1

It is clearly stated in the European Commission website that gender is considered as "Personal data" which is "sensitive" and is subject to specific processing conditions.

However, I am not sure about extracting gender specification on the data that is publicly available such as scientific publications (authors name) or patents (inventors name)? Yet the extraction of gender information requires a process for extracting authors' names and using external API services (i.e Gender API).

Would such experiment be compliant with EU regulations and GDPR? If not, and the gender extraction is considered as "sensitive" analysis, what would be the "specific processing condition" to mitigate any potential risks?

Improve this question
1
  • Are these publications available offline?
    – grovkin
    Mar 12, 2021 at 23:12

2 Answers 2

Reset to default
1

I think that the gender will likely not be sensitive in the context of your experiment, but whether your experiment would be GDPR-compliant would depend on the details.

gender is considered as "Personal data" which is ‘sensitive’

Yes, the gender of a particular person is that person's personal data, since (a) the person is identifiable and (b) the information about their gender relates to this person. This satisfies the definition of personal data in Art 4 GDPR.

No, it will likely not be sensitive data. GDPR defines special categories of data in Art 9 which require additional protection. This includes information regarding the sex life or health of the data subjects. In most cases, the gender of a person does not reveal such information. However, this depends on the purposes for which the data is processed. E.g. information regarding gender could be sensitive information when processed in the context of trans persons.

data that is publicly available

Whether data is publicly available makes no difference for GDPR compliance. Public personal data is still personal data, and you will need a legal basis etc. for processing it.

The only impact I know for using publicly accessible data is in respect to your information obligations under Art 14(2)(f): “the controller shall provide the data subject with the following information […]: from which source the personal data originate, and if applicable, whether it came from publicly accessible sources”.

the extraction of gender information requires a process for extracting authors name and using external API services (i.e Gender API).

You are not required to use an external API. You could use local techniques to estimate the gender.

Note that names are not necessarily clearly gendered, and that this depends a lot on the cultural context of the name. E.g. “Alex” or “Kim” are common examples of unisex given names in a western context, whereas the latter is also a common Korean surname.

Would such experiment compliant with EU definitions and GDPR?

Yes, an experiment that would involve estimating the gender of publicly available names could be GDPR-compliant. The usual GDPR concerns for handling personal data (such as names) apply.

If you use an external service for this experiment, you will need to consider GDPR compliance for using a service. Either the service acts as your data processor, which requires that you perform due diligence and sign an agreement with them, but then you have no special conditions. Or the service acts as their own data controller, in which case you will need a legal basis for sharing the personal data with this service. However, given that the personal data in question was made public by the data subjects themselves, this could strengthen an argument that you have a legitimate interest for sharing the data. A legitimate interest always requires a balancing test between that interest and the data subject's rights and expectations.

Improve this answer
2
  • Very comprehensive answer! About 'specific processing conditions', would it be adequate to say that after gender specification task by API services, all names will be anatomized/deleted for continuation of analysis. And the fact that we are looking at statistics on aggregate level (i.e.percentage of male vs female in country) would be a good justification to indicate our purpose for gender extraction?
    – AHK
    Mar 12, 2021 at 9:03
  • @AHK I cannot guarantee that anything will be “adequate” or sufficient. Yes you're required to delete data once it's no longer necessary for any purpose, and to not collect unnecessary data in the first place. You must also consider safeguards like encryption or pseudonymization wherever appropriate. Aggregate statistical data is usually anonymous, but you are still performing processing of personal data to get the aggregate information. If you exclude rare names and are sending only aggregated, non-identifiable data to external services, that might be anonymous and then fall outside of GDPR.
    – amon
    Mar 12, 2021 at 16:00
0

I would think that you don’t actually get the person’s gender but some software’s guess what the gender would be. The software you use gives an example: “We found 100 people named Elizabeth and they were all female”. If there is a transgender man named Elizabeth your software will get it wrong, and you won’t have his GDPR protected true gender, but an incorrect guess.

Of course discrimination against a person because of their incorrectly guessed gender would be illegal. And if your incorrect guess causes them damages, that might cause you a legal problem. And if your software didn’t guess but look up data in a database so it is the true and correct gender, that might or might not be a problem with GDPR.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .