We lead womens lives: we have no choice.
Thus has the Chief Justice of Canada, the Rt Hon Beverley McLachlin, summed up the basic truth that women and men do indeed lead different lives.
How much of this is down to unquestionable biological differences, how much to social conditioning, and how much to other peoples views of what it means to be a woman or a man, is all debateable and the accepted wisdom is perpetually changing.
But what does not change is the importance, even the centrality, of gender in any individuals sense of self.
Over the centuries many people, but particularly women, have bitterly resented and fought against the roles which society has assigned to their gender.
Genuine equality between the sexes is still a work in progress.
But that does not mean that such women or men have not felt entirely confident that they are indeed a woman or a man.
Gender dysphoria is something completely different the overwhelming sense that one has been born into the wrong body, with the wrong anatomy and the wrong physiology.
Those of us who, whatever our occasional frustrations with the expectations of society or our own biology, are nevertheless quite secure in the gender identities with which we were born, can scarcely begin to understand how it must be to grow up in the wrong body and then to go through the long and complex process of adapting that body to match the real self.
But it does not take much imagination to understand that this is a deeply personal and private matter; that a person who has undergone gender reassignment will need the whole world to recognise and relate to her or to him in the reassigned gender; and will want to keep to an absolute minimum any unwanted disclosure of the history.
This is not only because other people can be insensitive and even cruel; the evidence is that transphobic incidents are increasing and that transgender people experience high levels of anxiety about this.
It is also because of their deep need to live successfully and peacefully in their reassigned gender, something which non transgender people can take for granted.
This case is about how the Department for Work and Pensions (the DWP), in administering our complex welfare benefits system, treats people with a reassigned gender, and specifically whether certain policies conflict (1) with the Gender Recognition Act 2004; (2) with the Human Rights Act 1998; or (3) with the Equality Act 2010.
Those policies have undergone change in the course of these proceedings, as have the arguments presented, and so the issues before this Court are in some respects different from the issues before the High Court and the Court of Appeal.
The facts
The appellant has undergone gender reassignment from male to female.
Her transition began in 2003 and she changed her name in 2004.
She has undergone full gender reassignment treatment and surgery, which in her case included facial feminisation surgery, in her words because it was incredibly important to her easily to pass as a woman.
Her gender recognition certificate (GRC) was one of the first to be issued under the Gender Recognition Act 2004.
The Gender Recognition Panel notified both the Inland Revenue (now HMRC) and the DWP of the change.
She was employed in a variety of roles, some managerial, until she became unemployed in June 2010.
Since then, apart from a period of employment in 2015 2016, she has been in receipt of Jobseekers Allowance (JSA), a benefit which is administered by the DWP through Jobcentre Plus (JCP) offices.
As a condition of receiving JSA, she has to attend a JCP office in person every two weeks.
Her principal concern in these proceedings is with the way in which her history is recorded by the DWP and the effect that this can have on her interactions with its officials.
She has had a number of distressing experiences which indicate that DWP policies do not effectively protect the privacy of her status but rather tend to draw attention to it.
The DWP policies and practice
The DWP uses a centralised database, the Customer Information System (CIS), to record information relating to each of its customers and everyone else who has a National Insurance number.
The CIS interfaces or links to a number of other computer systems, including over 40 systems within government and quasi government departments, local authorities and HMRC, as well as to benefit specific computer systems, including the Jobseekers Allowance Payments system (JSAPS) which is used to administer JSA.
About 140,000 persons are authorised to access the CIS.
The information recorded on the CIS about a customer includes his or her current sex, the fact that he or she was previously recorded as having a different sex (if applicable), his or her current name and title, and his or her former names and titles (if applicable), the fact that a person has a GRC, its date of issue and date of notification to DWP, and (where this is the case) the reason for a change of recorded sex being gender reassignment.
These data, including the data recording a change of gender, are held for the life of the individual concerned and for 50 years and one day thereafter.
This has been referred to as the Retention policy in these proceedings.
When these proceedings were begun, as long ago as 2012, the fact of a GRC and the reason for a change of sex being gender reassignment were noted in such a way as to be visible to front line users of the CIS, such as staff at the JCP offices.
This has been referred to as the GRC Noting policy in these proceedings.
As a result of these proceedings and changes to the DWPs IT supplier arrangements, those matters are no longer visible to front line staff and so the GRC Noting policy is no longer under challenge.
However, any previous name, title or gender is visible and in the great majority of cases the reason for a change of name, title and gender will be gender reassignment.
Hence, without an extra layer of protection, front line staff could readily infer that gender reassignment had taken place.
That extra layer of protection is achieved through the DWPs Special Customer Records Policy (referred to in these proceedings as the SCR policy).
This sets out special procedures for dealing with the records of certain categories of customer who require extra protection, for example because unauthorised disclosure of their records could result in substantial distress or physical harm.
The categories of customer to which the policy may be applied include, for example, victims of domestic or honour based violence and people with witness protection orders.
But it is not applied automatically to all such people, as we are told that the great majority of those to whom the policy is applied are transgender.
It is, however, applied automatically to all those recorded on the CIS as having a GRC, unless and until the customer asks for it to be disapplied.
