ET Workbench

Foundations · 3

Data protection and the judgments

A not so quick word on data protection.

· 4 min read

Bar chart of judgments mentioning each protected characteristic, led by disability in 12,788
These are mentions in the text, not findings. One judgment can mention more than one characteristic.

Employment Tribunal judgments are full of personal information about claimants, managers and witnesses, much of it sensitive. Holding a complete copy of the register, analysing it and publishing what the analysis finds is processing of personal data, and the fact that the tribunal has already published the judgments does not take it outside data protection law. This article sets out how I have approached that.

Public, but still personal data

The register is published under the Open Government Licence, but the licence expressly excludes personal data. It deals with reuse as a matter of copyright, not data protection.

Discrimination claims turn on protected characteristics, so judgments routinely record a claimant’s disability and its effects, their religion, sexual orientation or ethnic origin, and the medical evidence about how the treatment affected them. Across 134,000 judgments, that is special category data on a large scale, and a systematic project with published results is not a purely personal activity. Open justice is a strong reason why processing the judgments is lawful and fair, but it has to be applied through the legislation rather than around it.

The basis for processing

Understanding how the tribunal decides cases, and making that available to practitioners and to claimants who represent themselves, is consistent with the purpose for which judgments are published. The analysis cannot be done without the judgments, the people named in them can reasonably expect them to be read, cited and analysed, and nothing in the project leads to a decision about any individual.

For special category data, the condition is research in the public interest (Article 9(2)(j), with paragraph 4 of Schedule 1 to the Data Protection Act 2018), subject to the research safeguards in Chapter 8A of the UK GDPR as amended by the Data (Use and Access) Act 2025: the processing must not be likely to cause substantial damage or distress, and must not be used to take measures or decisions about particular individuals. Neither is a feature of this project. Articles that discuss individual cases are published for journalistic and academic purposes, within the exemption for the special purposes in paragraph 26 of Schedule 2 to the 2018 Act.

Safeguards

Four features of the project keep the processing proportionate.

  • The judgments are held on one computer. The collection is not held in cloud storage. The judgments are downloaded, indexed and analysed on the same machine, using a model running locally. Where a result was uncertain, the relevant passage was sent to Anthropic’s Claude, a cloud AI service, to decide. Only published judgments are processed, and no client or other non-public personal data.
  • The collection follows the register. Judgments are occasionally withdrawn, or replaced with anonymised versions following a privacy order. Anything withdrawn from the register is deleted from the collection and from every index and dataset built on it, and anything replaced is downloaded again. That check runs as part of every update, and judgments found to have been withdrawn are removed.
  • Figures are checked. Every extracted figure is verified against the text of the judgment, doubtful results are set aside, and corrections are invited.
  • The processing is being assessed. Large-scale processing of special category data requires a data protection impact assessment, and one is in draft.

Publishing from the data

The awards viewer, described later in the series, lists each injury to feelings award with the case name, the protected characteristic, the band and amount, and a short note of the tribunal’s reasons. I have kept the case names. Decisions are identified by them in the register, the law reports and the commercial databases, and a practitioner needs the name to find and check the decision.

The risk lies in the compilation rather than any single entry: a list that places a name beside a protected characteristic and the effect the treatment had. Three measures address it, and they follow the practice of the established free-law services. The viewer is excluded from search engines, so a search for a claimant’s name online will not lead to it, although it can be searched from within the page. The reasons are confined to the legal factors that set the level of the award, such as the duration of the conduct, the severity of its effect and the consequences for the claimant’s work, rather than details of medical conditions or personal circumstances. And the viewer follows the register: a judgment removed or anonymised on GOV.UK is removed or anonymised in the viewer at the next update.

Telling people

Where personal data is obtained from a source other than the individual, the controller must normally tell each person concerned. With many thousands of people named across the register, that would be disproportionate, and Article 14(5)(b) allows the information to be made publicly available instead. The site’s privacy notice does that: what is held, why, for how long, and how anyone named in a judgment can ask for a correction or removal.