How Pay Transparency and Data Protection Can Be Implemented Together

The principle of equality under Art. 3 (2) of the Basic Law (GG) requires the state to promote the effective realisation of equality between women and men and to work towards the elimination of existing disadvantages. This includes equal pay. On June 6, 2023, a Pay Transparency Directive was adopted, which should already have been transposed into national law but has yet to be implemented in Germany. The aim of pay transparency is to enforce the requirement of equal pay for women and men for the same or equivalent work. However, if information about a specific person’s salary can be traced back to that individual, this also brings the General Data Protection Regulation (GDPR) into play, which requires the protection of personal data. Employers are then faced with the task of disclosing information about pay for the same or equivalent work whilst at the same time protecting their employees’ salary data. In this main topic, we explain how pay transparency and data protection can be implemented together.

European and National Legislation on Pay Transparency

The European legislator is not the first to have sought to create greater pay transparency. 

The National Pay Transparency Act

In Germany, a law to promote pay transparency between women and men (EntgTranspG) was enacted as early as July 30, 2017, and thus before the GDPR came into force. The law gives employees in a company with more than 200 employees the right to request information on the average monthly gross salary of comparable employees. However, the reporting obligations and verification procedures were designed to be voluntary for employers.

The European Pay Transparency Directive

At European level, it was not until June 6, 2023 that a directive was adopted to strengthen the application of the principle of equal pay for equal work or work of equal value between men and women through pay transparency and enforcement mechanisms (ETRL). In particular, the directive includes an obligation to provide pay transparency prior to employment, reporting obligations, as well as claims for damages and sanctions. A right to information is also provided for.

European Directives set binding targets for the Member States of the European Union (EU) and must first be transposed into national law. The directive should have been transposed by June 7, 2026; however, this has not yet happened. As the Directive has not been transposed by national legislators within the prescribed timeframe, certain provisions have direct effect and can be invoked by employees before the courts or regulatory authorities. 

In particular, the directive provides for a right of employees to obtain information regarding their individual pay levels as well as the average pay levels of comparable groups of employees. To fulfil this right, employers must first analyse the individual pay data of their employees. However, in principle, only the comparative figures determined for the reference group – and, where possible, anonymised or aggregated – are disclosed to the employees making the enquiry. The processing of personal data therefore takes place both during the internal analysis and when processing and responding to the request for information.

Once the directive has been transposed into national law, the processing of pay data may be based on the corresponding legal obligation under Art. 6 (1) (c) of the GDPR. Until then, provided no more specific national legal basis applies, processing may be carried out on the basis of legitimate interests in accordance with Art. 6 (1) (f) of the GDPR. This applies in particular to the implementation of the directive’s objectives and to the preparation for the transparency obligations that will become binding in future. In doing so, employers must limit processing to what is strictly necessary and take appropriate safeguards to prevent the identification of individual employees.

Data Protection Principles

The European Directive must comply with other EU law and must therefore also be interpreted in the light of the EU’s General Data Protection Regulation (GDPR). This is explicitly set out in Art. 12 (1) of the ETRL. Protection is afforded not only to the personal data of employees in the comparison group, but also to that of the enquirer. 

Purpose Limitation

The principle of purpose limitation under Art. 5 (1) (b) of the GDPR stipulates that personal data may only be processed for specified, explicit and legitimate purposes. Further processing for other purposes is not permitted. Art. 12 (2) of the ETRL also ties in with this principle, stipulating that personal data in connection with the implementation of the Directive may not be processed for purposes other than the application of the principle of equal pay. Consequently, the information may not be used for individual salary negotiations or performance appraisals. 

Data Minimisation

Art. 12 (3) of the ETRL allows Member States, in the event of the direct or indirect disclosure of the pay of an identifiable employee, to restrict access to the data to employee representatives, labour inspectorates or equality bodies. The transfer of data to third parties must, in accordance with the principle of data minimisation under Art. 5 (1) (c) of the GDPR, be limited to the extent necessary for the purposes in question.

Information Obligations

The processing of personal data must be transparent and comprehensible to the data subject. The specific information is listed in Art. 13 of the GDPR and includes, amongst other things, the purposes of processing, the recipients of the personal data, the retention period and the rights of data subjects. The data protection information provided at the start of an employment relationship must therefore be supplemented with information on the processing of remuneration data to fulfil statutory transparency obligations, provided that the disclosure could enable the data to be linked to a specific individual. Information must always be provided regarding the statistical analysis of individual salary data required in advance.

