Appendix 1. Legal advice
IN THE MATTER OF
THE SULLIVAN REVIEW
Advice
1. I have been instructed to provide written Advice in relation to an independent Review of Data, Statistics and Research and Gender (“the Review”) which is being carried out by Alice Sullivan, Professor of Sociology and Head of Research at the UCL Social Research Institute.
2. The Review examines a number of issues relating to the collection of data on sex, gender, gender reassignment, gender identity, and related matters. I understand that its purpose is to consider the impact of a move by both public bodies and private organisations, away from collecting data on sex, and instead towards collecting data that conflates sex with gender identity.
3. The Review has three main aims:
(1) To provide an overview of the current situation regarding data collection on sex and gender identity in theUK;
(2) To identify barriers to research and to make recommendations to assist universities, research
organisations and other relevant bodies in overcoming these; and
(3) To provide clear guidance to help public bodies and other data owners to collect accurate and consistent data on sex and gender identity.
The third aim is of particular relevance to this Advice.
4. This Advice is in three main sections. The first section discusses the current legal understanding of sex, gender, gender reassignment, gender identity, and related concepts. The second section discusses the main legal areas that are relevant to the subject matter of the Review, including the Equality Act 2010, the Human Rights Act 1998, the tort of misuse of private information (or “MOPI”), data protection law, and the Gender Recognition Act 2004. The third specifically addresses some of the proposed recommendations in the Review (these are also referred to at various points in the first two sections). I end with some concluding points, including as to the limitations of this Advice.
5. This Advice discusses the legal position in the UK. There are three UK jurisdictions: England and Wales; Scotland; and Northern Ireland. I refer to these separately where appropriate. Where I refer simply to the legal position in the UK, I am referring to the position across all three jurisdictions.
Section 1: current legal understanding of key concepts
6. This section discusses the current legal definition and understanding of the following concepts: sex; gender;gender reassignment; gender identity; and transgender (or trans).
Sex 1016
7. This concept is best understood historically, by reference to three successive stages of legal development.
8. First, there is the common law understanding, as set out in cases such as Corbett v Corbett [1970] 2 All ER33, R v Tan [1983] QB 1053, and Bellinger v Bellinger [2003] UKHL 21. This approach to the concept of sex has three main elements to it: (a) sex is a biological category, determined by physiological considerations, and not by an individual’s mode of living or self-perception; (b) sex is fixed at birth (at the latest), and cannot be changed by subsequent surgical or hormonal intervention; and (c) sex is binary, i.e. no sexes are recognised other than male or female. This common law understanding of sex equates with what is sometimes referred toas “biological sex”, or “natal sex”, or “sex at birth”. In this Advice I shall use the term “sex at birth”.
9. Secondly, there is the modification to the concept of sex as a result of the Gender Recognition Act 2004(“GRA 2004”), enabling individuals to apply for a gender recognition certificate (“GRC”). The effect of a GRC is that the person in question is treated for various legal purposes as having changed their sex. Hence there may now be a difference between a person’s sex at birth, and their legal sex (i.e. their sex as modified for certain legal purposes by a GRC). Note that in this Advice when I refer to “legal sex” I mean sex as modified by any GRC: I am not referring to situations where other official documents (e.g. passports) may record a sex that differs from sex at birth, even where a GRC has not been issued. I note recommendation 9, which (rightly) emphasises the need for clarity as to what is meant by any reference to “legal sex”.
10. The background to GRA 2004 was that in Goodwin v United Kingdom (2002) 35 EHRR 447, the European Court of Human Rights held that the UK was in breach of both Article 8 (respect for private life) and Article12 (right to marry) of the European Convention on Human Rights, arising from the fact that the applicant (described in the judgment as a post-operative male to female transsexual) was treated in UK law as a man. GRA 2004 was introduced to give effect to this decision. As indicated above, it modified the legal understanding of sex, by enabling those who satisfied specified conditions (set out in section 2 of that Act) to apply for a GRC.
