Why Monitoring Cultural Diversity in Your European Workforce Is Not at Odds with the GDPR

In a guest blog for the Future of Privacy Forum, Morrison Foerster’s Lokke Moerel dispels the myth that the EU General Data Protection Regulation (GDPR) prohibits organizations from collecting racial and ethnic background data in respect of their European workforce for the purposes of monitoring workplace discrimination and promoting equal opportunity.

Included at the end of the blog are country reports with a summary of the legal basis available for processing DEI data under the laws of France, Germany, Italy, Spain and The Netherlands.

For historic reasons, the collection of racial and ethnicity data is often considered very sensitive in many EU Member States, where there is an underlying assumption that collecting and processing such data increases the risk of discrimination. In this blog, Lokke shows that it is actually the other way around. Where discrimination, lack of equal opportunity, or pay inequity at the workplace is pervasive, monitoring of diversity, equity, and inclusion (DEI) data is a prerequisite for employers to be able to combat unlawful discrimination, comply with employee equality and anti-discrimination laws, and to defend themselves appropriately against any claims.

Where racial or ethnic background are ‘visible’―as a matter of fact or perception―to recruiters and managers alike, individuals from minority groups may be discriminated against without recording any data. It is therefore only by recording the data that potential existing discrimination may be revealed, and bias can be eliminated from existing practices.

The EU legal framework

In general, no Member State imposes an absolute prohibition on collecting racial and ethnic background data, though local nuances must be respected (in France, for example, data collection should be framed around objective criteria relating to geographical and/or cultural origins rather than notions of “race” or “ethnicity”). In the absence of specific prohibitions, processing of racial and ethnic data is governed by the GDPR, which provides a special regime for processing “special categories of data” such as data revealing racial or ethnic origin. This regime provides EU Member States with ample discretionary powers to legislate for specific legal bases to process DEI data for workplace discrimination and equal opportunity monitoring purposes. Where most Member States have not utilized this opportunity, collection of DEI data for monitoring can take place on a voluntary basis, using the general exception of explicit consent under the GDPR.

Both human rights frameworks and the GDPR itself facilitate such monitoring, provided it takes place through self-identification and there are safeguards to protect against abuse of the relevant data in accordance with data minimization and privacy-by-design requirements.

From 2024 onwards, large companies in the EU will be subject to mandatory disclosure requirements for compliance with environmental, social, and governance (ESG) standards under the upcoming EU Corporate Sustainability Reporting Directive (CSRD). The CSRD requires companies to report actual or potential adverse impacts on their workforce with regard to equal treatment and opportunities. Those impacts are difficult to ascertain or measure without collecting and monitoring DEI data.

The blog includes country reports on the conditions for processing racial and ethnic background data (or the equivalent) under the laws of France, Germany, Italy, Spain, and The Netherlands.

The article and country reports have been translated into other languages. Click on the language link for translations of the article and country reports in French, German, Italian, Spanish and Dutch.

To learn more, listen to our recent podcast, where Lokke Moerel discusses the importance, benefits and challenges of collecting and disclosing corporate data on diversity, equity and inclusion (DEI) and how to carry this out in compliance with GDPR.