The protection is therefore optional, but without it a persons gender history would be readily discernible by staff who needed to access the CIS.
Under the SCR policy, an individuals CIS record receives a protected marking, ranging (at the material time) from private, restricted, confidential, secret to top secret.
Transgender records were marked restricted.
Persons wishing to access them must be specifically authorised and must have a legitimate business reason for doing so; access is limited to a specific purpose or purposes; and it is time limited for a period not exceeding four hours.
Access to an individuals CIS record is not required for the routine issue of benefit payments, including JSA.
However, an adviser will need to access the CIS in order to make routine changes to relevant information, such as a change of address or contact details.
For an SCR customer, this will require the same authorisation process as described in para 12 below.
Authorisations are monitored, so that inappropriate or unauthorised access can be discovered, and this may result in disciplinary action.
Typically, the administration of claims for JSA requires a JCP adviser to access two systems, the JSAPS and the Labour Market System (LMS).
These are both affected by the SCR policy.
The LMS records information about the steps taken by the customer to obtain employment.
But it does not do so for customers who are subject to the SCR Policy.
Instead, their efforts to find work are recorded manually on paper.
When the customers LMS record is accessed, a warning of additional protection facility from unauthorised viewing will pop up directing the adviser to the paper record, which will only be accessed once authorisation is given.
The JSAPS records information which enables an adviser to assess entitlement to JSA and authorise payment.
When an adviser accesses JSAPS to authorise payment to a customer subject to the SCR policy, an error message pops up warning Sensitive account You are not authorised to view it.
Access is then gained through the authorisation process: this involves applying to the DWPs specialist IT team for temporary access to Special Customer Records.
Access is usually available within an hour but it can take considerably longer.
The adviser is warned again that the account is sensitive and no one else should view it.
On access, the front screen does not display previous names, titles or gender or the issue of a GRC and normally there would be no need to search for historical claim data.
If there is such a need, the historical gender identity data will only be available where a claim was made for JSA under a previous name, title or gender and this claim is still live.
It will not be displayed where the claim was made after the change of gender (as in the case of this appellant).
It follows that any JCP adviser processing a JSA claim is bound to learn that the customer is subject to the SCR policy.
The adviser will not usually know why that is the case, but may well be able to put two and two together.
The operation of the policy causes inconvenience and delay in accessing benefits: delays of an hour are usual and they can be as much as three days.
Late payment is, to say the least, a serious inconvenience to anyone on the tight budget required of JSA claimants.
Ringing up to find out why payment has been delayed can also be a serious inconvenience as the authorisation process has to be followed in order for the telephone advisers to access the account.
The alternatives to physically attending at the JCP offices are very limited.
The appellant has on at least three occasions asked to be allowed to sign on by post but been refused.
The appellant also reports some very distressing incidents in JCP offices.
On several occasions she has overheard references to her transgender status in conversations in open plan offices with other customers present.
Once her status has become known within an office she has felt compelled to transfer to another office to protect her privacy and dignity and, indeed, her physical safety.
She adds that she has had some very positive experiences with individual DWP staff members, but every interaction with them, good or bad, is against that background of insecurity and anxiety.
The evidence she has placed before the courts in these proceedings, both from experts in the field of gender dysphoria and from other transgender customers, shows not only the depth of these concerns but also that she is not alone in having them.
These proceedings
After considerable correspondence exploring possible alterations to the DWPs policies, these proceedings were launched in April 2012.
They were then stayed in order that the DWP could review its policies on data retention and implement any changes.
This review concluded that the DWP needed to improve its treatment of transgender customers but did not propose any change to the Retention, GRC Noting or SCR policies in respect of them.
The claim was heard by Simon J in May 2014: [2014] EWHC 2403 (Admin).
All three policies were challenged as being (1) in breach of articles 8 and/or 14 of the European Convention on Human Rights; and (2) directly and indirectly discriminatory contrary to the Equality Act 2010.
It was common ground that the Retention and Noting policies engaged the right to respect for private life protected by article 8(1).
Simon J held that they were not sufficiently clear, precise and accessible to be in accordance with the law for the purpose of justifying them under article 8(2) and granted a declaration to that effect.
However, he held that they pursued the legitimate aims of enabling accurate calculations of state pension entitlement and of reducing opportunities for identity theft and benefit fraud and were a proportionate means of doing so.
He was more doubtful whether the SCR policy even engaged article 8(2), as it was designed to protect privacy, rather than to interfere with it, although it did tend to have the opposite effect of drawing attention to transgender customers; but he held that it was in any event justified by the need to protect DWP staff.
He rejected the claim based on direct discrimination, because the appellant was not treated less favourably than other customers because of her gender reassignment.
He was prepared to assume that the policies were indirectly discriminatory, in that they put transgender customers at a particular disadvantage when compared with others, but they were justified under the 2010 Act for the same reasons that they were justified under the Convention.
Between the High Court judgment and the hearing of the appellants appeal to the Court of Appeal in December 2015, as already noted, the DWP altered its policy and systems so that the fact of a GRC was no longer visibly noted on the CIS (although other facts from which such an inference could be drawn remained).