11. The effect of a GRC is stated to be as follows (see section 9):
(1) Where a full gender recognition certificate is issued to a person, the person’s gender becomes for all
purposes the acquired gender (so that, if the acquired gender is the male gender, the person’s sex becomes that of a man and, if it is the female gender, the person’s sex becomes that of a woman).
(2) Subsection (1) does not affect things done, or events occurring, before the certificate is issued; but it does operate for the interpretation of enactments passed, and instruments and other documents made, before the certificate is issued (as well as those passed or made afterwards).
(3) Subsection (1) is subject to provision made by this Act or any other enactment or any subordinate
legislation.
Note that section 2 does not require a person to undergo any particular hormonal, surgical, or other medical treatment, as a precondition for obtaining a GRC.
12. The issuing of a GRC will not, however, alter a person’s legal sex in all circumstances. GRA 2004 itself sets out various exceptions: for instance, section 12 provides that the issue of a GRC does not affect the status of the person as the father or mother of a child. Moreover, section 9(3) provides that the effect of a GRC is subject to any provision made by other legislation. It is therefore open to the Courts to construe other legislation as having effectively excluded the effect of any GRC, so that (for the purposes of that legislation) a person’s sex is unaffected by the issuing of a GRC.
13. As set out above, GRA 2004 section 9(1) provides for the issue of a GRC in either a male or a female “acquired gender”. There is no provision for any other form of GRC (e.g. a non-binary GRC). In R (Castelucci)v Gender Recognition Panel and the Minister for Women and Equalities [2024] EWHC 54 (Admin), the Divisional Court confirmed that GRA 2004 was limited in this way, holding that an individual whose change of gender from male to non-binary had been recognised by the State of California was not entitled to be issued with a non-binary GRC in the UK 1017.
14. Thirdly, it is relevant to consider how “sex” is defined in the Equality Act 2010 (“EA 2010”), and the interaction between GRA 2004 and EA 2010.
15. The EA 2010 sets out nine “protected characteristics”, in relation to which various forms of conduct (including direct and indirect discrimination) are prohibited in specified contexts (e.g. in employment). For further details about the protected characteristics and about prohibited conduct under EA 2010, see section 2 of this Advice.
16. One of the nine protected characteristics is sex, defined as follows by EA 2010 section 11:
In relation to the protected characteristic of sex—
(a) a reference to a person who has a particular protected characteristic is a reference to a man or to a woman;
(b) a reference to persons who share a protected characteristic is a reference to persons of the same sex.
Section 212 (general interpretation) further provides that “man” means a male of any age, and “woman” means a female of any age.
17. For a person who does not have a GRC, my view is that their “sex” for the purposes of the Equality Act 2010 will be their sex at birth. This is so even if the person has the protected characteristic of “gender reassignment” under the Equality Act 2010 (as to which, see below): see R (Green) v Secretary of State for Justice [2013] EWHC 3491 (Admin), and For Women Scotland v The Lord Advocate [2022] CSIH 4, e.g. at paragraph 38, and see generally the article by Michael Foran referred to at note 1, above.
18. There is ongoing litigation as to whether a GRC has the legal effect of changing a person’s sex for the purposes of the protected characteristic in EA 2010 section 4. In For Women Scotland Limited v The Scottish Ministers [2023] CSIH 37 the Inner House of the Court of Session held that a GRC did have this effect, but the case is currently being appealed to the Supreme Court. Until the Supreme Court determines the point, there is uncertainty as to whether “sex” as a protected characteristic in EA 2010 means sex at birth, or legal sex. There is a difference between these two concepts in the case of individuals with a GRC, but (in my view) not otherwise.
