From ‘Code’ to ‘Guidance’: Revising the Instrument on Data and Employment

1. INTRODUCTION

Employers have long been interested in data-driven people management. Frederick Taylor was already arguing for a ‘scientific management’ approach to labour by the late 1800s,¹ and Henry Ford was known to patrol his factory floor with a stopwatch, timing workers’ motions.² Technological changes have opened the floodgates to these practices on a much wider scale.³ Workers across the socio-economic spectrum can be evaluated along multiple axes in real-time – through GPS monitors, wearable sensors, keystroke trackers, screenshots, communication sentiment analysis and more.⁴ The rise of machine learning has enabled the identification of hidden correlations in these huge datasets, and big data analytics has morphed into ‘people analytics’.⁵

The potential harms of such practices are both deep and diffuse.⁶ Yet many of these harms – from health and safety violations to privacy invasions – are age-old issues in the labour context, and are consequently dealt with under various existing laws.⁷ Meanwhile, the personal data processing operations which underpin most algorithmic management tools are largely dealt with under data protection law.⁸ A comprehensive review of the legal implications of algorithmic management recently concluded that while there are ‘significant gaps in the legal protection’, there are also various ‘current laws [which] are potentially effective’ and ‘important steps… should be taken to ensure that these laws are better known’.⁹

That employers are struggling to understand and apply the law on algorithmic management is clear from the Department for Digital, Culture, Media & Sport (DCMS)’s recent call for views on reforming data protection law.¹⁰ Two examples are particularly telling.

The first relates to the obligation for data controllers to carry out a data protection impact assessment (DPIA) prior to processing which is ‘likely to result in a high risk to the rights and freedoms of natural persons’.¹¹ Article 36 GDPR requires data controllers to ‘consult the Commissioner prior to processing’ where a DPIA indicates that processing would result in an unmitigable high risk to the rights and interests of the data subjects. Few controllers deem such consultation to be necessary: as of December 2021, the UK data protection authority had been approached just 17 times by data controllers proposing high-risk processing; only two of these cases were employment-related.¹² These low numbers stand in contrast with the many documented cases of workers’ personal data being processed with inadequate mitigations for risks to rights and freedoms,¹³ indicating that employer compliance with Article 36 is limited at best.

In its recent consultation, DCMS proposed to remove the mandatory consultation requirement altogether and replace it with ‘collaborative dialogue between organisations and the ICO’.¹⁴ Following stakeholder feedback, DCMS has continued to insist that it will proceed with the proposal of removing the mandatory requirement in favour of a voluntary mechanism.¹⁵ This response seems perverse: the answer to a lack of clarity should be clarification, not abolition.

DCMS’ proposals cast a similar shadow of uncertainty over the current requirement for automated decisions with significant effect to receive meaningful human review.¹⁶ The consultation highlights the lack of case law on how the requirement ‘works in practice, or indeed how the UK GDPR is interpreted in specific AI contexts’,¹⁷ with the application of the provision to the use of algorithmic tools in recruitment to automatically reject applicants at the sift stage being given as a specific example.¹⁸ DCMS sought views on the complete removal of the human oversight requirement,¹⁹ again responding to a lack of clarity by proposing to abolish the protection altogether. After the ‘vast majority of respondents opposed the proposal to remove Article 22, with respondents noting that the right to human review of an automated decision was a key safeguard’,²⁰ DCMS instead declared that it would consider ‘how to amend Article 22 to clarify the circumstances in which the Article must apply’.

The urgent need for clarity should mean that the Information Commissioner’s Office (ICO)’s proposed employment guidance is welcome.²¹ Unfortunately, the current proposals suffer from some serious shortcomings. In part, these shortcomings stem from a lack of ambition on the part of the ICO: despite significant contextual changes, the proposed instrument would retain a structure which dates back to 2005.²² Other problems are more fundamental. The existing ‘code of practice’ on data protection and employment will be replaced with mere ‘guidance’ which will have no legal significance; and the new instrument will focus narrowly on data protection law, leaving workers and employers to decipher its interaction with the myriad other codes of practice. In short, guidance is needed, but the substance and form of the forthcoming instrument will not fulfil the necessary function.

