Abstract
This article considers the provisions of the EU's proposed pay transparency Directive and comments upon their potential for uncovering and rectifying pay imbalances. We note the necessity of pay transparency measures, for full realisation of the right to equal pay for equal work or work of equal value, given that information access inequality is usually present between employee and employer. Whilst many of the innovations in the proposed provisions are commendable and desirable, we see several obstacles to success in the drafting of the proposed articles. Specifically, regarding the most important transparency provisions—the requirement to report on gender pay gaps, and the right to request and receive comparator pay data—the ease with which concerns over a potential clash with data protection obligations has been dismissed is concerning. In light of the jurisprudence of the Court of Justice of the European Union on data protection obligations, and the fallibility of data anonymisation techniques, we predict a tension between these two sets of provisions that has not been entirely precluded by the drafting of the new pay transparency directive.
Introduction
In March 2021, the EU Commission announced a proposal for a new Directive aimed at tackling pay inequality between women and men through increasing pay transparency. 1 The proposal was a priority for President von der Leyen, who is (rightly) of the opinion that pay transparency is a major ingredient in pay equality. 2 Alongside other measures, the proposal would introduce a right for a) prospective employees to have access to information relating to pay from a company they are applying to, and b) current employees to have access to the pay data of those doing ‘equal work’ to them. The proposal, which is not the only recent advancement in relation to equality in EU labour law, 3 was a reaction to the Council calling for greater attention to labour equality, and for Member States to take ‘measures to combat pay discrimination, including by promoting pay transparency’. 4
The importance of pay transparency for the realisation of the legal right to equal pay for equal work cannot be understated. When introducing a new Bill on pay transparency in the UK, Stella Creasy MP summarised the importance perfectly: ‘unless a woman knows that a man who is doing equal work to her is being paid more, she cannot know whether she is being paid equally.’ 5 Pay transparency could make the difference between an individual who is the victim of pay discrimination deciding to pursue equal pay litigation or not. The enforcement of the right to equal pay should not be de facto contingent on informal conversations between colleagues, or on individuals taking the uncomfortable and risky step of initiating conversations with their employers about potential pay discrimination, or even starting equal pay proceedings in order to gain access to the necessary information. Pay transparency therefore goes some way to equalising the burden of the enforcement of equal pay between employers and employees, and towards de-stigmatising conversations about pay in the workplace. Moreover, as noted by the Commission in its proposal for the Directive, pay transparency fuels the success of the principle of equal pay by providing those who do go on to litigation a) with the information necessary to evidence their claim against their employer, and b) with the potential to identify an effected group to which they belong, thus strengthening their litigation position. 6 The importance of pay transparency specifically at the EU level is noted by the Commission. Improving equality of pay is an important goal of the Union set out in Article 157 TFEU, noting that the Union should uphold ‘equal opportunities and equal treatment of women and men in matters of employment and occupation, including the principle of equal pay for equal work or work of equal value.’ 7 Moreover, the Union's added value in this area, above what can be achieved at the national level, is that harmonised system of equal protection prevents the temptation for a ‘race to the bottom’ to capitalise on the higher costs borne by other actors. 8
We have already considered the importance, advantages, and pitfalls of proposed pay transparency measures regarding the ‘Right to Know’ a comparator’s pay in the context of UK law. 9 In the UK context, we highlighted the potential for the ‘Right to Know’ to achieve what the general freedom of information framework could not: access to comparator data for public and private sector employees, without the need for a disclosure order. However, we also noted the tension that would then arise between the proposed ‘Right to Know’ and data protection law, a tension that has long stood between the data protection and freedom of information frameworks. The aim of this article is to achieve the same with regards to the EU level proposals, and to situate the importance of pay transparency measures into the broader framework of EU law, whilst also noting the ‘danger zone’ of a conflict with data protection law, particularly given EU activity in this area. Thus far, data protection obligations have been a blind spot in the literature on pay transparency measures, something that this article will rectify for the new EU provisions. We consider why pay transparency obligations are an important tool for achieving pay parity, not only through increased public scrutiny, but also through the enforcement of the legal principle of equal pay in litigation. In doing so, we are able to determine the added value of transparency measures and easier access to information in the specific pay equality context, and why such measures are a necessary step beyond the general freedom of information framework. More importantly, we also consider the potential for pay transparency obligations to be evaded by employers relying on their relatively strong data protection obligations, and the impact that data protection law may have on the utility of increased pay transparency for those wishing to enforce their right to equal pay. To be clear, we do not see data protection law as rendering the use of pay transparency measures ineffective, but rather something to be considered in detail during the drafting and introduction of provisions for greater pay transparency.
Our article is structured as follows. First, we explain and analyse the key provisions of the new equal pay directive and their potential to equalise pay or aid litigation around pay disparity. Secondly, we consider the potential obstacles to the effectiveness of the new measures. Finally, we consider the possibility of data protection law presenting an obstacle to the release of employee information, and whether the proposal for data to be anonymised goes far enough to prevent such a tactic of legal deflection.
The pay transparency Directive: importance and potential
The importance of pay transparency measures in the EU
Measures aimed at increasing the transparency of pay structures ultimately have the goal of equalising access to information between the employer and employee, 10 so that the latter may recognise and tackle pay discrimination that would otherwise go unnoticed or unchallenged. 11 As noted by the Commission's impact assessment for the proposed Directive, wage discrimination is a direct result of employees not understanding how their work is valued, and thus not noticing wage disparities. Whilst this may not always be a conscious choice of the employer, the discriminatory outcome persists when information is not made available to employees, either due to lack of data collection, or unwillingness to share (from the employer) or ask (from the employee). 12 Discrimination and pay secrecy are therefore entangled issues, which are bolstered by social stigmas around wage discussions, 13 fears of victimisation, 14 or internalised gender biases in the perception and valuing of work both from the employer and employee. 15 Greater transparency in wage setting would therefore (hopefully) reduce the stigma around conversations relating to wages, reduce the possibility of backlashes from employers, and allow for a better understanding of the valuing of work that can lead to more egalitarian expectations around wages for employees. 16
Increased access to pay information is particularly important when equal pay law is implemented in a manner that puts a heavy burden on the claimant to evidence their suffering of pay disparity with regards to an actual comparator.
