to quantify any structural gap, to size what correcting it would require, and to test whether measures taken actually work.

Data flows.Collection through a hosted survey instrument, transfer of workforce records by secure transfer to an agreed template, processing inside a controlled environment with access limited to named analysts, and output as aggregate documents. No data is transferred outside the United Kingdom or the European Economic Area without an agreed transfer mechanism recorded in the client agreement.

Necessity and proportionality

Is the processing necessary?Whether background predicts pay and progression inside a specific organisation cannot be answered without data about background from that organisation. No existing workforce record contains it, and public benchmarks describe the national population rather than a firm's own position.

Is there a less intrusive way?Considered and rejected in three forms. Inferring background from names, postcodes or universities would avoid asking people anything, and is refused outright as both intrusive and unlawful in this context. Using existing demographic data alone would not measure background at all. Sampling a smaller group would reduce the data collected but produce estimates too uncertain to act on, which fails the purpose while still processing personal data.

Data minimisation.The instrument was reduced deliberately. Several variables the underlying research found predictive were removed because their intrusiveness or unreliability outweighed their contribution, including birth circumstances, physical fitness, personality measures and family size. What remains is the smallest set that supports a defensible estimate.

Proportionality of the outputs.Outputs are aggregate only. Granularity is capped by minimum group sizes rather than by what the data would technically permit. Where a population cannot support a breakdown, the breakdown is removed from scope rather than published with wide uncertainty.

Accuracy.Background data is self reported and treated as such. Non-response is recorded rather than imputed, and the proportion appears in every deliverable.

Individual rights

Pseudonymised, not anonymised

Survey responses are linked to workforce records by a pseudonymous identifier. Because that linkage exists, the data remains personal data and the full regime applies to it.

A great many vendors describe the same arrangement as anonymised, which is inaccurate and misrepresents the client's obligations. Anonymisation arrives only at the point the mapping is destroyed.

Roles

The client is controller for the workforce data and for the survey data relating to its employees. EconPact acts as processor under a written agreement meeting Article 28, and as controller for the anonymised residual dataset retained for population benchmarking after the mapping is destroyed. Sub-processors are listed in the client agreement, and no new sub-processor is engaged without notice.

Delivery through counsel

An engagement may be commissioned by the client's legal counsel, with deliverables addressed to counsel and prepared for the purpose of obtaining legal advice. Clients frequently prefer this, because a structural equity diagnostic produces written findings about the organisation's own pay outcomes and they are entitled to take advice on those findings before deciding what to do with them. Whether privilege attaches in any particular case is a matter for the client's own counsel.

Consultation, sign-off and review

The client specific assessment is completed jointly with the client's data protection officer and reviewed with employee representatives or a works council where one exists. It is signed off before any survey is deployed, and no fieldwork begins without it.

Where high risk would remain after mitigation, the controller must consult the Information Commissioner before proceeding. On the assessment above, residual risk is low across every identified category and prior consultation is not triggered. That conclusion is reviewed for each engagement rather than assumed from this document. The assessment is reviewed annually, and on any material change to the instrument, the analysis or the scope.