Gender
19. There are three points to make in relation to this concept.
20. First, in ordinary usage, the term “gender” is used in a variety of ways. Sometimes it is used as a synonym for biological sex. Sometimes it is used to denote the social expectations that are applied to those whoare biologically male or female: “gender” in this sense is about “gender roles”, or “gender stereotypes”, or“gender norms”. Sometimes it is used to denote “gender identity”, understood as a person’s innate sense ofbeing a man, a woman, or neither: see further the discussion of this concept below. And sometimes it refers to a person’s “gender expression”: whether they dress, behave, etc., in a manner that reflects the social norms that are currently applied to the male or female sex.
21. The World Health Organisation (WHO) explains some of these different senses of “gender” on its website, as follows1018:
Gender refers to the characteristics of women, men, girls and boys that are socially constructed. This includes norms, behaviours and roles associated with being a woman, man, girl or boy, as well as relationships with each other. As a social construct, gender varies from society to society and can change over time.
Gender is hierarchical and produces inequalities that intersect with other social and economic inequalities. Genderbased discrimination intersects with other factors of discrimination, such as ethnicity, socioeconomic status, disability, age, geographic location, gender identity and sexual orientation, among others. This is referred to as intersectionality.
Gender interacts with but is different from sex, which refers to the different biological and physiological
characteristics of females, males and intersex persons, such as chromosomes, hormones and reproductive organs.
Gender and sex are related to but different from gender identity. Gender identity refers to a person’s deeply felt, internal and individual experience of gender, which may or may not correspond to the person’s physiology or designated sex at birth.
22. The different meanings of “gender”, as set out at paragraph 20 above, mean that the term risks giving rise to considerable confusion when used in a policy context or in data collection. Recommendations 18 and 38-39 (rightly) recognise this uncertainty, and the difficulties to which it could give rise.
23. Secondly, the GRA 2004 itself gives rise to further potential confusion by using the terms sex and gender interchangeably. See the wording of section 9(1) of GRA 2004, set out above. That said, it is reasonably clear that in GRA 2004 “gender” is being used simply as a synonym for “sex”.
24. Thirdly, as explained above the protected characteristic in EA 2010 is sex not gender. It is surprisingly common to see the term “gender”, rather than “sex”, in what purport to be lists of the protected characteristics (e.g. as set out by public authorities on their websites). It would be preferable to refer to “sex”, reflecting the language of EA 2010. Referring to sex, rather than gender, will assist in compliance with the Public Sector Equality Duty (discussed below).
25. It is true that at various points EA 2010 refers to “gender” instead of or as well as “sex”.
• Section 79 is headed “Gender pay gap information”. It provides that regulations may require employers to publish information relating to the pay of employees for the purpose of showing whether there are difference in the pay of male and female employees. The Equality Act 2010 (Gender Pay Gap Information) Regulations 2017 have been made under this provision.
• EA 2010 section 195 (sport) defines a category of “gender-affected activity” (see section 195(3)):
A gender-affected activity is a sport, game or other activity of a competitive nature in circumstances in which the physical strength, stamina or physique of average persons of one sex would put them at a disadvantage compared to average persons of the other sex as competitors in events involving the activity.
In both section 79 and section 195, “gender” is clearly being used as a synonym for “sex”. This does not alter the fundamental point that the protected characteristic under EA 2010 section 4 is sex, not gender.
Gender reassignment
26. Gender reassignment is one of the nine protected characteristics under the EA 2010. It is defined as follows, by section 7(1):
A person has the protected characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex.
27. A person with the protected characteristic of gender reassignment is referred to in EA 2010 as a “transsexualperson”: see section 7(2). The terms “transgender” or “trans” do not appear in EA 2010.
28. The fact that a person has the protected characteristic of gender reassignment does not in itself alter the person’s sex for the purposes of EA 2010: these are different questions (see paragraph 17 above).
29. A person who understands their gender identity1019 as being at variance with their biological sex will not necessarily have the protected characteristic of gender reassignment. Such a person may not have undergone (or be undergoing or proposing to undergo) a process as referred to in section 7(1). Similarly, a person who understands themselves to be transgender or trans will not necessarily have the protected characteristic of gender reassignment, given the breadth of the terms transgender and trans in current usage: see further the discussion at paragraphs 36-41 below.