17
The significance of information parity is heightened when one considers the obstacle that information asymmetry presents for realising the right to equal pay for work of equal value, as noted by Ceballos et al: ‘Without transparent wage information, it might be realistic for a worker to realize her pay is unjust relative to her co-workers in the same position (i.e., equal pay for equal work), but it is significantly more difficult for a worker to realize she is not paid fairly relative to a worker in a different role who she probably has little contact with (i.e., equal pay for work of equal value).’
18
At present, the gender pay gap in the EU is around 13%, 23 with indications that pay discrimination is a key contributor to the gap, 24 and that any portions of the gap that cannot be justifiably explained are not going to reduce without some intervention. 25 A reduction in discrimination, either by enlightening responsive employers to discriminatory policies, or by supporting equal pay litigants with necessary information, is a potential important outcome of greater pay transparency. The Commission's study on the statistics of gender discrimination and the gender pay gap illuminate that discrimination constitutes an unexplained portion of the gap, 26 so it is difficult to know the exact percentage that could be affected by measures aimed at supporting the enforcement of equal pay. In the absence of adequate data on pay discrimination at the employer level, it is difficult to see exactly how much of the gender pay gap is attributable to discriminatory practices. This is not to suggest that pay transparency may be a futile exercise, but rather that transparency (and the greater enforcement of the right to equal pay that comes with it) is also an important step towards understanding the gender pay gap, 27 as well as a measure to close it.
Pay transparency is not a panacea for pay equality law, as pay secrecy and inequality of access to information is but one contributing factor to the gender pay gap across jurisdictions, 28 and pay transparency measures are just one policy area that can seek to reduce the gap. 29 A more realistic assessment is that ‘pay transparency is legislated with the intention that it should reduce the gender pay gap to levels below that which would be achieved without the legislation.’ 30 The following analysis breaks down some of the pay transparency measures contained in the new Directive, and considers the extent of their potential to reduce gender pay discrimination.
Key Features of the pay transparency Directive and their potential
The new Directive does not just introduce measures regarding pay transparency, but also to clarify the right to equal pay, and ensure better access to justice for pay discrimination victims. 31 However, the focus of this article is on the first two types of provisions: those aimed at increasing pay transparency, and those aimed at clarifying the right to equal pay. These are the measures aimed at increasing access to information for those who may be the victim of pay disparity.
Rights of prospective employees
Article 5 of the pay transparency Directive determines that employers will have to provide, without being requested and apparently before any job interview, information regarding the pay level or pay range of the role advertised, in a way that ensures ‘an informed and transparent negotiation on pay’. 32 The fulfilment of this requirement seems rather flexible, as the employer can opt to include the information in the job advertisement or in any other way. The benefit of this provision is twofold. Firstly, it could remove the potential for pay discrimination before it can arise, as it evens the position of the prospective employee and potential employer in the wage negotiating process, and evens the negotiating position of women and men candidates. 33 Furthermore, it is arguably easier for someone to negotiate firmly prior to the start of an employment relationship than once it is established and social pressures and boundaries affect their negotiating position. Knowledge as to the potential wage level or range helps an individual to enter an interview or role with a firmer idea of their negotiation position. Secondly, if a candidate has a history of their work being undervalued, it is valuable for them to be provided with a clear expectation of pay that is more likely to reflect market averages than wage-setting based upon potential gender biases, which they may have become accustomed to. One could even argue that the practice of offering clear, objective (gender-neutral) pay expectations can lead to greater pay fairness. 34 For instance, even if a woman candidate is not successful at the job interview stage, access to more transparent pay expectations can place her in a better position to negotiate with her existing employer, if it becomes obvious that her work has been undervalued. However, it is accepted here that this would be an unintended consequence and that this is not a guaranteed success route; the measures aimed at tackling pay discrimination in a person's current employment relationship should prove much more fruitful for their enforcement of pay parity in this regard if they are underpaid due to discriminatory pay practices.
In an additional innovation, Article 5 also prohibits employers from asking applicants about their current pay and pay history during the job application process. This is noted as a ‘simple but crucial’ provision, 35 that prevents these questions from continuing a cycle of underpaying and devaluing of women, where potential gender biases have impacted their previous earning abilities. 36 We would agree with the assertion of the crucial nature of the ban on previous and current salary enquiries, and consider it a welcome change that employers must instead research and match competitive salary rates for their advertised roles, giving all candidates a better understanding as to the actual value of their work.
Rights of current employees
The Directive introduces two measures placing obligations on employers in relation to their current employees. First, Article 6 obliges employers to make the objective and gender-neutral criteria used to determine pay, pay levels, and pay progression, available to employees. 37 This is again another important tool for setting expectations around pay for women, and particularly around setting expectations around career progression with transparent information. The rights of current employees are further extended, as Article 7 provides the ‘Right to Information’, namely, the right to request and receive ‘information on their individual pay level and the average pay levels, broken down by sex, for categories of workers doing the same work or work of equal value to theirs.’ 38
Article 7 would significantly reduce pay secrecy and allow an employee to compare their pay level with that of their colleagues, who may be suitable comparators for the determination of whether they have been the subject of pay discrimination. The Directive obliges employers to remind employees of this right (and how they can use it) 39 on an annual basis, 40 which is a good innovation in the drafting of the Directive as it will also ensure that employees are made aware (or reminded) of their right to equal pay. 41 The wording has a particularly desirable effect of placing the burden on employers to analyse the comparators doing equal work for equal value and provide their pay levels, something that individual employees may struggle to do. Whilst employees may be aware that they should be paid equally to those doing exactly the same work as them, 42 they may not realise the scope of their potential comparators, and would otherwise miss drawing comparisons with those doing work of equal value.
