Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?
<p>If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?</p>

<p>In principle, the company can disclose personal data as long as it has a legal basis such as a legitimate interest to do so. This legitimate interest must outweigh the interests, rights, and freedoms of the affected persons.</p>
<p>But in this particular scenario I have doubts on two grounds.</p>
<p>First, the company might not have a sufficiently compelling legitimate interest. It's none of the client's business what a particular employee's demographics are. Even if the company has a legitimate interest, it can only process data as necessary for that purpose – but no more. For example, if the legitimate interest can be satisfied with aggregate statistics, then there is no legal basis for disclosing per-employee information.</p>
<p>Second, and more importantly, some of this information may fall under “special categories” of data in the sense of <a href="https://gdpr-info.eu/art-9-gdpr/" rel="nofollow noreferrer">Art 9 GDPR</a>. Such special categories are illegal to process, unless an explicit exception applies. Processing information about the “racial or ethnic origin” is explicitly illegal, though it may e.g. be permissible if explicitly authorized by national laws. Processing information about gender is not explicitly prohibited, though there might be interesting edge cases. For example, an employer would almost certainly fail to have a legitimate interest for a processing activity that would out a trans employee.</p>
<p>So a company should think about:</p>
<ol>
<li>whether it is allowed to process the data in the first place, taking into account Art 9 GDPR</li>
<li>if so, whether it has a legal basis for processing (such as a sufficient legitimate interest)</li>
<li>if so, and if the information is taken from existing records, whether it is allowed to reuse the data for a different purpose than it was collected for (see Art 6(4) GDPR)</li>
<li>if so, what the minimum necessary amount of data for this purpose would be</li>
</ol>
<p>Likely, this means sharing no data at all (because the data may not be collected or reused in the first place), or only sharing aggregate statistics.</p>
<p>Of course, there can be reasonable scenarios where processing this kind of data is appropriate, for example in a modelling agency. But taking into account Art 9 GDPR, this might require explicit consent if national laws do not provide a suitable exception.</p>

gdpr data-protection personal-information