Technical and Organisational Measures

It is advisable to extend the use of technical and organisational measures to the area of pay transparency. According to Recital 44 of the ETRL, specific security measures should be put in place to prevent the direct or indirect disclosure of information about an identifiable employee. In particular, measures such as access authorisations, pseudonymisation and data aggregation can contribute to the protection of personal data. However, according to Recital 44 of the ETRL, employees should be able to voluntarily disclose their own remuneration data in order to enforce the principle of equal pay.

Retention Periods

The principle of storage limitation under Art. 5 (1) (e) of the GDPR requires that personal data may be retained only for as long as is necessary for the purpose of processing. An important purpose of processing is the defence of legal claims. Until now, applicants’ data has therefore been retained for up to six months in accordance with Section 15 (4) of the General Equal Treatment Act (AGG) and Section 61b (1) of the Labour Court Act (ArbGG). In future, employers must also be able to defend themselves against claims relating to equal pay. A conceivable scenario would be where an employer is compelled, due to the situation on the labour market and difficulties in recruiting employees, to increase the remuneration for a vacant post. If an applicant then brings a claim for gender-based pay discrimination, the employer will need to provide evidence of applicants who did not wish to enter into an employment relationship at the offered rate in order to rebut this presumption. The ETRL is calling for a limitation period of at least three years for claims relating to equal pay.

An extended retention period should not, however, apply across the board to all applicant data. Rather, it may be necessary to retain pay-related documents – such as those concerning the determination of the offered pay, the underlying labour market conditions and comparable recruitment decisions – for the period during which equal pay claims can be asserted and defended. The specific scope of the retention obligations is subject to the national implementation of the ETRL.

In practice, a retention period of three to four years is therefore recommended for the defence against equal pay claims. 

Right to Information under Art. 7 of the ETRL

Under Art. 7 of the ETRL, employees are entitled to request information about their individual pay levels and about average pay levels. Such a right to information has already been incorporated at national level in Section 10 of the EntgTranspG.

In this context, Section 12 (3) of the EntgTranspG explicitly provides for the protection of personal data of the employees affected by the request for information and exempts employers from the obligation to disclose a comparative pay figure where there are fewer than six employees. This is because the smaller the comparison group, the easier it is to identify individual employees. Although the European Directive does not specify a threshold to prevent salary data from being traced back to individual employees, the German legislature is likely to retain the option of defining a threshold under the opening clause in Art. 12 (3) of the ETRL. 

Conclusion

On June 6, 2023, the European Pay Transparency Directive was published; the German legislature still needs to transpose it into national law, having already missed the implementation deadline. Pay transparency is in tension with data protection law. Whilst the disclosure does not, in principle, directly concern the individual salaries of other employees, but rather comparative figures for groups performing the same or equivalent work. However, in order to determine the average pay levels of such groups in particular and to respond to requests for information, employers must first analyse individual pay data. This processing involves personal data; even the comparative figures provided may, in the case of small comparison groups or due to other circumstances, allow conclusions to be drawn about individual employees. Employers must therefore fulfil their transparency obligations whilst at the same time protecting their employees’ salary data.

To ensure that remuneration data is processed in compliance with data protection regulations for the purpose of fulfilling statutory transparency obligations, the salary data must not, in accordance with Art. 12 (2) of the ETRL and the principle of purpose limitation under Art. 5 (1) (b) of the GDPR, be processed for any purpose other than the application of the principle of equal pay. In accordance with Art. 13 of the GDPR, employees must be informed in particular of the purposes of the processing, the legal basis, the recipients or categories of recipients, and the retention period. In addition, appropriate technical and organisational measures – such as access authorisations, pseudonymisation and data aggregation – must be implemented to restrict access to the data and, as far as possible, prevent the identification of individual employees. The retention obligations should not be extended across the board to cover all applicant or employee data. Rather, it may be necessary to retain only those remuneration-related documents required for the assertion or defence of equal pay claims. The specific duration is subject to national implementation and the data protection principle of necessity.

A particular feature is the right of access under Art. 7 of the ETRL. Employees may request information about their individual pay levels as well as the average pay levels of comparable groups of employees. It remains to be seen whether the German legislature will, in line with its previous legislation, set thresholds to protect personal data. In any event, when responding to requests for information, employers must take the comparison group into account on a case-by-case basis and implement appropriate technical and organisational measures to prevent, as far as possible, the direct or indirect identification of individual employees – particularly in the case of small comparison groups. The specific national implementation in this regard remains to be seen.