Two other inclusions in the wording are important tools for allowing the right to request to be realised in practice. A particularly important inclusion is that employees do not have to make the request themselves, but are allowed to do so via their representatives or an equality body, 43 which would hopefully lessen any anxieties about victimisation resulting from a request for pay data. Moreover, the Article sets out that ‘workers shall not be prevented from disclosing their pay for the purpose of enforcing the principle of equal pay between men and women for equal work or work of equal value.’ 44 This is similar to s.77 of the Equality Act in the UK, which renders restrictions on pay disclosure unenforceable where the disclosure is aimed at determining if there is some pay disparity regarding a protected characteristic. 45 The inclusion of this demonstrates the Directive not only aims at greater pay transparency for the enforcement of equal pay, but also to deconstruct some of the culture around pay secrecy in employment relationships that enables pay inequality. In practice, this inclusion will be particularly important for when an individual who has received pay information via the right to request it wishes to verify aspects of the information received.
Reporting obligations
Articles 8 and 9 create obligations regarding the gender pay gap reporting of employers. Article 8 sets out that: ‘1. Employers shall provide the following information concerning their organisation, in accordance with this article:
(a) the gender pay gap;
(b) the pay gap in complementary or variable components;
(c) the median gender pay gap;
(d) the median gender pay gap in complementary or variable components;
(e) the proportion of female and male workers receiving complementary or variable components;
(f) the proportion of female and male workers in each quartile pay band;
(g) the gender pay gap between workers by categories of workers broken down by ordinary basic salary and complementary or variable components.’ 46
The accuracy of this information must be confirmed by the firm's management, 47 and an annual report on factors from (a) to (f) must be given to and published by a monitoring body 48 designated by the Member State. 49 Data collected under Article 8(1)(g) must be reported internally in each company, 50 albeit with no mention of how frequently this should be conducted. 51 Whilst there are limited prospects for public reporting duties to aid the evidencing of an individual equal pay claim, 52 the obligation to publicly report on the internal gender pay gap can make a difference to the level of discrimination in a firm. There may be some indirect impact on a firm's gender pay gap, 53 either through the public reporting highlighting discrepancies to employees who then go on to enforce their right to equal pay, or because the employer considers their own statistics and is proactive in rectifying any discriminatory pay practices. 54 There is also the advantage that women can avoid employers that have a high gender pay gap, when they have access to that information whilst job searching. 55 Also, the obligation to have this information (especially for internal data collection) reduces the capacity of employers to rely on the cost and administrative burden of data collection as a reason for their inaction on pay discrimination. 56 This is particularly important in light of the technological advancements and availability of data management and analysis tools that can be at the disposal of employers. 57
The effectiveness of the reporting obligations for lowering the gender pay gap in individual firms is bolstered by the requirement to conduct joint pay assessments, set out in Article 9. Employers covered by Article 8 are required to conduct a joint pay assessment with workers’ representatives, when their internal pay reporting highlights a pay difference of 5% or higher in any category of workers that cannot be explained by objective and gender-neutral factors, 58 and this has not been remedied within six months of publication of their pay report. 59 These pay assessments must include ‘information on average female and male workers’ pay levels and complementary or variable components for each category of workers’ 60 and thus require employers to investigate even further than their internally-reported data. 61 Employers must take steps to address differences that cannot be explained by objective and gender-neutral factors, 62 and must report on the effectiveness of those measures in any future joint-pay assessments. 63 The potential to enforce a reaction to pay reporting is useful, as systems implementing public reporting obligations without any enforcement mechanisms have been criticised for their limited utility, 64 such as those in the UK 65 and Austria. 66
Measures aimed at clarifying equal value law
An interesting inclusion in the new Directive is aimed at enforcing the interpretation of equal work for equal value, a notoriously nebulous concept that is difficult to concretely define. 67 It is no surprise that it has been argued that it is difficult for both employers and employees to determine whether a particular pay (or occupational) structure is lawful prior to litigation on the matter. The broader equal pay comparisons become, so that they are capable of challenging pay disparities beyond direct inequalities between two persons doing the same role, the more difficult it is to assume that employers and employees will spot discriminatory practices. Article 4 seeks to overcome this by reiterating the need for Member States to ensure ‘that analytical tools or methodologies are made available and are easily accessible to support and guide the assessment and comparison of the value of work in line with the criteria set out in this Article. These tools or methodologies shall allow employers and/or social partners to easily establish and use gender-neutral job evaluation and classification systems that exclude any pay discrimination on grounds of sex.’ 68 Article 4(3) sets out how these considerations should not be based on factors relating to sex, by reiterating that equal work of equal value should be based on ‘educational, professional and training requirements, skills, effort and responsibility, work undertaken and the nature of the tasks involved.’ The benefit of having these criteria known at the national level is twofold: it could increase employer and employee awareness about the breadth of the right to equal pay, and thus also the visibility and understanding of equal work for equal value; in turn, it also allows employees to more thoroughly understand and assess their comparator pools for determining if they have been subject to pay discrimination.
Limits to the effectiveness of the Directive
Wage equality as individual responsibility
Whilst we would agree that pay transparency measures are important tools for equalising access to information and facilitating the deconstruction of social barriers to pay discussions, they are not a panacea against wage secrecy or pay discrimination. One thing which must be noted is that pay transparency is aimed at empowering women to enforce their right to equal pay through litigation or via wage negotiation (especially with measures aimed at wage transparency pre-employment). Whilst making negotiation and enforcement more possible, this still places a large burden on women to take the initiative to utilise the pay information in a particular manner, which may be more difficult in practice than in theory. The requirement for employers to take measures if their internal reporting highlights a particular gender pay gap is a good fall-back option, depending on how broad ‘objective and gender-neutral’ reasons for any gender pay gap can be interpreted by them. One way that the Directive could work to place a lower burden on women is to give them a right to receive information rather than a right to request it, putting the onus on employers to provide this information automatically. This would be more costly and burdensome for the employer, but should this be taken as a reason for not wording the Directive to create a right to receive, that would indicate that the Directive inherently relies on a percentage of women not utilising their rights when it is framed as a right of request and receive.