These issues are symptomatic of a broader phenomenon in both the labour context and the data protection context: quasi-legislative instruments have been promulgated over the course of decades without adequate thought being given to their objectives or to the structural and constitutional decisions necessary to ensure those objectives are met. Rather than proceeding with the proposals on guiding employer data practices, the ICO and policymakers should take the opportunity to step back to reassess how employer data practices should be guided.

This article proceeds by first highlighting some key internal shortcomings in the forthcoming quasi-legislation. Section 3 takes a step back to consider the legal insignificance of the instrument, while section 4 takes an even wider lens, highlighting the difficult questions which must be answered if any guidance instrument is to be effective. Section 5 places the ICO’s proposed instrument in context, explaining why issuing separate instruments on different aspects of the employment relationship is ultimately unhelpful. We conclude by calling for a broader rethinking of the status and purpose of ‘quasi-legislation’ in the employment context, and we highlight how the rise of algorithmic management – which creates novel interactions between historically discrete areas of law – could be a key inflection point to inspire this rethinking.

2. FIXING THE BASICS: INTERNAL SHORTCOMINGS

The proposed instrument explaining the law on employer data practices seems promising. Even on its own terms, however, the ICO’s proposal is flawed. Since its first iteration in 2005, the Employment Practices Code has been structured around four topic areas: recruitment, selection and verification; employment records; monitoring at work; and information about workers’ health.²³ The intention was that each part could ‘stand alone’, with employers advised to ‘choose’ parts of the code depending on ‘the relevance to [their] organisation of each area covered’.²⁴ From an historical perspective, division into the four topic areas made sense. The technology which employers used to monitor workers once differed from that used in recruitment, for example; and different data protection considerations applied to the different activities.

Such a division is no longer tenable. Management is now mediated through all-in-one software packages which fully or partially automate numerous HR functions – including recruitment, pay, scheduling, employee monitoring and performance management.²⁵ Any attempt to define employers’ data protection obligations by activity will thus be both over- and under-determinative: over-determinative because the same obligations will apply to all activities, resulting in repetition throughout the guidance; and under-determinative because confining the discussion to certain activities may give a false impression that data protection considerations only arise in those instances.

Imagine, for example, an employer who is considering purchasing a service in which an algorithm vendor captures event logs from a handheld scanner at a warehouse. The event logs are stored by the vendor and analysed to generate monthly employee performance scores. To determine the legality of this proposal, should the employer look at ‘employment records’ or ‘monitoring’? Similarly, some employers track their employees’ physical movements for occupational health and safety reasons.²⁶ Where records are generated and stored, should employers look for guidance under ‘employment records’ or ‘health’? While some issues thus fall to be dealt with repeatedly under multiple headings, other pervasive practices would appear to fall through the cracks: under what section would data processing for automated scheduling or automated pay be covered, for example?

The ICO has explicitly recognised that ‘[m]uch has changed’ since the old Code was issued,²⁷ and its stated aims in updating the Code include ‘reflect[ing] the changes in the way employers use technology and interact with staff’.²⁸ Despite this recognition, the ICO’s initial call for views proposed that the new guidance should ‘retain [the original four] topic areas’.²⁹ A few months later, the ICO summarised the consultation responses: many suggested that the guidance would ‘need to address other topic areas’, including ‘cross-cutting topics’ such as ‘the increasing use of AI and algorithmic decision-making… impacting on several areas, including… recruitment… monitoring… performance management… [and] allocation of work’.³⁰ Some suggested that a more fundamental restructuring might be necessary, such as by reference to the data protection principles.³¹ The ICO nonetheless reiterated that ‘[w]e think the new guidance should retain the four main topic areas from the [old] code’.³²

3. LEGAL STATUS: FROM ‘CODE’ TO ‘GUIDANCE’

Fixing the structure of the instrument would not be a silver bullet. Despite replacing the Employment Practices Code, the ICO has been clear that it has ‘no plans to issue a new code of practice in this area’³³ – the new instrument will be mere ‘guidance’. The reason for the apparent downgrade is that the Data Protection Act 2018 withdrew the ICO’s power to issue ‘codes of practice’ autonomously, which it had relied upon to issue the first Employment Practices Code.³⁴ The rationale behind this withdrawal is hard to divine³⁵ and stands in contrast with the powers afforded to Advisory, Conciliation and Arbitration Service (ACAS) and the Equality and Human Rights Commission (EHRC).³⁶ In a context of rising risk, a shift from ‘code’ to ‘guidance’ might seem concerning.