30. There is room for some uncertainty as to whether the protected characteristic of gender reassignment covers an individual who is non-binary (i.e. who does not identity either as a man or a woman). The statutory definition refers to the reassignment of a person’s sex. Given that sex has historically been viewed in law as a binary concept 1020, the statutory wording would suggest that the concept applies to male-to-female transsexuals1021, or female-to-male transexuals, but not to non-binary individuals. The decision of the Employment Tribunal in Taylor v Jaguar (1304471/2018) has been treated by some commentators1022 as supporting the proposition that a non-binary individual can have the protected characteristic of gender reassignment. However, it is strongly arguable that the point did not arise on the specific facts of that case; and in any event an Employment Tribunal decision has no binding authority as a precedent and cannot, in itself, make new law. As matters stand, therefore, there is no authoritative legal ruling as to whether non-binary individuals can have the protected characteristic of gender reassignment. If not,then this increases the cohort of individuals who: (a) assert a gender identity that is at variance with their biological sex; but (b) fall outside the protected characteristic of gender reassignment.
Gender identity
31. Gender identity is widely deployed as a concept in discussions regarding sex and gender.
32. For instance, the widely-cited Yogyakarta Principles ( a document published following a meeting of international human rights groups in Yogyakarta, Indonesia in November 2006) define “gender identity” as follows:
Gender identity is understood to refer to each person’s deeply felt internal and individual experience of gender,which may or may not correspond with the sex assigned at birth, including the personal sense of the body (whichmay involve, if freely chosen, modification of bodily appearance or function by medical, surgical or other means) and other expressions of gender, including dress, speech and mannerisms.
33. However, the concept of gender identity does not currently feature in any statutory provision in any of the UK jurisdictions. In other words, there are no legal rights in the UK that are conferred by reference to genderidentity, and no UK statutory definition of the concept.
34. Broadly speaking, the concept is usually seen as denoting a person’s interior sense of themselves as being a man, a woman, or something else. See the WHO and Yogyakarta definitions set out above, and see also the following text from the NHS Digital website1023:
Gender identity is a way to describe a person’s innate sense of their own gender, whether male, female, or nonbinary,which may not correspond to the sex registered at birth.
35. As the Review points out, there are a range of views in relation to the concept of gender identity. There are a number of people who would not claim to have a gender identity themselves: e.g. because they reject the concept as incoherent, or because they assert that it applies in relation to some people but not to themselves, or because the concept is unfamiliar to them and not understood. Any assertion that everyone has a gender identity 1024 is therefore contentious, and carries significant legal risks in relation to compliance with the public sector equality duty, and data protection law (see discussion below): recommendation 25 (rightly) warns against making any such assumption.
Transgender or trans
36. In current discussions regarding sex and gender identity, there are frequent references to individuals as being “transgender” or “trans”. Currently, it appears to more common for individuals to self-describe using these terms, rather than to describe themselves as transsexual.
37. That said, as indicated above, EA 2010 uses the term “transsexual” to refer to a person with the protected characteristic of gender reassignment. The terms “transgender” and “trans” are not used in EA 2010.
38. I note that the Hate Crime and Public Order (Scotland) Act 2021 defines the term “transgender identity” in section 11(7) as follows:
A person is a member of a group defined by reference to transgender identity if the person is—
(a) a female-to-male transgender person,
(b) a male-to-female transgender person,
(c) a non-binary person,
(d) a person who cross-dresses,
and references to transgender identity are to be construed accordingly.