Difficulty in implementing Article 4
Even with transparency provisions, it may be difficult for an employer or an employee to know that there is some disparity in pay for those doing work of equal value, because of the highly subjective nature of this concept. Even with some guidance on how work of equal value should be assessed; there may be some difficulties in applying the concept in practice. 69 Even the use of job evaluation schemes may be imperfect. When the concept of equal pay first emerged in UK law, equal pay enforcement through job evaluation schemes was heavily criticised because schemes may be influenced by subconscious biases regarding the valuing of typical ‘women's’ and ‘men's’ work. 70 Whilst the former may partially be rectified by the Directive encouraging these tools to ensure respect for the concept of equal pay for work of equal value, 71 the issue of bias in job evaluation schemes may remain. Although there is not much more that can be done to clarify and enforce the principle, beyond what the Directive already does by setting out the criteria for assessment, it may remain the case that the classification of some roles (or the legality of that classification) for the purposes of equal pay will remain unclear until litigation occurs.
Size limits for obligations in Articles 8 and 9
Annual reporting obligations in Articles 8 and 9 will only apply to employers with 250+ employees, which seems relatively high in comparison to some national provisions, and is coincidentally the threshold currently set in UK pay reporting obligations that has come under fire for being too high. 72 A threshold that is too high naturally reduces the practical impact of pay transparency measures. 73
After the political agreement reached between the EU Parliament and Council, 74 employers with between 150 and 249, and 100 to 149 employees will also be required to report, but only every three years, 75 which significantly limits the effectiveness of the provision. These are still high thresholds compared to those enacted in other jurisdictions, 76 and to those suggested by the Committee on Employment and Social Affairs and the Committee on Women's Rights and Gender Equality. 77 This not only significantly limits the impact of the publishing obligation; it further privileges women working in large firms who are more likely to benefit from mass litigation, 78 leaving behind those in smaller working environments who might need more support in reality.
An oversight in Article 5
Another innovation could have been added to Article 5 of the Directive, in the form of a prohibition against employers asking for a job applicant's salary expectations. Whilst such conversations could be viewed as an important step in the negotiation process, it is likely that women will have a skewed idea of the value of their work at this stage, being more likely to have been underpaid in previous roles. Thus, they may tend towards expecting the lower salary range available to them. The provision of salary information upfront combats this slightly, but not if the employer advertises a role with a broad salary range. In such instances, the employer should either be prohibited from asking salary expectations, or should be required to provide criteria expected to be met for different salary points, so that applicants have a better understanding of the value of their experience.
The scope of Article 7
Most of our concerns about the Directive revolve around the implementation of Article 7, which gives employees the right to information ‘on their individual pay level and on the average pay levels, broken down by sex, for categories of workers doing the same work or work of equal value.’ 79 There are two major concerns with this. The first is that there is no specific expression of what employers must give as a response, or how much detail they must provide. This leads to fears of a watering down of the obligation by employers giving incomplete or vague information. 80 Such a fear is not unwarranted. To use an example from UK litigation, during the large supermarket claims for equal work of equal value, Tesco was asked to provide information to female store workers. The company provided some information, 81 but not everything necessary for the equal pay claim, the rest having to be obtained through a lengthy proceeding for a disclosure order. 82 This example is not given to challenge the utility of Article 7. The wording of the provision would avoid too much cherry-picking from employers deciding what information to give, as there is some clarity about what should be provided. However, the litigation shows that companies might attempt to give incomplete or vague information until pushed to give more. The political agreement between the EU Parliament and Council has luckily rectified this, with the inclusion of a provision that allows requests for (and the right to receive) clarifications on any vague or incomplete data. 83 Aside from putting in an obligation for the employer to provide absolutely accurate and comprehensive information in the first instance, which would raise questions of interpretation, we do not see a better course of action that can be taken. The drafting of the ‘Right to Know’ in the UK dealt with the matter a little differently, and would have made the employer liable for any costs for a disclosure order necessitated by their inaccurate or vague information; 84 but this also required individuals to start equal pay proceedings (perhaps before they felt ready) and would put them on track for a lengthy process of gaining an order. Thus, the additional right drafted into the Directive seems a reasonable reaction to the concern about scope and substance, which will hopefully become clearer once the Directive comes into force.
The second concern is that Article 7 grants the right to know the pay level of comparators, which includes ‘gross annual pay and the corresponding gross hourly pay’ 85 and does include the broader concept of pay. The right to information only extends to basic pay and not the inclusion of other pay-related factors like bonuses, which may allow more convert forms of prohibited pay discrimination to remain hidden. 86 When a similar right to know was drafted in the UK context, the right extended to bonuses, overtime pay, and performance-related payments as well as basic pay, 87 which would have been a welcomed addition to the EU-level Directive, especially as the Treaty and the case law of the CJEU emphasise that equal pay is not just about equalising basic pay, but also additional benefits and bonuses received from the employer. 88 This may be compensated slightly by the internal reporting requirements, which require the employer to provide information on ‘the pay gap between female and male workers by categories of workers broken down by ordinary basic salary and complementary or variable components.’ 89 Yet, there is uncertainty as to how often the employer has to provide this information. 90 It would have been slightly stronger to provide access to the information via the right to request in Article 7, something which does not seem to have been picked up during the scrutiny process.
Another issue was that the original draft of Article 7 did not provide a period for the employer to respond to requests for information. 91 Due to the political agreement reached between the Parliament and Council, the text now includes a two-month time limit. 92 This is particularly important as requests for pay data may induce anxiety about potential victimisation for the employee, so the time they are made to wait for a response should be minimised. In light of this, a two-month limit may seem a little too long, especially as this is in contrast to other areas of law which provide rights of access to information, such as freedom of information law, where in some jurisdictions, requests must be responded to within 20 working days. 93
Data protection concerns
Finally, a more complicated concern around Article 7 will be the relationship between requests made under this provision and the employer's data protection obligations under the EU General Data Protection Regulation (GDPR). 94 During the stakeholder assessments for the proposed Directive, employers did raise concerns about the potential data protection impacts of the new transparency measures. 95 In this regard, there appear to be two general ways through which Article 7 may have the potential to generate data protection-related problems.