Confusingly, though, the downgrade is actually of no legal significance. Although the old instrument had the facial authority of being called a ‘code of practice’, unlike the ACAS and EHRC codes³⁷ it too had no legal status before courts or tribunals.³⁸ The implications of this became clear when an employee was dismissed on the basis of information obtained through covert video surveillance.³⁹ The Employment Appeal Tribunal considered the alleged violation of the Employment Practices Code as irrelevant to the fairness of the dismissal, pointing out that:

The Employment Practices Data Protection Code is expressly guidance. No statutory provision requires it to be paid regard to… It is not obvious to see why ignorance of a code which the employer was not bound in law to have regard to in any event would render an investigation into the wrongdoing of the Claimant unreasonable when it would otherwise have been reasonable.⁴⁰

To understand the nature of ‘codes of practice’ in data protection law, a brief review of history is necessary.

A. ‘Codes’ and Data Protection Law

‘Codes of practice’ first appeared in the Data Protection Act 1984 as wholly voluntary instruments drawn up by trade associations to provide ‘guidance in complying with the data protection principles’.⁴¹ The Data Protection Act 1998 altered this position by extending the power to create ‘codes of practice’ to the Information Commissioner.⁴² The Commissioner had already had the power to disseminate ‘information’ about data protection law, so this addition merely permitted a more authoritative name to be given to formal guidance.⁴³ It was this new power to issue ‘codes’ without legal effect which formed the basis for the Employment Practices Code.

However, by 2008, the wholly voluntary nature of codes had proven unsatisfactory: a report on data sharing co-authored by the Information Commissioner suggested that data controllers were relying on a ‘plethora’ of ‘piecemeal and outdated guidance’, and that a statutory code of practice on the issue – that is, a code of practice with some legal status – should be created.⁴⁴ An amendment to primary legislation was duly made in 2009, requiring the Information Commissioner to promulgate a data-sharing code which tribunals and courts would be required to take it ‘into account’ when dealing with relevant questions.⁴⁵

Surprisingly, this new legal status was not extended to other existing data protection ‘codes of practice’, such as the Employment Practices Code, which in legal terms remained mere guidance. A confusing two-tier framework thus emerged. This is particularly surprising when one considers that the 2008 report had itself challenged the ‘piecemeal’ nature of the guidance and had noted that a requirement for courts to consider a data sharing code would be ‘in keeping with similar codes in other fields’, including employment.⁴⁶ Despite its apparent incoherence, the two-tier structure of codes of practice was expanded when further statutory (or ‘tier one’) codes were added in 2017 and 2018.⁴⁷ The legislative history discloses no rationale for maintaining the confusing idiosyncrasy,⁴⁸ and indeed the issue appears to have been skimmed over in some Parliamentary debates.⁴⁹ The ICO’s website does not even try to explain the distinction, stating simply that:

The ICO is required under the Data Protection Act 2018 (DPA 2018) to produce four codes of practice… The DPA 2018 also allows the Secretary of State to require the ICO to prepare other codes of practice…⁵⁰

Moreover, although ‘codes of practice’ (of either shape) can now be issued only by the ICO, trade associations retain the authority to issue voluntary ‘codes of conduct’, compliance with which can help to demonstrate conformity with certain specified provisions of the General Data Protection Regulation (GDPR).⁵¹

B. Choosing a Legal Status

Although the change is nominal only, there is a risk that it will impact on compliance. Anecdotal evidence indicates that employers are already ignoring ‘guidance’ promulgated by the ICO.⁵² Yet the desirability of according ‘codes’ legal status also remains unclear. While one might expect that the proliferation of ‘codes of practice’ over the past two decades to have been guided by empirical research, the opposite is true: the piecemeal regulatory landscape belies an absence of empirical evidence. Ganz’ seminal 1987 work on ‘quasi-legislation’ such as codes of practice found that many instruments were ‘too recent to have yielded any results’,⁵³ and while research on employer awareness of the Race Relations Code of Practice carried out by the Commission for Racial Equality in 1989 reached generally positive conclusions, we can find no comparable research on the impact of equality codes in employment published since then.⁵⁴ A 2011 report on the ACAS Code of Practice on disciplinary and grievance procedures did establish that that Code enjoys broad familiarity among employers,⁵⁵ but given its special legal status, the example is not representative.⁵⁶ By contrast, early research on the ACAS Code of Practice on disclosure of information to trade unions found the instrument to be of ‘limited relevance’ in the collective bargaining context.⁵⁷

The absence of evidence makes it difficult to reach any conclusions about what status an instrument guiding employer data practices should have in order to be effective. This is a question for policymakers, but it is not one that has been answered. Indeed, the issue of status was not even addressed in the ICO’s initial proposal.