39. To illustrate the wide understanding current usage of the terms “transgender” or “trans”, the Review quotes the following definition from Stonewall:
“Trans people may describe themselves using one or more of a wide variety of terms, including (but not limited to) transgender, transsexual, gender-queer (GQ), gender-fluid, non-binary, gender-variant, crossdresser, genderless, agender, nongender, third gender, bi-gender, trans man, trans woman, trans masculine, trans feminine and neutrois.”1025
40. In the light of the broad understanding of the terms “transgender” and “trans”, it cannot safely be assumed that every person who asserts a transgender identity: (a) would have the protected characteristic of gender reassignment under EA 2010; or (b) would themselves assert that they had that protected characteristic.
41. Conversely, there may be individuals who would have the protected characteristic of gender reassignment,but who would not assert a transgender identity. One potential example is detransitioners, i.e. people who embark on a transition process but then abandon or reverse that process. There could very well be detransitioners who would not currently assert a transgender identity, but who would nevertheless have the protected characteristic of gender reassignment, on the basis that they had (at some point in the past) undergone a process falling within section 7(1) of EA 2010.
Section 2: main relevant legal provisions
(...)
HRA 1998 and and the Convention
53. Article 8 of the ECHR provides as follows:
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in
accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
54. As will be apparent, this is a qualified not an absolute right: i.e. interference with the right may nevertheless be justified, in the circumstances set out in Article 8(2). Where there is interference that is not justified under Article 8(2), then there is a violation of the right.
55. Under the Human Rights Act 1998 (“HRA 1998”), it is unlawful for a public authority to act in a way which is incompatible with a Convention right: HRA 1998 section 6(1). If a public authority interferes with the Article 8 right, and the interference cannot be justified under Article 8(2), then the public authority will be in breach of HRA 1998 section 6(1).
56. The duty under section 6(1) does not extend beyond public authorities. However, the UK courts have developed the common law so as to give effect to the values underpinning Article 8 in cases not involving public authorities: the effect of this development is that the common law now recognises a tort of misuse of private information (or “MOPI”). This tort is separately discussed below.
57. The collection and storage of information about individuals by public authorities is highly likely to engage Article 8(1) (i.e. to constitute an interference with the right to respect for private life): see e.g. Rotaru v Romania (2000) 8 BHRC 449 and R (on the application of Catt) (AP) (Respondent) v Commissioner of Policeof the Metropolis and another (Appellants) [2015] UKSC 9. It follows from this wide approach to the scope ofArticle 8(1) that the collection by a public authority of data about sex (whether by reference to sex at birth, or legal sex) is likely to engage Article 8(1). The same applies as regards the collection of data by reference to any of the other concepts discussed above, i.e. gender, gender reassignment, gender identity, or transgender/ trans status.
58. Where there is an interference with the Article 8(1) right, the question is whether the interference can be justified under Article 8(2): if it cannot, then the interference will be unlawful. This will require consideration of whether the interference is: (a) necessary for one of the matters set out in Article 8(2); (b) “in accordance with the law”; and (c) proportionate. The test of necessity is one of reasonable rather than absolute necessity. Interference will be “in accordance with the law” if (put shortly) it is governed by a sufficiently accessible and foreseeable framework of law and policy: see e.g. the summary in R (ota Bridges) v Chief Constable of South Wales Police and others [2020] EWCA Civ 1058, at paragraph 55. As to proportionality, the test is set out in Bank Mellat v HM Treasury (No 2) [2013]UKSC 39, paragraph 20, as follows:
The question depends on an exacting analysis of the factual case advanced in defence of the measure, in order to determine (i) whether its objective is sufficiently important to justify the limitation of a fundamental right; (ii) whether it is rationally connected to the objective; (iii) whether a less intrusive measure could have been used; and (iv) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. These four requirements are logically separate, but in practice they inevitably overlap because the same facts are likely to be relevant to more than one of them.
59. It follows from all of the above that there is nothing in Article 8 that imposes an absolute barrier on the collection by public authorities of data about sex, or any of the others matters discussed in section 1 above.In practice, the question will be whether such collection can be justified under Article 8(2).