First, and perhaps most obviously, disclosure of an employer's salary information may lead to privacy-related harm for individuals who are identified as a result of such a disclosure. Second, the right to information as set out in Article 7 may clash with pre-existing data protection rules set out in the General Data Protection Regulation (GDPR). On this point, it should be noted that under the GDPR the processing (i.e., almost any imaginable use) of personal data (i.e., any information relating to an identified or identifiable individual), including the disclosure of personal data, is subject to an extensive suite of legal rules and restrictions. The existence of such rules may therefore clash with an employer's prospective obligations under Article 7 (i.e., because information relating to salary and pay may constitute ‘personal data’, and disclosure under Article 7 would constitute ‘processing’ of those data).
The impact report deals with both of these concerns concurrently, by suggesting that both would be negated by virtue of the fact that the information requestable under Article 7 ‘would not be about individual identifiable workers’ data.’ 96 The apparent implication being, therefore, that either this information would not be personal data and thus its disclosure would not engage any GDPR rules, and/or any personal data that were subject to a request under Article 7 could be anonymised so as to render them anonymous. The European Data Protection Supervisor, in their formal opinion on the draft Directive, 97 also merely suggested that the Directive include an obligation for employers to take measures to prevent a disclosure of information on an identifiable co-worker. This has not been implemented; the draft Directive only provides the need for employers to have safeguards against such disclosures in the preamble. We argue, however, that such measures are not infallible in any event, and that more should be done to recognise and navigate the inevitable conflict that will arise between the transparency Directive's provisions and data protection law.
The impact report is correct in the sense that if information requested under Article 7 did not relate to an identifiable individual it would not be personal data (i.e., it would be legally ‘anonymous’). Anonymous data are explicitly excluded from the material scope of the GDPR, and so disclosure of data of this sort would not be subject to GDPR rules.
98
The United Kingdom's supervisory authority, the Information Commissioner's Office (ICO) provides an explanation for this position: ‘[O]nce information ceases to identify anyone then it ceases to have any direct effect on them, so it poses a lower privacy risk, meaning researchers and others should be much freer to use it for their own purposes than information held in a personally identifiable form.’
99
Efforts to anonymise data (i.e., cut or obscure the link between a person referred to in a dataset, and the data itself) can be traced back at least as far as the 1970s.
100
There are a number of prominent anonymisation techniques that can be used for this purpose. Some focus on removing identifying characteristics (e.g., names, dates of birth, addresses) from data, whereas others focus on aggregating data to produce summary level statistics that do not include individually-identifying data. Given their potential to remove data from the scope of data protection rules, and thus free organisations from their data protection obligations, it has been widely noted that there are strong incentives for their use.
101
There is, however, a problem. Over the last 20 years or so, technical critics of anonymisation have demonstrated that conventional, and commonly used, anonymisation techniques are simply not capable of providing cast-iron guarantees of anonymity.
102
As noted elsewhere, the upshot of this is twofold:
Data that have been nominally anonymised by commonly-used anonymisation techniques will often be susceptible to being ‘de-anonymised’ (i.e., rendered personal); and Successful anonymisation of data is often a very complicated and context-dependent technical matter that will require expert advice/input to achieve.
103
“ “ “
In its 2014 opinion on anonymisation techniques the Article 29 Party
104
outlined a range of factors that organisations should consider when attempting to anonymise data, and also provided an explanation of three specific reidentification risks that may undermine anonymisation efforts:
As has since been noted elsewhere, the majority of commonly used anonymisation techniques are likely to be susceptible to at least one, if not more, of these reidentification risks.
106
To demonstrate how these issues might cause problems for employers attempting to meet their obligations under Article 7, we can consider the example of one commonly used anonymisation technique, k-anonymity.
K-anonymity is a technique designed to anonymise data by limiting the extent to which linkage of data in one dataset to data in another is possible. It involves the grouping of records pertaining to one individual in a dataset with at least k other individuals, and generalising attribute values to the extent that each individual shares the same value.
107
For instance, dates of birth might be generalised into a range of dates, grouped by specific months or years, or redacted entirely, and other numerical attributes (such as salaries) could be generalised by interval values. Each individual in such a dataset, therefore, will be part of a larger group. Ergo, any of the records within this group could correspond to a single person. The singling-out of a specific individual should not, therefore, be possible. The following hypothetical example illustrates how k-anonymity could be of use to an employer in the context of a request for pay information made under Article 7: Company A possesses a dataset (shown in Fig. 1, below) containing the gender, salary details, level of work, and other identifying information of its employees. Dieter makes a request under Article 7 requesting access to the dataset, as he wishes to obtain this information so that he can scrutinise the company's pay structure. Company A is obligated under Article 7 to disclose aspects of the information contained in the dataset, but also has an interest in not disclosing this dataset in its entirety to Dieter as this would potentially result in a breach of data protection rules.
Fictional dataset.
The second dataset shown in Fig. 2, below, shows the data from Fig. 1 anonymised to achieve k-anonymity of k = 2 with respect to the attributes of Gender, Salary and Work Level, since for any combination of these attributes found in any row on the table there are always at least two rows with these exact attributes. This was done through redacting some of the attributes shown in Fig. 1 (i.e., Name, Location and Age).
k-anonymised fictional dataset.
As a result, of the dataset being nominally anonymised to the value of k = 2, it is no longer possible to single out one individual in the dataset. With this being the case, Company A may conclude that this data has now been anonymised, and can be disclosed pursuant to the request made under Article 7 without triggering or infringing any data protection rules or obligations. This could, however, potentially be an errant reading of the situation due to k-anonymity's inherent limitations and weaknesses as an anonymisation technique.
