encryption gdpr
Is extracting gender specification by utilising author names from scientific publications GDPR-compliant?
<p>It is clearly stated in the <a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en" rel="nofollow noreferrer">European Commission website</a> that gender is considered as &quot;Personal data&quot; which is &quot;sensitive&quot; and is subject to specific processing conditions.</p>
<p>However, I am not sure about extracting gender specification on the data that is publicly available such as scientific publications (authors name) or patents (inventors name)? Yet the extraction of gender information requires a process for extracting authors' names and using external API services (i.e <a href="https://gender-api.com/" rel="nofollow noreferrer">Gender API</a>).</p>
<p>Would such experiment be compliant with EU regulations and GDPR? If not, and the gender extraction is considered as &quot;sensitive&quot; analysis, what would be the &quot;specific processing condition&quot; to mitigate any potential risks?</p>

<p>I think that the gender will likely not be sensitive in the context of your experiment, but whether your experiment would be GDPR-compliant would depend on the details.</p>
<blockquote>
<p>gender is considered as &quot;Personal data&quot; which is ‘sensitive’</p>
</blockquote>
<p>Yes, the gender of a particular person is that person's personal data, since (a) the person is <em>identifiable</em> and (b) the information about their gender <em>relates</em> to this person. This satisfies the definition of personal data in Art 4 GDPR.</p>
<p>No, it will likely not be sensitive data. GDPR defines special categories of data in Art 9 which require additional protection. This includes information regarding the sex life or health of the data subjects. In most cases, the gender of a person does not reveal such information. However, this depends on the purposes for which  the data is processed. E.g. information regarding gender could be sensitive information when processed in the context of trans persons.</p>
<blockquote>
<p>data that is publicly available</p>
</blockquote>
<p>Whether data is publicly available makes no difference for GDPR compliance. Public personal data is still personal data, and you will need a legal basis etc. for processing it.</p>
<p>The only impact I know for using publicly accessible data is in respect to your information obligations under Art 14(2)(f): “the controller shall provide the data subject with the following information […]: from which source the personal data originate, and if applicable, whether it came from publicly accessible sources”.</p>
<blockquote>
<p>the extraction of gender information requires a process for extracting authors name and using external API services (i.e Gender API).</p>
</blockquote>
<p>You are not required to use an external API. You could use local techniques to estimate the gender.</p>
<p>Note that names are not necessarily clearly gendered, and that this depends a lot on the cultural context of the name. E.g. “Alex” or “Kim” are common examples of unisex given names in a western context, whereas the latter is also a common Korean surname.</p>
<blockquote>
<p>Would such experiment compliant with EU definitions and GDPR?</p>
</blockquote>
<p>Yes, an experiment that would involve estimating the gender of publicly available names <em>could</em> be GDPR-compliant. The usual GDPR concerns for handling personal data (such as names) apply.</p>
<p>If you use an external service for this experiment, you will need to consider GDPR compliance for using a service. Either the service acts as your data processor, which requires that you perform due diligence and sign an agreement with them, but then you have no special conditions. Or the service acts as their own data controller, in which case you will need a legal basis for sharing the personal data with this service. However, given that the personal data in question was made public by the data subjects themselves, this could strengthen an argument that you have a legitimate interest for sharing the data. A legitimate interest always requires a balancing test between that interest and the data subject's rights and expectations.</p>

<p>I would think that you don’t actually get the person’s gender but some software’s guess what the gender would be. The software you use gives an example: “We found 100 people named Elizabeth and they were all female”. If there is a transgender man named Elizabeth your software will get it wrong, and you won’t have his GDPR protected true gender, but an incorrect guess.</p>
<p>Of course discrimination against a person because of their incorrectly guessed gender would be illegal. And if your incorrect guess causes them damages, that might cause you a legal problem. And if your software didn’t guess but look up data in a database so it is the true and correct gender, that might or might not be a problem with GDPR.</p>