60. Note for example the decision of the Supreme Court in R (C) v Secretary of State for Work and Pensions [2017] UKSC 72, which considered the policies of the Department for Work and Pensions (“DWP”) regarding the retention of, and access to, information about individuals with GRCs (including their sex at birth, the fact that they had a GRC, and the date of the GRC). Those policies were held to constitute an interference with the Article 8(1) right (see judgment, paragraph 31). However, the relevant policies were held to be justified on the basis of the requirements for administration of the benefits system, including properly calculating state pension entitlement and identifying and detecting fraud (see judgment, paragraphs 32-38).
61. In relation to justification under Article 8(2), one important consideration will be data accuracy. When data is inaccurate, and where this is because of the way in which the public authority has gone about collecting the data (e.g. by failing clearly to specific what data it is seeking to collect), then: (a) it will be difficult to establish that the collection, retention and monitoring of the data is necessary for any of the purposes specified in Article 8(2); and (b) it will likewise be difficult to satisfy the proportionality test summarised in Bank Mellat, in particular (i) the requirements that there must be a rational connection between the collection and retention of the data and the objective being pursued, and (ii) the requirement that there must be a fair balance between individual rights and community interests.
62. In relation to proportionality more generally, I would make the following points.
(1) The points made below apply in particular to the collection of data about the sex of individuals who assert a transgender identity, or who have the protected characteristic of gender reassignment (including, but not confined to, individuals with a GRC). For individuals who do not assert a transgender identity and do not have the protected characteristic of gender reassignment, the collection of data about sex is likely to be much easier to justify.
(2) These points apply in particular as regards data about sex at birth, or about the fact that an individual has a GRC (thereby revealing that there is a difference between the individual’s legal sex and their sex at birth). As to GRC status, see also the provisions of GRA 2004 section 22 (discussed below).
(3) There is an important difference between questions that seek to elicit the simple fact of someone’s sex at birth or GRC status, and questions that seek to elicit further details (such as whether a person has had specific hormonal or surgical treatment). The latter will be considerably harder to justify.
(4) A question that gives individuals the option of withholding information (e.g. by way of a “prefer not to say” option) will be easier to justify than a question that gives no such option.
(5) Where (a) there is no option to withhold information, and (b) the information must be provided as a
precondition for obtaining a benefit (e.g. employment, or a service) or for avoiding some legal liability, then the threshold for justification will be particularly high.
(6) It is considerably easier to justify collecting data in circumstances where the data will not be used to make decisions about individuals (as will usually be the case where data is collected for research purposes).
(7) The more widely data is to be disseminated (in a form that allows individual identification), the harder it is likely to be to justify the collection of that data.
(8) It will be particularly difficult to justify the collection of data where the intention is to make that data public.
(9) In considering whether the proportionality test is met (particularly in relation to the dissemination of data, or making data public) it is important to take into account any impact on third parties. In particular, it is important to consider whether third parties have an interest in knowing the sex of a particular individual (e.g. where the third parties are receiving intimate care or medical treatment from that individual).
Data protection law
71. Data protection law (as set out in the UK GDPR and in DPA 2018) does not prohibit the collection of data about either sex at birth or legal sex. However, it imposes various requirements that need to be satisfied if such data is to be lawfully collected and used. Those requirements go beyond those imposed by Article 8 of the ECHR.
72. Data protection law imposes various obligations on controllers (persons or bodies who determine the
purposes and means of the processing of personal data). Personal data, put shortly, means informationrelating to an identified or identifiable natural person: and information about an identified or identifiable person’s sex (whether sex at birth or legal sex) would be personal data about that individual. Note that in order to be personal data, information does not need to be private or confidential: the scope of the concept is therefore very wide.
73. The obligations imposed by data protection law relate to the processing of personal data: again, this is a wide concept, extending (among other matters) to the collection, retention, and use of personal data.
