The 'DPIA+': Aligning data protection with UK equality law

In recent years, data protection scholarship has moved beyond the assumption that the General Data Protection Regulation ('GDPR') is solely concerned with individual rights. Tools such as the Human Rights Impact Assessment ('HRIA') and the Fundamental Rights Impact Assessment ('FRIA') have been promoted to apply the GDPR more expansively, capturing broader societal harms that may flow from personal data processing. These tools can widen the scope of the GDPR's Data Protection Impact Assessment ('DPIA') through aligned consideration with human rights law. They have been outlined at an international level, but require adaptation to national contexts in practice. This article advances the discussion in three ways. First, it develops a jurisdiction-anchored expansion of the DPIA ('DPIA+') by integrating the UK Public Sector Equality Duty in s.149 Equality Act 2010. Second, it highlights equality law as both overlapping with, and distinct from, human rights law. In the UK, equality law imports a proactive duty to investigate risks of discrimination, while also providing an evaluative template in the form of an Equality Impact Assessment. Finally, it considers the distinctive value of an equality-inflected DPIA+ in life-and-death contexts, such as the Covid-19 pandemic. The open-ended term 'DPIA+' acknowledges that various legal frameworks may supplement a DPIA in each national context. The central argument, however, is that equality and human rights law should be considered together when augmenting a DPIA, as both can help identify and address risks of discrimination in personal data processing.