While we wait, yet again, does anyone know if section 13.182 (the erroneous section that claimed that sex was likely to be "special category data") has been updated so it now accurately reflects the law. This is something Sex Matters specifically noted as erroneous.
Is the text after "relevant systems and resources " (below) additional, and does it solve the issue that Sex Matters pointed out?
From Sex Matters: https://sex-matters.org/posts/updates/what-is-in-the-new-guidance/
Section 13.182 says:
“Information about sex is likely to constitute special category data for the purposes of the Data Protection Act 2018 (DPA) and UK General Data Protection Regulations (GDPR). Processing personal data should be done with regard to that legislation and the constraints of the relevant systems and resources.”
This is wrong in law.
Article 9(1) of UK GDPR defines special category data as “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.” It does not include sex.
From the Code as laid to Parliament: https://www.equalityhumanrights.com/sites/default/files/2026/EHRC_Code_of_practice_for_services_public_functions_and_associations.pdf
13.182 Information about sex is likely to constitute special category data for the purposes of the Data Protection Act 2018 (DPA) and UK General Data Protection Regulations (GDPR). Processing personal data should be done with regard to that legislation and the constraints of the relevant systems and resources. Any information about the sex of individuals which is obtained and held by a service provider should be held securely and not be retained longer than reasonably necessary for the purpose of dealing with admission of
each individual or for ongoing legitimate purposes. Legitimate purposes may include, for example, equality monitoring or service planning reasons, in which case thought should be given to anonymising data, where possible. Access
to any personal information should be restricted to people who legitimately need access to it for those purposes. This should be done with regard to the constraints of the relevant systems and resources.