Tracking diversity and inclusion efforts on a global basis often is a challenging task for in-house legal, human resources, and diversity, equity, and inclusion (DEI) teams. While employers may be interested in collecting applicants’ and/or employees’ diversity information to track their progress, such an effort is fertile ground for potential litigation involving data privacy violations and discrimination claims.
Risks of Violating Data Privacy Requirements
DEI leaders in the U.S. often want to implement questionnaires asking employees’ to self-indentify their race/ethnicity, gender and gender identity, and LGBTQ status. Furthermore, employers with more than 100 employees are required to track race and gender information for the Equal Employment Opportunity Commission.
This is often in direct conflict with privacy laws around the world, because diversity information typically constitutes personal data outside the U.S. (and, in many jurisdictions, sensitive personal information) and therefore will be subject to the general privacy law requirements in each jurisdiction related to the collection, processing, use and transfer of personal and/or sensitive personal information.
Employers are prohibited from inquiring about certain diversity information of applicants and/or employees in some jurisdictions. In Belgium, for example, employers are not permitted to ask employees about their race, ethnicity, or if employees consider themselves to be living with a disability.
Employers in France are not permitted to ask employees about their race or ethnicity—unless employees consent to the collection of such data—because the proposed collection relies on employees’ free will to disclose such data. Of course, consent is viewed skeptically in the employment context and may be withdrawn at any time.
Understanding Cultural Norms
Employers must also be cognizant of cultural norms and sensitivities. In Mexico, for example, employers should not ask applicants/employees about their veteran status, because such status does not exist per se. Similarly, asking workers about military service in Australia is uncommon.
Cultural nuances also are prevalent in China. Asking for gender identity and sexual orientation information in China is culturally uncommon, in part because social awareness of equality, protection, and inclusion of people with different gender identity and sexual orientation has not reached the same level as in Europe, the U.S., and other Western countries.
In countries such as the United Arab Emirates, where homosexuality is illegal, employers should not ask employees about their sexual orientation. Employers also should not ask employees about their gender identity in the UAE because only male and female genders are recognized.
Finally, although collecting employees’ race, ethnicity, and race data may be permitted in Hong Kong, India, Japan, Saudi Arabia, and South Korea, it is culturally uncommon to do so.
Best Practices for Data Privacy
Generally, to ensure that employers’ processing of sensitive personal information is lawful, employers must require data subjects (i.e., applicants and employees) to provide explicit consent. But this poses a conundrum for employers because consent is viewed skeptically in the employment context in many jurisdictions.
Thus, it also is necessary to consider whether (i) the fact that responses are voluntary is sufficient to comply with any requirements to obtain consent and (ii) disclosures likely will be required through a data privacy notice that explains how the information will be processed or used and where, to whom and for what purposes it may be transferred.
Avoiding Potential Discrimination Claims
When collecting diversity information of an international workforce, many questions that employers seek to ask may raise discrimination issues. This is the case even when such diversity questions are legally permitted.
The primary concern is that as soon as employers collect any diversity information from applicants or employees, and such individuals experience a negative consequence, the likelihood greatly increases that the individuals will claim that such a decision was due to a protected category and therefore is discriminatory.
In addition, employers should implement a clear communication strategy that conveys the positive reasons why certain diversity questions are being asked and dispels potentially negative perceptions that candidates and employees otherwise may have formed.
When communicating with candidates and employees, transparency is important to avoid any misunderstanding. As a best practice, employers should obtain candidates’ and employees’ consent if individuals’ data will be stored or maintained by a third party.
If it is not possible or practical to obtain candidates’ and employees’ consent, employers, at a minimum, should inform candidates and employees when they are completing the survey that a third party may store their responses.
Conduct a Risk-Based Analysis
Around the world, whether employers may ask individuals diversity-related questions often is not a simple “Yes” or “No” determination. When jurisdictions do not provide by law whether certain diversity information may be collected, employers may consider developing a risk-based analysis that assesses the need for the information.
Such a risk-based analysis considers factors in addition to the simple legal bases for collecting diversity information, including, but not limited to, if the collected information will be (i) aggregated and not used by any managers during the hiring process or otherwise in making employment-related decisions; (ii) gathered in a location where it only may be accessed by the DEI team; and (iii) used only to track employers’ progress in its diversity and inclusion efforts.
These factors, as well as whether employers would like to take a progressive approach and “push the envelope” in the area of diversity and inclusion, will help employers assess whether they are in a position to commit effectively to collecting applicants’ and/or employees’ diversity information. In the end, employers must consider (i) whether they are equipped from a data privacy perspective to collect individuals’ personal information and (ii) the purpose of the diversity collection effort.
This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owner.
Erika C. Collins is a partner in Faegre Drinker Biddle & Reath LLP’s labor and employment department in New York where she co-leads the International Employment practice team. She works with U.S.-based multinational companies to help them navigate, understand, and comply with non-U.S. labor and employment laws.
Ryan H. Hutzler is an associate in Faegre Drinker Biddle & Reath LLP’s labor and employment department in Washington, D.C., where he advises employers in all aspects of international employment and human resources matters, with a particular focus on navigating cross-border legal and cultural differences.