74. Controllers must comply with various principles set out in UK GDPR Article 5(1) in relation to their processing of personal data. For instance, processing must be lawful, fair and transparent (Article 5(1)(a)); and every reasonable step must be taken to rectify data inaccuracy (Article 5(1)(d)). The processing of personal data must, in every case, satisfy one of the conditions in Article 6(1). The processing of “special category data”(defined in Article 9(1)) must, in addition, satisfy one of the conditions in Article 9(2). The provisions of Article 9(2) are complex, as they need to be read in conjunction with DPA 2018, which sets out in more detail the circumstances in which there will be compliance with the Article 9(2) conditions: see in particular DPA 2018 section 10 and Schedule 1.
75. Many of the conditions in Article 6 and 9 depend on the processing of data being “necessary” for various specific matters. It is well-settled that this imports a proportionality test comparable to that discussed abovein relation to Article 8 of the Convention. Controllers (whether public or private sector) will therefore have to engage with considerations of proportionality – taking account of the matters discussed above in the context of Article 8 – when determining whether processing of personal data is necessary for one of the matters set out in Article 6 or Article 9.
76. Will data about sex constitute special category personal data? This is defined by Article 9(1) as: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation
77. As will be apparent, data relating to sex is not in itself categorised as special category data. However, such data might be special category data if it revealed one of the matters referred to in Article 9(1). For instance, if a dataset included the information that Bob’s sex is male, and that Bob’s partner’s sex is also male, then these two items of information (taken together) disclose Bob’s sexual orientation, and constitute special category data.
78. Does information about a person’s transgender status constitute special category information about that person? Usually the answer to this question will be yes, and it is advisable for controllers to proceed on this basis. This question requires separate consideration in relation to the information that: (a) a person has a GRC; (b) a person has the protected characteristic of gender reassignment; and (c) a person asserts a transgender identity.
79. The information that a person has a UK GRC will almost certainly constitute information about that person’s health, and hence will constitute special category data on that basis. This is because one of the conditions for the grant of such a certificate is that the person has or has had gender dysphoria: see GRA 2004 section 2(1)(a). Gender dysphoria is currently defined in the Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition, Text Revision (DSM-5-TR) (American Psychiatric Association 2022)1026. The information that a person has or has had gender dysphoria would in my view constitute information concerning that person’s health, for the purposes of UK GDPR Article 9(1).
80. There is a theoretical possibility that a person might have been granted a GRC on the basis of a foreign certificate not dependent on such a diagnosis (by way of section 1(1)(b) of GRA 2004). However, I would expect such cases to be rare (and non-existent from 20241027). For practical purposes, the information that a person has a UK GRC (or information that makes clear that this is the case) should in my view be regarded as special category data.
81. It is more questionable whether the information that a person has the protected characteristic of gender reassignment, or asserts a transgender identity, is special category data. That said, I note that the International Classification of Diseases Eleventh Revision (ICD-11) (World Health Organization, 2022) uses the term “gender incongruence” to describe “a marked and persistent incongruence between an individual’s experienced gender and the assigned sex”. This condition has been moved out of the “Mental and behavioural disorders” chapter and into the “Conditions related to sexual health” chapter so that it isnot perceived as a mental health disorder. Nevertheless, the information that a person satisfies the ICD-11definition of gender incongruence would in my view constitute information about their health. Further, it seems to me very likely that a person who has the protected characteristic of gender reassignment, or who asserts a transgender identity, would satisfy the definition of “gender incongruence”1028; hence the prudent course for a controller is to treat this information as being information about health, and therefore special category data.