The legal status of a non-legislative instrument is, moreover, not only an empirical question. It is also a constitutional one. While ‘quasi-legislation’ is now a familiar and accepted part of the legislative scene,⁵⁸ its role has not always been uncontroversial.⁵⁹ As codes of practice for the industrial context became increasingly commonplace from the 1970s onwards, scholars began to raise concerns about requiring such instruments to be ‘taken into account’ by courts and tribunals.⁶⁰ Chief among them was the concern that codes of practice could be used to indirectly impose rules which had not been agreed by Parliament.⁶¹ Codes receive little parliamentary oversight: the most common process for their approval is the negative resolution procedure,⁶² which involves no line-by-line analysis of codes or opportunity for amendment.⁶³

This is not to say that quasi-legislation is inherently constitutionally problematic. Recent caselaw has established that quasi-legislation ‘does not have the binding effect which a statutory provision or a statutory instrument would have’.⁶⁴ Moreover, although public bodies must generally follow their own published policies,⁶⁵ the court has the final say when it comes to interpreting legislation:

[Quasi-legislation] cannot supersede statutory provisions passed by the legislature, nor can it restrict, qualify or extend statutory provisions… where guidance is given amounting to an interpretation of [statute], it should be borne in mind that only the courts can interpret the law authoritatively.⁶⁶

The instruments do not, however, come without risk. Several codes of practice were adopted in the 1980s for reasons of apparent of ‘political expediency’ which restricted workers’ collective action rights in controversial ways.⁶⁷ The Code on Picketing, for example, suggested a limit of six pickets at any workplace entrance⁶⁸ – a limit which did not exist in the statute, but which continues to influence judicial approaches to this day.⁶⁹ As Elias commented in relation to restrictions imposed by the contemporaneous Closed Shop Code:

[I]t is constitutionally unacceptable that [provisions impacting collective action rights] should be in a code rather than the body of the law. It comes close to the Government directing the tribunal to reach a particular decision and then disowning responsibility for it.⁷⁰

While these codes no doubt reflected the zeitgeist of 1980s industrial relations, there are still indications that codes are being used by the executive to avoid legislative reform. A very recent example is the Government’s promise of a new ‘statutory code of practice’ on ‘fire and rehire’ (dismissal and re-engagement)⁷¹ following the P&O Ferries scandal.⁷² Calls have long been made for specific legislative changes to be made in relation to the same issue, but a bill on ‘fire and rehire’ practices failed to pass a second reading in 2021.⁷³ Similar trends can be seen in data protection law: following calls for a statutory inquiry into data protection breaches by news publishers in 2018, the Government instead proffered a statutory code.⁷⁴ Meanwhile, concerns about parliamentary oversight remain well-placed: recent governmental proposals on certain data protection codes of practice have suggested replacing the negative resolution procedure with alternative executive sign-off.⁷⁵

In short, codes of practice should not be adopted as a ‘political compromise between conflicting pressures to do nothing and to enact legal rules’.⁷⁶ Against that backdrop, it is notable that the proposed guidance on employer data practices follows consistent calls for a legislative to algorithmic management,⁷⁷ including in a recent report by an All-Party Parliamentary Group.⁷⁸ While the initiative comes from the ICO rather than the executive, the risk remains that the existence of a code of practice will bolster the Government’s previous response to calls for legislative reform: that ‘existing law meets the concerns raised’.⁷⁹

4. GUIDING EMPLOYER DATA PRACTICES: CLARITY OF PURPOSE

The significance of replacing the Employment Practices Code with ‘guidance’ therefore has both practical and constitutional implications. To be capable of empirical evaluation and constitutional consensus, the purpose of the instrument must be clear. Most fundamentally, will the new document explain legal minima or set higher standards?

