Measuring diversity at work: the CNIL finally opens a public consultation

Background

In promoting equal opportunities and fighting against discrimination, companies and public organizations may be pushed to use various tools to measure workforce diversity, covering factors like disability, age, gender, and social, geographical, or cultural origins. These measurements often involve submitting questionnaires to employees. Due to the collection of personal and sometimes sensitive data, these tools must comply with data protection laws and constitutional equality principles, which prohibit the collection of ethno-racial data. Ensuring privacy protection is paramount for the success of these surveys, fostering trust and participation among employees.

In Anglo-Saxon and particularly US companies, diversity questionnaires and surveys are widely used. However, French law differs significantly in this regard. Following the CNIL’s position, a decision by the French “Conseil Constitutionnel” (Constitutional Council) on November 15, 2007, diversity studies must not be based on the supposed ethnic or racial origins of employees, as this would contravene Article 1 of the Constitution, which ensures equality before the law for all citizens without distinction of origin, race, or religion. Consequently, any categorization that could be seen as an ethno-racial reference must be avoided.

However, this decision allows for the exploration of social, geographical, or cultural origins using objective data such as the place of birth and nationality at birth of the employees or their parents. Additionally, subjective data can be used, such as how individuals feel about their identity or how they believe they are perceived by others.

This French approach to measure diversity in companies presents a real challenge for international groups seeking to implement equivalent measures across all their subsidiaries. The direct US approach, which involves explicit questions about ethnic affiliations and racial identification, contrasts sharply with the indirect French approach, which focuses on understanding how individuals identify themselves and how they believe they are perceived by others.

Measuring diversity in the workplace remains critical for promoting equal opportunities and fostering an inclusive environment. Aware of this difficulty and the unique position of France, the CNIL proposes adopting a recommendation for measuring diversity within companies following a phase of public consultation.

Key Points from the Draft Recommendation

The Draft Recommendation aim to guide organizations to comply with data protection laws and constitutional equality principles, avoiding any collection of actual or perceived ethnic or racial data. The CNIL's recommendations include, among others:

1. Ensure anonymization of the surveys:

   1. surveys should be designed to ensure participant anonymity to protect privacy and encourage honest responses;

   2. avoid collecting identifiable information such as names, addresses, phone numbers, or birth dates. Questions should be broad to prevent indirect identification through data combinations.

2. Rely on legitimate interest seems the most appropriate legal basis:

   1. use the legitimate interest of the employer as the legal basis for conducting diversity surveys;

   2. ensure that the data collection is proportional and only gathers necessary information;

   3. balance the employer’s needs with employees' rights and freedoms, by insisting on the optional nature of the survey, or by including optional questions.

3. Ensure exclusively voluntary participation in the survey:

   1. participation in surveys must be entirely voluntary, requiring a specific affirmative action from employees, such as following a survey link;

   2. there should be no negative consequences for non-participation, and participation must be clearly optional.

4. Comply with data minimization principle:

   1. collecting only data necessary for achieving the survey’s objectives;

   2. use predefined categories and multiple-choice questions to limit the amount of data collected.

5. Collect explicit consent for sensitive data:

   1. obtain explicit consent for collecting sensitive data, including information about racial or ethnic origins, political opinions, and religious beliefs;

   2. ensure consent is free, explicit, and informed, with no coercion, by using a trusted third party.

6. Prefer reliance on a trusted third party:

   1. engage a trusted third party to administer surveys, enhancing data security and confidentiality;

   2. ensure the third party manages data anonymization and provides aggregated results, protecting individual identities;

7. Anonymize results of the survey:

   1. ensure data is anonymized during analysis and before publication to protect individual identities;

   2. present results in aggregated statistical form, eliminating any direct or indirect identifiers;

   3. the employer should not have access to the data collected, but only to the results.

8. Conducting a data protection impact assessment.

According to the CNIL, by adhering to the Draft Recommendations, organizations could conduct workplace diversity surveys responsibly, ensuring compliance with data protection laws while fostering a culture of equality and inclusion.

While the CNIL's intention is welcomed, there are still some practical uncertainties:

• in the case of online questionnaires, how to ensure that no identifier or individualization of the respondents remains?

• how to reach reliable results, taking into account the wording of questions proposed by the CNIL (e.g. "How do you think others perceive you?")?

• what conditions must be met to qualify as a trusted third party?

• does the use of a trusted third party guarantee the validity of employees' explicit consent to the collection of sensitive data?

The public consultation on the Draft Recommendation will undoubtedly provide an opportunity for stakeholders to express their doubts and outstanding questions. This opportunity should be seized to avoid recommendations that would be difficult to apply in practice.

Please follow this link to participate in the public consultation before September 13, 2024 (available in French only).

Authored by Etienne Drouard and Remy Schlich.