If we had to rank the most frequently asked questions regarding the Pay Transparency Directive, the question of its relationship to individual employees’ right to privacy and the GDPR would be pretty high up there.
The concern is clear: the Directive requires employers to share averages of wages of male and female employees per category of employees, either at the request of an individual employee or as part of the (tri-) annual pay reporting. But what should you do if the number of employees of a certain gender in a specific category is very low, and sharing the data per category thereby indirectly comes down to sharing individual employees’ pay data with their colleagues?
The Directive acknowledges this concern, but does not do much more than that. It states that to the extent any information provided pursuant to the individual right to information, the (tri-annual pay reporting or the joint pay assessment involves the processing of personal data, it shall be provided in accordance with the GDPR, and that such personal data shall not be used for any purpose other than for the application of the principle of equal pay. The Directive also suggests that Member States consider further measures: they may decide that, “where the disclosure of information would lead to the disclosure, either directly or indirectly, of the pay of an identifiable worker, only the workers’ representatives, the labour inspectorate or the equality body shall have access to that information”. In such circumstances, the workers’ representatives or the equality body should advise workers regarding a possible claim under the Directive without disclosing the actual pay levels of individual workers performing the same work or work of equal value.
It’s no surprise that the Member States which have already started implementation of the Directive have not picked up on this (in our humble opinion) unworkable solution. But these Member States also haven’t done much else – they have basically all considered that this is not an issue that requires further attention. So far there has only been the German Commission “reducing the administrative burden of implementing the Directive”, which has suggested in its report that any comparison of pay should have at least six members to ensure that data privacy is safeguarded. This minimum comparison group of six employees is already included in other German legislation and thus stands a good chance of being included in local legislation implementing the Directive when it eventually sees the light of day.
So where does that leave employers in other jurisdictions that do not address this issue in their national legislation? Does the Directive and any local implementing legislation give them sufficient ground to (indirectly) disclose employees’ personal (pay) data? Not so sure …
In the hierarchy of legal norms, a regulation (the GDPR) trumps a directive or national implementing legislation. The GDPR provides that the processing of data is lawful only if and to the extent that one of the grounds for legitimate processing applies. The list of lawful grounds is limited and exhaustive, and when it comes to sharing pay data, “legal obligation” is the only valid option: processing is lawful if necessary for compliance with a legal obligation to which the controller is subject. The recitals to the GDPR specify that “such a legal basis or legislative measure should be clear and precise”. The European Data Protection Board (EDPB) adds in this regard as an essential condition that “these legal provisions must establish a clear and specific obligation to process that personal data”. It must be sufficiently clear from the legal provision what the required processing of personal data entails, so that the controller does not have any (inappropriate) margin of discretion with regard to the manner in which it complies with the legal obligation.
And that is in our view not the case: the Pay Transparency Directive does not instruct employers to disclose personal data. Quite the opposite in fact. The Directive speaks only of aggregate and unidentifiable data, such as averages and median pay gap data. Furthermore, the Directive reminds employers of the GDPR and urges member states to consider alternative measures if providing information as required by the Directive could lead to the disclosure, either directly or indirectly, of the pay of an identifiable worker. The alternative suggested by the Directive (sharing information only with the workers’ representatives, the labour inspectorate or the equality body) is flawed and has not been picked by any of the national legislators so far. The conclusion thus remains that employers need to observe both pay transparency legislation and the GDPR, and that the former is not a sufficient alibi to bypass the latter.
Practically speaking, where does that leave you as an employer faced with an individual information request or your pay reporting obligation? The steps below may help to navigate you through this thorny situation:
- Check whether the local legislator has included any measures on the topic. So far, only Germany seems to have picked up on the issue, but hopefully their sensible guidance will influence other member states which are still in the process of preparing legislation (and there are a few …).
We will of course also continue to track any movement in this regard.
- Assess the data sets: if the number of employees of a certain gender in a specific category is very low, special attention should be paid to sharing any data regarding this category, both in response to an individual information request or as part of the pay reporting obligation.
- Consider proportionately widening certain categories to ensure that the data sets avoid disclosure of personal data.
- Providing alternative information may be justified if it allows the employer to meet the objectives of the Directive, while also complying with the requirements of the GDPR.
- For most member states, the Directive is quite a big change, and this may require some education for all stakeholders. It may need to be explained to individual employees and employee representatives that while the Directive ensures that employees shall no longer be prevented from disclosing their pay for the purpose of the enforcement of the principle of equal pay, the Directive does not come with an obligation for individual employees to have their pay disclosed.
For any further questions around pay transparency, please visit our dedicated Pay Transparency Support & Resources page or reach out to our team of experts.