A. Clarifying Legal Obligations?

The ICO’s stated intention is to provide a ‘new, more user-friendly online resource’ which ‘addresses the changes in data protection law; reflects the changes in the way employers use technology and interact with staff; and meets the needs of the people who use [the ICO’s] guidance products’.⁸⁰ Clarification of legal obligations is one of the ICO’s functions,⁸¹ and since codes of practice are not bound by the strictures of potential judicial interpretation,⁸² they can explain the law in language accessible to a layman. As Ganz explains:

The precise legal language in which statutes and statutory instruments are couched so that the courts will not be able to misunderstand the will of the legislature, forms an enormous obstacle to understanding and use which can be circumvented by the use of informal rules written in ordinary everyday language and not given direct legal force.⁸³

Giving such instruments indirect legal force, by requiring a court or tribunal to take a party’s compliance with the instrument into account when considering compliance with a legal obligation, for example, can provide greater certainty for readers, but entails the constitutional concerns detailed above. These constitutional concerns become more marked when the ‘explanation’ is not accurate, as where complex legal obligations are oversimplified or misrepresented.⁸⁴

B. Recommending Best Practice?

Even more difficult is the situation where instruments contain ‘recommendations’ which go beyond the law. Despite the ICO’s stated intentions to focus on ‘data protection law’, the old Employment Practices Code was structured around ‘good practice recommendations’.⁸⁵

Setting higher standards is potentially useful: Ganz identified that in addition to clarification of obligations, another ‘basic reason for preferring quasi-legal or non-legal rules to law’ is that ‘persuasion may be preferable to compulsion’.⁸⁶Craies on Legislation similarly suggests that ‘[w]here the government wants to control, it should legislate, in clear justiciable terms; where it wants to influence, particularly where attempts to control are unlikely to be successful or helpful, quasi-legislation will often be the appropriate and desirable mechanism.’⁸⁷ The ICO is required to consult with stakeholders in the course of issuing codes of practice, and codes of conduct are created by trade associations – so both forms of quasi-legislation do provide potential avenues for co-construction of good practice standards.⁸⁸

The distinction between obligation and recommendation should be made clear, however, which is not the case in the existing ICO Employment Practices Code.⁸⁹ The question of legal status is also omnipresent: is it constitutionally acceptable to give indirect legal force to standards which go beyond the law?

5. DATA PROTECTION LAW IN ISOLATION

Whether the instrument will explain legal minima or establish higher voluntary standards, one thing is clear: it will deal only with data protection law. Meanwhile, the five ACAS codes of practice, the Employment Statutory Code of Practice on equality, the multitude of Approved Codes of Practice from the Health and Safety Executive and various other codes and guidance on trade unions will continue to bear upon aspects of data-driven employment decisions. If the purpose of quasi-legislation is to simply, in its current form it does the opposite.

Concerns about the potential emergence of a complex quasi-legislative web were first raised in a 1944 note by Robert Megarry,⁹⁰ which highlighted a ministerial ‘assurance’ made in Parliament about the application of a provision of the Workmen’s Compensation Act 1925 as an example of the ‘haphazard promulgation’ of ‘quasi-legislation’ which was taking lawyers outside the ‘reasonable comfort and safety’ of a ‘world bounded by Acts of Parliament, Statutory Rules and Orders and judicial decisions’.⁹¹

It seems Megarry’s fears have proven well-founded. Consider, for example, an employer’s use of an automated tool to identify job applicants with unionist tendencies.⁹² Personal data ‘revealing… trade union membership’ is designated as ‘special category’ under the GDPR,⁹³ and the processing of such data is tightly restricted under data protection law.⁹⁴ Meanwhile, the Blacklisting Regulations 2010 make it unlawful for employers, employment agencies and others to compile, supply or use a blacklist of trade union members or activists for purposes such as employment vetting or treatment of workers.⁹⁵ An instrument which deals with one regime but ignores the other will hardly be helpful.⁹⁶

Despite such obvious overlaps, the new guidance on employer data practices is unlikely to even cross-reference other areas of law. The ICO’s recent Guidance on AI and data protection, for example, recognises the risks of discriminatory algorithms but limits itself to ‘guidance on interpreting the discrimination-related requirements of data protection law’, explicitly avoiding any discussion of the interplay with equality law standards.⁹⁷ Employers and workers, then, are left to work out how the ICO’s guidance on ‘discrimination-related requirements of data protection law’ relate to the EHRC’s guidance on discrimination law itself.

