Consejería de Economía, Conocimiento y Empleo – Complaint Upheld (Spain, 2024)

On 31 January 2022, a complaint was filed with the Spanish DPA concerning a government webpage that required certain personal data to submit a form for conciliation of labour disputes to the Canary Islands’ Department of Economy, Knowledge and Employment (controller). In particular, the form included a question concerning sex/gender that obliged a response of man, woman, or nonbinary. The data subject argued that the nonbinary response required disclosure of personal data related to sexual orientation and that such data is beyond the scope of the controller’s legal basis and the form’s purpose. The controller argued that there was no violation of Article 5(1)(c) or 9(1) GDPR and that it was in fact required to collect such information under Spanish law. In particular, Article 26 of Law 12/89 and Article 20(a) of Law 3/2007 obliges public institutions to collect sex/gender information in all administrative forms for statistical purposes. The DPA found that the controller exceeded its legal basis for processing under Article 6(1)(c) GDPR, violated the data minimisation principle under Article 5(1)(c) GDPR, and improperly processed a special category of information under Article 9(1) GDPR. First, in finding a violation of Article 6(1)(c) GDPR, the DPA determined that the controller exceeded their legal basis for processing under Spanish legal requirements. A number of Spanish laws including [https://www.boe.es/buscar/act.php?id=BOE-A-2007-6115 Article 20 of Law 3/2007] and [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] require public institutions to collect data about the applicant’s sex/gender for statistical purposes and monitoring of gender equality. [https://www.boe.es/buscar/doc.php?id=BOE-A-1989-10767 Article 26 of Law 12/1989] specifies ‘woman’ and ‘man’ as the responses to inquiries about sex. On the other hand, the DPA noted that no Spanish laws obliging sex/gender to be documented require the nonbinary response to be included. Including it as a response thus exceeded the scope of the legal requirements that formed the basis for processing under Article 6(1)(c) GDPR. Second, the DPA held that the nonbinary response collected personal data that was not necessary for the purpose of processing in violation of Article 5(1)(c) GDPR. It considered that the nonbinary response was not related to the purpose for which data was being collected in the form, which related to labour disputes between employers and employees. Finally, the DPA determined that the controller processed special categories of information prohibited under Article 9(1) GDPR. Though it noted that gender identity and sexual orientation are distinct, the DPA determined that a response other than man or woman (in this case, nonbinary) can still be considered to relate to sexual life, even if the form does not explicitly refer to sexual orientation or sex life. There was no applicable exception to the prohibition on processing of special categories in this case under Article 9(2) GPDR. As a result, the DPA concluded that the nonbinary response violated Article 9(1) GDPR. The DPA imposed warning sanctions for the controller’s violations of Article 5(1)(c) and 9(1) GDPR, pursuant to Article 83(5)(a) GDPR. It also ordered the controller to bring processing operations into compliance by removing the nonbinary response in questions of sex/gender from not only in the form arising in the case, but in the processing of all forms processed by the controller.