In particular, this scenario highlights how data that are nominally anonymised by k-anonymity can potentially be vulnerable to the linkability and inference reidentification risks set out above, as background knowledge may allow for inferences to be made about individuals contained in a k-anonymised dataset. Imagine, for example, that Dieter knows that Mark is the only other male member of staff employed by the company. After identifying his own salary in the table, Dieter will reliably be able to infer that Mark's salary is EUR75,000. Similarly, if Dieter knows through conversations with Antonia that she earns less than him, he will be able to not only infer that her salary is EUR44,000, but also that she is the lowest paid member of staff on his work level. In such a situation the information, due to its identifying nature, would not be anonymous and would in fact constitute personal data for the purposes of the GDPR. With this being the case, the disclosure of the data pursuant to Dieter's request under Article 7 would not fall outside the scope of the GDPR, and Company A would be required to comply with its substantive rules.
This example leads us to two significant conclusions. First, though statistical information relating to employee gender, salary, and level of work will not itself directly identify an individual to whom it relates, there are circumstances and contexts in which it can be leveraged in a way that results in indirect identification. In such a situation, the information will be personal data for the purposes of the GDPR, and any use of this data (including disclosure) will have to comply with GDPR rules. This would likely be a challenging and complicated exercise. We return to this issue and examine it in more detail below. For now, it is sufficient to note how the example highlights how the impact paper's assertion that the use of Article 7 will not give rise to any data protection related concerns, due to the only information requestable will not be of an identifying nature, fails to appreciate the complexity of identifiability as a concept.
Second, in situations where information requested under Article 7 are personal data, efforts to anonymise the data to remove it from the scope of data protection rules will not always be straightforward. The removal of direct identifiers (e.g., names, addresses, dates of birth etc.) from a dataset containing information requestable under Article 7, or obfuscation by way of anonymisation techniques like k-anonymity, will plainly not always be sufficient to render these pieces of information anonymous and remove them and their usage from the scope of data protection rules. The example above demonstrates how datasets anonymised by k-anonymity are vulnerable to so-called inference attacks, but as noted elsewhere, it is a technique that is also vulnerable to other types of the reidentification risks set out above. 108 K-anonymity is of course just one example of a popular anonymisation technique. It is important to note that there are many other notable alternative techniques employers may turn to in an effort to anonymise information at their disposal, but these will often have similar significant limitations and vulnerabilities of their own. 109 In other words, whatever mode of anonymisation an employer may use to attempt to anonymise information requested under Article 7, their efforts will not be guaranteed and will be vulnerable to being ‘de-anonymised’.
The upshot of these two conclusions is that the impact paper's overly simplistic eschewal of data protection-related concerns raised in response to Article 7 of the proposed Directive are simply divorced from reality. Were the Directive to be enacted in its current proposed form, this would likely result in employers having to balance their obligations under the Directive with their obligations under the GDPR. This would likely prove to be challenging. We examine this issue in detail in the next section.
In the previous section we examined how the existence of data protection rules set out under the GDPR may act as an impediment to the effective use of Article 7 of the proposed Pay Transparency Directive. In this section we go further, and consider how the existence of the GDPR may not be limited to specific aspects of the proposed Directive, but to the smooth and effective operation of the Directive in its entirety. The starting point for our consideration of this issue is Article 10 of the proposed Directive, which states: 1. To the extent that any information provided pursuant to measures taken under Articles 7, 8, and 9 involves the processing of personal data, it shall be provided in accordance with Regulation (EU) 2016/679.
2. Any personal data processed by employers pursuant to Articles 7, 8 or 9, shall not be used for any other purpose than to implement the principle of equal pay.
3. Member States may decide that, where the disclosure of information pursuant to Articles 7, 8 and 9 would lead to the disclosure, either directly or indirectly, of the pay of an identifiable co-worker, only the workers’ representatives, the labour inspectorate or the equality body shall have access to that information. The representatives or equality body shall advise workers regarding a possible claim under this Directive without disclosing actual pay levels of individual workers doing the same work or work of equal value. For purposes of monitoring pursuant to Article 26 the information shall be made available without restriction. 110
The effect of Article 10 of the proposed Directive is clear, and can essentially be summarised as follows: any disclosure of information made pursuant to a request made under Articles 7, 8 and 9 of the Directive would only be lawful if it was compliant with the substantive provisions of the GDPR.
In the previous section we explained how anonymising information requested under Article 7 of the Directive would likely prove to be a problematic and difficult task. If this information could not be sufficiently anonymised it would likely constitute personal data for the purposes of the GDPR, and its disclosure would fall within the GDPR's material scope. However, it is important to note that an employer's inability to ensure the anonymity of information requested under Article 7 of the proposed Directive would not necessarily mean that disclosure of the information would be prohibited. There is nothing in the GDPR, for instance, that de facto prohibits disclosure of personal data in such circumstances. Disclosure of information requested under Article 7 would still theoretically be possible, either to the requesting individual themselves or to a representative body under Article 10(3), but only if it was compliant with the GDPR's substantive rules.
As set out above, the GDPR subjects any processing of personal data, including disclosure, to various conditions. Of particular interest in the context of Articles 7 to 9 of the proposed pay transparency Directive are Articles 5(1)(a) and Article 6 of the GDPR. Article 5(1)(a) GDPR specifies that any processing of personal data must be lawful and fair. Pursuant to this, Article 6 then GDPR sets out a range of preconditions through which the processing of personal data can be rendered lawful. When confronted with a request made under Article 7 of the proposed pay transparency Directive that would entail the disclosure of individuals’ personal data, therefore, an employer would be required to answer two questions:
Would the disclosure of the information (i.e., the personal data) requested under Article 7 of the proposed Directive be lawful as per Article 6 of the GDPR? and Would the disclosure of the requested information (i.e., the personal data) be fair to the individual(s) to whom the data relates?
