The disclosure of salary transparency reports and compensation criteria: How to apply the equal pay law in harmony with the general data protection law?

Abstract

Law No. 14.611, enacted on July 3, 2023, ensures salary equality and remuneration criteria between men and women. Article 5 of the aforementioned law mandates that private companies with 100 (one hundred) or more employees submit biannual reports to the Ministry of Labor. These reports contain anonymized personal data and indicate the remuneration criteria, enabling the analysis of salary conditions and the internal dynamics of each company.

According to §1 of Article 5, these reports allow for an objective comparison of salaries, remuneration, and the proportion of leadership, management, and executive positions occupied by men and women. Additionally, the documents provide statistical data on established employment relationships, aiming for greater transparency in hiring and preventing inequalities related to factors such as race, ethnicity, nationality, and age. The preparation of these reports complies with Law No. 13.709/2018, known as the General Data Protection Law (LGPD).

Considering that several companies in Brazil have more than 100 employees, the requirement imposed by Article 5 of Law No. 14.611/23 has sparked controversy, particularly regarding its reconciliation with the fundamental principles of the LGPD. The main controversy arises from the lack of specification on how the reports should be published, the criteria for assessing salary equality, and the means to ensure compliance with LGPD principles. The normative command assumes that omitting data such as an individual’s CPF (Brazilian tax ID) or name is equivalent to anonymization. However, in practice, cross-referencing information may allow the identification of the position holder and the exposure of sensitive data that should remain confidential.

For example, in companies with only a few high-level positions, such as CEO (Chief Executive Officer) and CFO (Chief Financial Officer), merely disclosing the job title may be enough to reveal the occupant’s identity and salary. Under LGPD regulations, information related to employees’ income and remuneration is considered sensitive and must be treated as confidential, respecting workers’ privacy. Therefore, the requirement imposed by Article 5 of Law No. 14.611/23 presents significant risks regarding data security.

Although Decree No. 11.795, issued on November 23, 2023, was introduced to regulate Law No. 14.611/23, its wording does not provide sufficient guidelines for companies to implement the legal provisions in compliance with the LGPD. The decree requires that reports include employees’ positions or occupations, as well as detailed values of all labor-related payments. Moreover, it establishes the obligation to publish these reports on the company’s digital platforms, such as institutional websites and social media, ensuring public access.

However, this requirement may lead to the identification of employees, particularly in trusted positions or roles with a limited number of occupants. Even without disclosing names or identification documents, making this information public could compromise employees’ privacy.

To further complicate matters, failing to publish the reports results in penalties, including an administrative fine of 3% of the company's payroll, capped at 100 minimum wages, as stipulated in §3 of Article 5 of Law No. 14.611/23.

Due to the divergence between the laws, it is observed that private companies are not fully complying with the requirements of the new decrees, often refraining from providing the required information out of fear of violating data protection rights. At the same time, companies strive to disclose the necessary information but struggle to determine the correct way to do so without facing penalties under either the LGPD or Law No. 14.611/23.

It is concluded that companies must be effectively monitored to ensure compliance with salary equality. However, it is essential that this oversight occurs without infringing on employees’ privacy, adhering to the principles of the LGPD and ensuring the protection of sensitive data.