Data Bill: First They Came for Trans People

On May 12, the Data (Use and Access) Bill, also known as the UK data protection reform, came back to the House of Lords for what was supposed to be its final stage. However, this story is not about how the Lords have decided to start a Parliamentary “ping-pong”, but about an amendment that would introduce a duty for digital verification providers to record “sex at birth” of individuals.

This amendment would, in other words, stick a “transgender” label on users of digital verification services. Unsurprisingly, this is raising fears among the transgender and queer community in the UK, which already faces the fallout of the UK Supreme Court ruling on trans women.

Likewise, the pace by which the UK debate around transgender identity has creeped into the UK data protection reform speaks volumes about the risk that the DUA Bill poses for everyone’s rights: by enshrining powers that allow the government to rewrite data protection rules without meaningful Parliamentary scrutiny, the DUA Bill politicises data protection, thus exposing all of us to our rights being denied whenever the politics of the day demands or allows it.

And, to paraphrase a well known poem, first they came for trans people…

WHERE DATA PROTECTION MEETS TRANS RIGHTS

Someone or something (say, an algorithm) will always have to take a look at your record to decide if you’re entitled to health insurance, a benefit, a loan, a VISA application, a salary increase, a discount at your local convenience store. As data-driven decisions creep into every aspects of our lives, you will have no rights without the right to know about this information, to correct it, to control how it is used. This is, in a nutshell, what data protection is about: as your data has become an extension of your identity, your personality, your life, data protection rights allow you to assert your own interests and retain control over your life.

Enter the UK Supreme Court, and a judgment that is problematic or, in the words of the British Medical Association, “scientifically illiterate”. On top of that, many groups are weaponising this ruling to enforce a moral vision of the world—where “men were men and women were women”—above the need to protect the identity and right to self-determination of transgender people. The significance of this debate cannot be understated: following the post war period, and in response to the Holocaust—and to centuries of human’s personalities and their dignity being abused or erased in the name of a god, an ideology, or someone else’s morality—European nations developed the aspiration to put individuals and the protection of their dignity, freedom and welfare at the heart of their legal and constitutional order.

The debate sparked by Supreme Court decision marks a political push for a decisive, retrograde step against this principle. Perhaps unsurprisingly, data protection is the battlefield where those seeking to turn back the clock of history have chosen to fight their next battle.

ERASING TRANS PEOPLE FROM PUBLIC RECORD: MAYBE NOT TODAY, CERTAINLY TOMORROW

An amendment that would force public authorities to collect data on members of the public on the basis of sex at birth has been creeping in throughout the DUA Bill parliamentary debate and, by last, was supported by the Lords. If approved in the final version of the Bill, this amendment would force digital verification providers to put your “sex at birth” on your record, forcing out every trans person and exposing them to the risk of hate crimes and discrimination. Some commentators also pointed out that this could “could force public bodies, including the NHS and the DVLA, to update sex data to match sex”, potentially leading to the erasure of their data and of vital documents such as medical records, and to the denial of several important gender-based procedures such as smear tests or prostate screenings.

The chances of this amendment making it into the final version of the Bill are somewhat slim. Nevertheless, this amendment materialises the fears that we have long expressed about the UK data protection reform, where the provision of undemocratic “Henry VIII powers” would allow any government to change data protection rules according to the politics of the day. If Parliament were to oppose the amendments above, there is nothing in the Bill that would prevent any government from reintroducing these provisions via Statutory Instrument and without meaningful Parliamentary scrutiny.

How could this look like in practice? For instance, Clause 28 allows the government to publish at their discretion a so-called “digital trust framework”, i.e. the rules that digital verification providers need to comply with. This could be used by any government to force digital verification providers to record and disclose “sex at birth” when in use, thus forcing every trans person to either expose themselves or be excluded from government digital services. Likewise, Clauses 70 and 71 allow any government to introduce new legal bases for processing and exemptions from the purpose limitation principle. These powers could be used to legalise data sharing and enable the cross-referencing and matching of “sex at birth” data with the credit card you used to pay your toilet fee, or your gym’s membership’s card — for instance, to check whether you’re entitled to use the female toilet or changing rooms.

It is important to notice that the scenario above is not a stretch: it is in the nature of Henry VIII powers to be open-ended and allow the government of the day to rewrite the rules without boundaries. Therefore, there is nothing in the law that could be used to prevent any government from picking up on trans people.

BRACE YOURSELVES: THE WORST IS YET TO COME

The Data (Use and Access) Bill introduces an undemocratic and dangerous legal framework that allows data protection rules to be rewritten and weaponised against anyone—today it is transgender people, tomorrow it may be migrants, trade unionists, or any other category from the well known poem mentioned above. There are not limitation that would prevent such abuse, and this is by design.

This issue has been known for a long time: already in 2023, ORG and another 26 human rights organisations wrote to the conservative government to warn against the inclusion of undemocratic powers in the Bill and the risks they would introduce. Fast forward to 2024, a new Labour government won the elections, running on a manifesto with CHANGE written on the front page in big capital letter. However, the Labour government then purposely chose to resurrect the UK data protection reform and leave these issues unchanged, opting to protect the commercial interests of large technology companies instead. Digital rights and policies may not be a mainstream feature of the political discourse, but they invariably and accurately reflect government priorities.

The Labour government may have abandoned its progressive cause, but we at Open Rights Group will keep fighting to reclaim our future back and drive society forward, not backward.