The 'DPIA+': Aligning data protection with UK equality law.

Area of Science:

• Data Protection Law
• Human Rights Law
• Equality Law

Background:

• Data protection scholarship increasingly recognizes the General Data Protection Regulation's (GDPR) potential beyond individual rights.
• Tools like Human Rights Impact Assessments (HRIA) and Fundamental Rights Impact Assessments (FRIA) aim to capture broader societal harms from data processing.
• Existing frameworks for widening the scope of the GDPR's Data Protection Impact Assessment (DPIA) require adaptation to national contexts.

Purpose of the Study:

• To develop a jurisdiction-anchored expansion of the DPIA (DPIA+) by integrating the UK Public Sector Equality Duty.
• To highlight the distinct yet overlapping nature of equality and human rights law in data protection.
• To explore the value of an equality-inflected DPIA+ in critical contexts, such as public health emergencies.

Main Methods:

• Integration of the UK Public Sector Equality Duty (s.149 Equality Act 2010) into the DPIA framework.
• Comparative analysis of equality law and human rights law in the context of personal data processing.
• Case study consideration of the DPIA+ in life-and-death scenarios, exemplified by the Covid-19 pandemic.

Main Results:

• A proposed 'DPIA+' framework that incorporates national legal duties, specifically the UK's Public Sector Equality Duty.
• Identification of equality law's proactive duty to investigate discrimination risks and its utility as an evaluative template.
• Demonstration of how an equality-inflected DPIA+ can enhance risk assessment in sensitive areas like public health data.

Conclusions:

• Augmenting the DPIA with both equality and human rights law provides a more comprehensive approach to identifying and addressing data processing risks.
• Equality law offers unique contributions, such as proactive discrimination risk assessment, complementing human rights frameworks.
• The DPIA+ concept acknowledges the need for context-specific legal integrations to effectively manage data protection and societal harms.