Data protection considerations for fields

Information and details behind the design of this field

As part of HESA’s Data Protection considerations of processing of special category data within its collections, we have risk assessed the SEXID field and its valid entries. Risks were identified in our initial proposal for SEXID in the Personal Characteristics and Equality data consultation: 

1. No mechanism to enable a data subject’s right to decline to provide the information (risk to the rights of data subjects – lack of control over the provision of very sensitive data). 
2. There was no valid entry that allowed accurate recording of a data subject’s choice not to provide the information (accuracy).
3. “Prefer not to say” value is not visible to data subjects (transparency risk).
4. The field appeared to conflate sex with gender (transparency).
5. The way the SEXID question was posed could have caused data subjects to feel they were forced to out themselves (risk of causing distress to data subject).
6. Given the imbalance of power between the provider and data subject (whether staff or student) the risk of data subjects feeling they have no choice but to provide this personal information was worsened (risk of causing distress to data subject).
7. Gender identity is collected in another field so collection of gender information in the SEXID field could result in an overcollection of data (data minimisation).

We assessed these risks inherent in the SEXID field as being very high to the risk and rights of data subjects and therefore requiring suitable treatments to bring the risk down, these included:

1. No mechanism to enable data subject’s right to decline to provide the information

• The proposed valid entries for the SEXID field are “Male / Female / Other”. There was no mechanism to record a refusal to provide the information or to record the absence of the information. 
• There was insufficient information about what “Other” means, which may have caused return of gender rather than sex information. 
• The combination of a lack of alternative valid entry to record a refusal to provide the information and the lack of clarity about what this field is seeking to record (gender or sex) means that the SEXID field could have caused a data subject to 'out' themselves. This would have also curtailed their choice to provide or withhold their personal data. This lack of control, combined with the potential to feel forced into providing the data, could be distressing to data subjects, especially where they feel they are outing themselves when they do not want to. 
• Clearly defining the purpose of the SEXID field as collecting legal sex (e.g. sex at birth as per birth certificate or sex declared on a Gender Reassignment certificate) and providing clear guidance to providers to support this. The valid entry “Other” will collect any third sex that is legally recognised in international countries, which will allow for the accurate recording of such third sexes. 
• The provision of guidance and clarification about the SEXID field recording the legal sex of a data subject removes the risk of conflation of gender and sex in this field (and therefore the risk of forcing data subjects to out themselves). Legal sex is collected by a wide range of organisations in the course of life and so we consider that the collection of this data in the proposed way is less likely to cause distress to data subjects. 

2. There was no valid entry that allowed accurate recording of a data subject’s choice not to provide the information 

• Added a valid entry to allow “Prefer not to say” to be accurately recorded. 

3. “Prefer not to say” field is not visible to data subjects

• “Male / Female / Other” will still be visible to data subjects and “Prefer not to say” will be available to providers to record a data subject’s refusal to provide the information. This provides a mechanism to enable data subjects’ rights and brings the risks associated with curtailing data subjects’ rights over their data down. 
• Given the proposal to collect legal sex in the SEXID field (and not gender information), and that legal sex is collected by many organisations in the course of daily life, we consider that the collection of this field without the “Prefer not to say” field visible to data subjects poses lower risk to data subjects rights and freedoms. We will, however, keep the operation of this field under review and consider any feedback from providers or/and data subjects regarding its use. 

4. The field appeared to conflate sex with gender

• We have provided guidance to state that this field will only collect legal sex, therefore removing the potential confusion of gender and sex. 

5. The way the SEXID question was posed could have caused data subjects to feel they were forced to out themselves

• As point 1 above.

6. Given the imbalance of power between the provider and data subject (whether staff or student) the risk of data subjects feeling they have no choice but to provide this personal information was worsened

• As point 1 above. 

7. Gender identity is collected in another field so collection of gender information in the SEXID field could result in an overcollection of data

• As point 4 above.

Striking a balance

SEXID data is needed for measurement over time and widening participation purposes and therefore it is important we keep a high quality of data in this area. There were concerns raised that the format that includes "prefer not to say" carried the potential of decreasing data quality, causing an increase in “Prefer not to say” returns for this category and devaluing the field. This is the first time we would allow an opt out of this question and we appreciate that this marks a significant change for this field. 

Taking account of these concerns, we consider that this format strikes a balance between the need for quality data with the upholding and enabling of the rights and freedoms of data subjects. As the “Prefer not to say” valid entry will not be displayed, it is much less likely that a significant number of such responses will be returned and therefore the impacts on data quality are less likely.

The Gender Identity or Transgender questions record a change of sex with the recommended option of “Prefer not to say” being available to the data subject. Our recommendation is that both questions are asked together to provide greater transparency as the fields relate to each other. Recognising the complexities involved in data collection in this area, we will also give advice to providers to support them to collect this information consistently. 

From a data protection perspective, HESA considers that the presentation of this SEXID field is now fairer, more transparent and collecting sufficient and more accurate sex identifier data.  

HESA are recommending the following proposal is implemented in Data Futures, ITT and Staff records from 2022/23.

• Change guidance question to: “What is your sex?” 
• Guidance given that this should be based on sex at birth as per birth certificate or sex declared on a Gender Reassignment certificate. Therefore, SEXID will now be recording legal sex. 
• “Other” would only be used only for a third sex that is legally recognised by another country. 
• Definitions: Prefer not to say – student/staff member doesn’t want to declare the information; Not available – the provider is not able to get this data in order to send it to HESA. 
• Guidance given that this question should be asked alongside the Gender Identity or Transgender questions. 

The high-level reasons behind each code:

• “Female” and “Male” are needed, now in alphabetical order.
• “Other” would only be used only for a third sex that is legally recognised by another country - this will recognise the scenarios where, for example, an international student/staff member has a legal sex other than male or female. It should also reduce potential inaccuracy issues around the conflation of gender with sex under ‘other’ (some validation may be introduced to only allow non-UK nationalities to use this code).
• “Prefer not to say” will be added where providers have been unable to collect this data in their student record/HR systems.
• “Not available” will be added, to allow cases where it is not possible to supply the information (such as a cyber-attack), this shouldn’t be an option presented to students/staff members explicitly (validation may be introduced to require justification for use of this code).