If the answer to both of these questions was ‘Yes’, then the disclosure of the information could go ahead without issue. If the answer to either of these questions was ‘No’, then the disclosure of the information would not be compliant with the substantive terms of the GDPR, and therefore would apparently be disallowed under Article 10 of the proposed Directive. Troublingly, this is a hurdle that employers would likely find difficult to negotiate when debating whether to disclose information requested under the proposed Directive.
The first of the abovementioned questions (i.e., whether the disclosure would be lawful) would be unlikely to cause employers much difficulty. Article 6(1)(c) GDPR specifies that processing of personal data will be lawful when it is necessary for compliance with a legal obligation to which a data controller is subject. Given that under the proposed Directive employers would have an explicit statutory commitment to disclose salary information following a request made under Article 7, this would clearly represent such an obligation. Making determinations in respect of the second question (i.e., whether disclosure would be fair to affected persons) would, however, be far more complicated. Whether the disclosure of personal data pursuant to a request made under Article 7 is fair will depend on context and will likely require a balancing exercise in which the competing interests of affected individuals are weighed (i.e., the interest of the requester of the information in the information being disclosed vs the interest of the individual to whom the information relates in the non-disclosure of the information). For reasons explained below, it is by no means guaranteed that the outcome of such a balancing exercise will favour disclosure over the protection of other competing interests. CJEU jurisprudence has, for example, seemingly established a general principle according to which data protection interests should prevail over other competing interests, such as those relating to transparency and the disclosure of information. In the context of Article 7 of the proposed Directive, therefore, there appear to be major doubts that the disclosure of salary details would be fair to affected individuals, the upshot of this being that the disclosure of this information could be incompatible with Article 10 of the Directive and the GDPR. This would obviously impede the overall effectiveness of Article 7 and of the Directive in its entirety.
As a means of contextualising and highlighting this potential problem, comparisons can be drawn between the prospective clash between the rules of the proposed Directive and data protection rules and the data protection-related difficulties experienced by another piece of EU legislation geared towards engendering transparency, Regulation 1049/2001. Article 2 of Regulation 1049/2001 111 sets out a general right to access documents held by EU institutions (e.g., the European Parliament, the European Commission etc.). 112 As is made clear in the Regulation's recitals, the purpose of this right is to prevent the workings of EU institutions from becoming shrouded in secrecy. 113 Article 4(1)(b) of the Regulation then specifies that disclosures of documents that would compromise the protection of privacy and integrity of the individual, particularly in accordance with Community legislation regarding the protection of personal data (i.e., the GDPR), are exempt from requests made under Article 2. The main guidance regarding how and when this exemption should apply is found in another complementary piece of EU legislation, Regulation 2018/1725. 114
Article 9(1)(a) of Regulation 2018/175 specifies that when deciding whether it is appropriate to disclose personal data following an access request made under Regulation 1049/2001, if there is reason to believe that the disclosure would compromise an affected individual's data protection interests, disclosure will only be permissible if it is proportionate to the purpose of the disclosure (i.e., enhancing transparency), having weighed and balanced the competing interests. However, the CJEU's attempts to resolve matters involving the balancing of data protection interests against competing transparency interests has not provided a consistent message. Despite initially appearing to take a balanced approach to resolving tensions between data protection interests and competing interests relating to transparency, over time the court's decisions appear to evince an attitude that disproportionately favors data protection interests.
In Schmidburger, 115 for instance, it was held that the purpose of the right of access as set out in EU data protection law was to allow individuals to verify the accuracy of personal data stored about them by others and the lawfulness of the processing of such data. Here, the CJEU made clear that the data protection rights and interests of individuals are not absolute, nor should they be presumed to have an overriding effect in relation to other competing rights and interests. 116 The implication, therefore, appeared to be that there should be no presumption that data protection rights and interests should de facto prevail in the face of other competing interests, such as those relating to transparency.
Later, however, in Bavarian Lager 117 the CJEU appeared to embark on a different course, and implied that even if important competing transparency-related interests are at stake, an individual's data protection interests should prevail in all but exceptional circumstances. Here, the CJEU explicitly stated that in situations where data protection interests were in conflict with other interests relating to transparency of information, legal rules relating to the protection of personal data should apply in their entirety. The CJEU held that the fact that the names of public figures (i.e., personal data) appeared in a European Commission document was sufficient justification for refusing its disclosure. Notably, it was also intimated that even in situations where it is uncertain whether disclosure of personal data would prejudice the interests of affected individuals, data protection interests should be presumed to prevail over competing transparency interests. This position was completely at odds with the advice of the European Data Protection Supervisor, who throughout proceedings had consistently argued that an actual proven threat of harm to an individual's data protection interests should be necessary before data protection interests could be allowed to prevail over competing transparency interests. 118
The Grand Chamber of the CJEU reached a similar conclusion in Schecke. 119 Here, the court upheld a decision not to disclose documents containing the names of individuals receiving agricultural aid on the basis that doing so was necessary to protect the data protection interests of the affected individuals. This decision was taken without any consideration of whether the affected individuals’ data protection interests had, as a question of fact, been harmed, and in spite of the fact that the personal data in question (i.e., the names of the affected individuals, and the fact that they were receiving agricultural aid) was already in the public domain.
Dennekamp II 120 concerned an access request made in relation to a document containing the names of MEPs participating in the European Parliament's pension scheme. The CJEU accepted that there were strong transparency interests in the requested document being disclosed, due to the way in which it would help bring to light possible conflicts of interest arising in EU institutions. However, despite recognising the importance of transparency in this way, the court nevertheless opined that the threshold for transparency interests prevailing over data protection interests was set very high, and that in the immediate case the public's interest in transparency was not proportionate to the harm that would be done to the data protection interests of the affected MEPs were the document to be disclosed. The access request was, therefore, refused.
The CJEU jurisprudence on conflicts between transparency and data protection interests does not paint an altogether satisfactory picture. In situations where conflicts between transparency and data protection interests have arisen in the context of Regulation 1049/2001, the court has seemingly disproportionately favoured the latter. Bavarian Lager, Schecke, and Dennekamp II all concerned requests for documents containing personal data in which the court conceded there was a public interest in disclosure. In all three cases the court recognised the need to resolve the conflict between transparency interests and data protection interests by way of a balancing/proportionality assessment. However, on all three occasions the court concluded that personal data interests should prevail over competing transparency interests without requiring any evidence that disclosure would result in the affected individuals’ data protection interests being prejudiced. None of the three cases, for instance, appeared to involve a situation where any affected person's personal integrity was at risk of serious compromise. In Dennekamp II, in particular, given the personal data contained in the requested document related to individuals acting in a public capacity and making use of public funds, it seems doubtful that disclosure would have compromised their integrity at all.
The apparent upshot of CJEU case law, therefore, is that in the context of access to document requests made under Regulation 1049/2001 the burden or standard required for transparency interests to prevail over data protection interests is very high. Nonetheless, more recent case law has demonstrated that this high standard is, on rare occasions, obtainable. In ClientEarth, 121 for instance, the CJEU held that, due to risks of regulatory capture associated with the European Food Safety Authority (EFSA), the disclosure of some personal data pursuant to a document access request made under Regulation 1049/2001 was necessary to ensure transparency of the EFSA decision-making process. However, whilst the ruling was arguably significant from a transparency perspective, the court did not address any possible concerns relating to the arguably disproportionately pro-data protection stance adopted in previous cases.
What these cases show is that in a directly comparable area of law, also concerned with ensuring transparency of information, where data protection interests and transparency interests must be balanced, the courts have seemingly favoured a pro-data protection stance, according to which data protection interests (i.e., interests in non-disclosure) are seemingly given automatic precedence over competing transparency interests (i.e., interests in disclosure). This jurisprudence should represent a cautionary tale for the proposed Directive and the transparency obligations/rights it seeks to introduce. For the reasons provided above, disclosures of information made under Article 7 of the proposed Directive would likely only be lawful under both Article 10 of the Directive and the substantive rules of the GDPR if the interest in disclosure of information outweighed any competing interests in the information not being disclosed. Previous case law clearly shows us that it cannot be assumed that transparency interests will always prevail in such circumstances. If the CJEU were to take the same stance when attempting to balance data protection and transparency interests under Article 7 of the proposed Directive as it has when attempting to deal with analogous balancing exercises under Regulation 1049/2001, this could plainly come to significantly undermine the Directive's aims and effectiveness.
Of course, one could take the position that the CJEU may favour transparency interests when they are related to equal pay. Two details of pay transparency could make this likely, although still not a given. Firstly, the status awarded to equal pay in EU law may make a difference. Protection of the concept of equal pay between men and women has existed in EU law since 1957, with the signing of the Treaty of Rome. 122 Now, Article 157 TFEU requires Member States to ensure that the principle of equal pay is adhered to. That equal pay is afforded a treaty-based status in EU law might suggest that the utility of pay transparency measures—specifically, their aim to enforce this right—outweigh any data protection concerns. The utility of transparency measures in general are much more vague, and may not benefit from much treaty-based support. The provision on EU institutional transparency only requires the EU institutions to have an ‘open, transparent and regular dialogue with representative associations’, 123 which may not lend much support to transparency-based data requests. The link between pay transparency data requests and the right to equal pay is more robust and refined. 124
Secondly, from a pragmatic perspective, disclosures of personal information for the purposes of securing the right to equal pay are perhaps more heavily regulated, thus the data will have limited useability. That the proposed Directive only allows the data obtained to be used for the purposes of enforcing the right to equal pay is a welcome limitation on the right to pay transparency. This can be contrasted to, for example, the UK's draft pay transparency provisions, 125 which did not include such a limitation. That the disclosure has limited purpose, and that the purpose is linked to a fundamental Treaty right enshrined in Union law, may make a difference in the weighting of data protection law and transparency rights, should a case on this matter come before the CJEU. What is clear is that such a case is likely, given the number of employers bringing up data protection concerns from the outset of the drafting process, 126 and given that the relationship between data protection measures and transparency measures in EU law is not concretely ascertainable.
Conclusion
This article has commended the new EU pay transparency Directive, for its potential to ease the enforcement of the principle of equal pay for equal work or work of equal value. Inequality in access to information is a large stumbling block for individuals wishing to uncover and rectify pay disparity. Increased pay transparency, and particularly the right to request and receive pay data relating to comparators, is therefore a relatively sure way to overcome obstacles to challenging pay discrimination. Increased availability of pay data would also allow a better understanding of the gender pay gap, and might aid in the determination of the percentage of that gap caused by pay discrimination.
However, there are several concerns with the proposed Directive, not all of which have been picked up during the process of scrutiny by the European Parliament or the impact evaluation. Most of our concerns are procedural, relating to the time the employer has to respond to requests for pay data, the lack of standards on what must be provided, and the limitations regarding how many employees a company must have before it is subject to transparency obligations. More generally, we note a concern that overreliance on pay transparency as a tool for challenging the current gender pay gap in the EU is undesirable, given that it still places a large portion of the burden on claimants (predominantly women) to enforce their right to equal pay. That is not to suggest that measures aimed at decreasing the taboo around pay negotiations and conversations should not be put in place, but rather to suggest that overreliance on the initiative of those who are discriminated against is not ideal.
By far, the largest concern is the ambivalence towards the potential clash between the proposed right to receive pay data and the data protection obligations of employers. The limits of anonymisation techniques will likely mean that much of the information that can be requested under the proposed Directive will be personal data as defined in the GDPR. The upshot of this is that whilst disclosure of this information will still be technically possible, it will only be permitted if it can be done in a way that is compatible with the GDPR's substantive rules and, in particular, the data protection principles. This will likely prove to be a challenging and complicated issue, with employers ultimately being pulled in opposite directions by their competing data protection and transparency obligations.
Footnotes
Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