82. Where information is special category personal data, the threshold for processing it is higher than in relation to ordinary personal data. For special category data, a condition in UK GDPR Article 9(2) needs to be satisfied,in addition to the conditions in Article 6(1). Article 9(2) cannot be read in isolation, but needs to be considered in conjunction with the relevant provisions of DPA 2018: see in particular section 10 of, and Schedule 1 to,DPA 2018. The conditions in Article 9(2) that are most likely to be relevant for information relating to gender reassignment or transgender identity are these:
(g) processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall beproportionate to the aim pursued and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
(i) processing is necessary for reasons of public interest in the area of public health, such as protecting againstserious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of domestic law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research
purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) based on domestic law which shall be proportionate to the aim pursued and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
83. Processing based on limb (g) will need to satisfy a condition in Part 2 of Schedule 1 to DPA 2018.
• One of these conditions is satisfied where (put shortly) processing is necessary for the exercise of a function conferred on a person by an enactment or rule of law or for various governmental purposes, but
only where the processing is in the substantial public interest: Schedule 1, Part 2, paragraph 6.
• There is also a provision allowing the processing of specified categories of personal data, where the processing is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category
with a view to enabling such equality to be promoted or maintained: Schedule 1, Part 2, paragraph 7. This paragraph provides a basis for data concerning health to be processed in relation to equality of opportunity or treatment between people with different states of physical or mental health; and for personal data concerning an individual’s sexual orientation to be processed in relation to equality of opportunity or treatment between people of different sexual orientations.
84. Processing based on limb (h), (i) or (j) will need to satisfy a condition in DPA 2018 Schedule 1 Part 1. These conditions include that the processing is necessary for certain specified health or social care purposes (Schedule 1, Part 1, paragraph 2). There is also a condition in relation to research (Schedule 1, Part 1, paragraph 4), as follows:
This condition is met if the processing—
(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,
(b) is carried out in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19), and
(c) is in the public interest.
Article 89(1) and section 19, read together, impose two main requirements. First, the processing must not belikely to cause substantial damage or substantial distress to a data subject. Secondly, the processing must notbe carried out for the purposes of measures or decisions with respect to a particular data subject, unless thepurposes for which the processing is necessary include the purposes of approved medical research (defined by DPA 2018 section 19(4)).
(...)
Section 3: proposed recommendations in the Review
117. I have reviewed the 59 proposed recommendations in the Review. The recommendations are, in my view, consistent with the legal analysis set out above. I have referred to some of the individual recommendations inthe discussion above. I add some general comments. I have also referred to instances where failing to follow one of the recommendations could be unlawful.
118. The recommendations reflect the importance of: (a) being clear in every case about what data is being sought, and why it is being sought; and (b) being careful, when devising questions, to ensure that those questions appropriately target the data that is being sought. Leaving aside their obvious practical importance, these are key considerations when ensuring compliance with data protection law and with the other legal regimes discussed above. These practical concerns are reflected all through the recommendations in the Review: see e.g. recommendations 3, 8, 9, 16, 17, and 24-37.
119. The recommendations reflect the concerns expressed above about the ambiguities associated with the term “gender” (see recommendation 18) and about the need to avoid conflating sex and gender identity (recommendation 17). These are important points, both in relation to ensuring compliance with the PSED, and more generally in ensuring that data collection complies with human rights and data protection considerations.
120. Recommendation 6 indicates that there may be cases where omitting or discouraging the option of nonresponse might be appropriate. Rightly, the recommendation recognises that this approach would require careful and case-specific justification: in this regard, see the discussion above about proportionality under Article 8 of the Convention. Particular care needs to be taken in circumstances where a refusal to answer has specific adverse consequences for an individual (e.g. by making it impossible for them to obtain a benefit or a service); this could result in unlawful sex or belief discrimination.
Conclusion
121. This Advice discusses the relevant legal framework, and considers the propos in the Review by reference to that framework.
122. Both the relevant legal framework, and the proposed recommendations, are highly fact-sensitive and will need to be applied in a wide range of different situations. This Advice is not intended to address whether the practices adopted by specific organisations or persons regarding the collection of data about sex and gender, and related issues, are legally compliant, and it should not be relied upon for that purpose. In case of doubt, organisations and individuals will need to seek legal advice that is tailored to their own factual circumstances.
11KBW
28th August 2024