Cross-referencing to other instruments would be a positive step: the EHRC’s Employment Code, for example, cites employee protection legislation and summarises relevant provisions where necessary.⁹⁸ An even better alternative would be a co-produced instrument explaining how the various legal regimes apply to given practical examples. A recent report for the TUC ‘strongly recommend[ed]’ the creation of guidance ‘on a cross-disciplinary basis’ between the EHRC, ACAS, and the ICO, as well as the Centre for Data Ethics (CDEI) – a government expert body with expertise in data and AI policy – and bodies representing industry and labour.⁹⁹ Joint statutory guidance by the ICO and EHRC was also proposed by the Institute for the Future of Work (IFOW)’s Equality Task Force in its report on AI accountability.¹⁰⁰

Regulatory cooperation is a frequently lauded aim, and features in the ICO’s most recent Information Rights Strategic Plan;¹⁰¹ the EHRC’s draft strategic plan for 2022–25;¹⁰² and ACAS’ 2021–25 strategy.¹⁰³ The recently established Digital Regulatory Cooperation Forum, set up to establish regulatory collaboration, demonstrates that regulatory co-operation is a government priority – although the HSE, the EHRC and ACAS are all excluded from the consortium.¹⁰⁴ It seems likely that a single code on employer data practices, co-produced by all of the relevant regulators, would serve employers and workers better than a plethora of codes issued by different regulators.¹⁰⁵

6. CONCLUSION

There is a clear need for clarity on the legal framework regulating algorithmic management. At first glance, the ICO’s proposed Employment Practices Code might seem a useful instrument for achieving such clarity. The structure, status, and content of the instrument will be hamstrung, however, by an absence of constitutional debate and empirical evidence on quasi-legislation. These absences have translated into a much larger problem in both employment and data protection: quasi-legislation has proliferated without adequate thought being given to its role and efficacy. As well as the data protection code (or guidance), employers are also expected to be aware of the ACAS codes of practice,¹⁰⁶ the code of practice on equality law,¹⁰⁷ codes on trade union recognition and derecognition ballots,¹⁰⁸ and on picketing¹⁰⁹ and a series of codes of practice on workplace health and safety – among other instruments. The absence of careful deliberation and empirical evidence has meant that the only consistent theme is heterogeneity.

First, legal statuses vary: while many codes of practice are issued by regulators and ‘taken into account’ by tribunals and (in some cases) by courts,¹¹⁰ codes of practice on some topics in data protection law have no status before judicial bodies.¹¹¹ It seems likely that such instruments are followed less closely than their higher-status counterparts, but there is no evidence to that effect. A similar diversity can be seen when one looks at form and content. Some codes of practice are short and instructive, while others are longer and more discursive. The ACAS Code of Practice on disciplinary and grievance procedures contains only 47 paragraphs, while the Equality and Human Rights Commission (EHRC)’s Employment Statutory Code of Practice comes to 321 pages. The existing Employment Practices Code comes to 100 pages,¹¹² while its replacement will be an online ‘hub’ of unspecified size.¹¹³

Rather than ploughing ahead with another isolated piece of guidance, the rise of algorithmic management should provide an opportunity for the ICO and policymakers to take a step back and reassess the regulatory landscape. Guidance on how historically discrete areas of law interact to regulate a new phenomenon is clearly helpful. The form, status, and content of that guidance should be a matter for careful consideration.

In 2011, the Law Commission found that ‘the amount of guidance’ on adult social care was causing ‘difficulties’; that there was ‘overwhelming support’ for a ‘single code of practice’, or at least ‘consolidated guidance’; and that consultees’ concerns included ‘confusion about the precise legal status of the various pieces of guidance’.¹¹⁴ It seems likely that a similar review of quasi-legislation in data and employment would be more fruitful than another piece of siloed guidance.

We acknowledge funding from the European Research Council under the European Union’s Horizon 2020 research and innovation programme (grant agreement No 947806).

Footnotes