The challenge to the GRC Noting policy was therefore no longer a live issue before the Court of Appeal.
Furthermore, the Retention policy had been clarified and was now accessible, so the issue of legality was no longer live.
On 9 February 2016, the appeal was unanimously dismissed.
The only judgment was given by Elias LJ, with whom Patten and Black LJJ agreed: [2016] EWCA Civ 47, [2016] PTSR 1344.
He accepted that article 8 was engaged by both the Retention and the SCR policies, but agreed with Simon J that the interference was proportionate.
He rejected the argument that article 14 required transgender customers to be treated differently from others.
Any indirect discrimination entailed in the SCR policy was justified for the same reasons that the interference with article 8 rights was justified.
A new argument, that the policies were contrary to the requirement in section 9 of the Gender Recognition Act 2004 that where a full gender recognition certificate is issued, the persons gender becomes for all purposes the acquired gender was rejected: this did not require history to be rewritten.
Before this court, the appellant challenges the Retention and SCR policies on three grounds: (1) inconsistency with sections 9 and 22 of the Gender Recognition Act 2004; (2) incompatibility with the rights under articles 3, 8 and 14 of the European Convention on Human Rights (article 3 is raised for the first time in this court); and (3) infringement of section 13, 19 or 26 of the Equality Act 2010 (direct discrimination under section 13 was not pursued before the Court of Appeal but is raised again before this court; harassment under section 26 is an entirely new argument).
The Gender Recognition Act 2004
This Act, as is well known, was passed in response to the judgments of the European Court of Human Rights in Goodwin v United Kingdom (2002) 35 EHRR 447 and the declaration of incompatibility made by the House of Lords in Bellinger v Bellinger [2003] UKHL 21; [2003] 2 AC 467.
It lays down the criteria and the process by which a person born in one gender may be recognised as having acquired a different gender.
Section 9 provides for the consequences: (1) Where a full gender recognition certificate is issued to a person, that persons gender becomes for all purposes the acquired gender (so that, if the acquired gender is the male gender, the persons sex becomes that of a man and, if it is the female gender, the persons sex becomes that of a women). (2) Subsection (1) does not affect things done, or events occurring, before the certificate is issued; but it does operate for the interpretation of enactments passed, and instruments and other documents made, before the certificate is issued (as well as those passed or made afterwards). (3) Subsection (1) is subject to provision made by this Act or any other enactment or subordinate legislation.
Section 22 deals with the disclosure of protected information.
Section 22(1) makes it a criminal offence for a person who has acquired protected information in an official capacity to disclose that information to any other person.
Section 22(2) provides that, once a GRC is issued, protected information includes information which concerns the persons gender before it becomes the acquired gender.
Section 22(3) defines the acquisition of such information in an official capacity in such a way as to cover officials in the DWP, and indeed elsewhere in the civil service and otherwise in connection with the functions of a public authority.
Section 22(4) and the Gender Recognition (Disclosure of Information) (England, Wales and Northern Ireland) Order, SI 2005/635, provide for circumstances in which disclosure is not an offence.
These include: 22(4)(h) the disclosure is made for the purposes of the social security system or a pension scheme.
The appellant accepts that section 9 does not rewrite history.
Thus, in J v C [2006] EWCA Civ 551; [2007] Fam 1, the issue of a full GRC in the male gender to a person who was previously female did not retrospectively validate his prior marriage to another female (at a time when the law did not provide for same sex marriages), with the result that he did not become the father of a child born to the other female as a result of artificial insemination by donor (as would otherwise have been the case under section 27 of the Family Law Reform Act 1987, which provided that the husband of a woman who gives birth as a result of AID was to be treated for all purposes as the father of the child).
But she argues that section 9(1) does require her now to be treated for all purposes as a woman and this includes how she is treated by the DWP for the purpose of claiming and receiving JSA.
Section 22(1) is not an exception to the general principle in section 9(1).
Rather it is an additional protection.
It does not follow from the fact that no offence is committed under section 22 that a policy which is in breach of section 9(1) is lawful.
The problem with this argument is that section 9(1) clearly contemplates a change in the state of affairs: before the issue of the GRC a person was of one gender and after the issue of the GRC that person becomes a person of another gender.
The sections which follow section 9 are designed, in their different ways, to cater for the effect of that change.
Thus, for example, section 12 provides that the acquisition of a new gender does not affect that persons status as the father or mother of a child; section 15 provides that it does not affect the disposal or devolution of property under a will or other instrument made before the appointed day (thus section 9 will apply to dispositions made after that date); section 16 provides that the acquisition of a new gender does not affect the descent of any peerage or dignity or title of honour or property limited to descend with it (unless a contrary intention is expressed in the will or instrument).
There is nothing in section 9 to require that the previous state of affairs be expunged from the records of officialdom.
Nor could it eliminate it from the memories of family and friends who knew the person in another life.
Rather, sections 10 and 22 provide additional protection against inappropriate official disclosure of that prior history.
Section 10 and Schedule 3 deal with birth registration.
In summary, if there is an entry in the UK birth register relating to a person to whom a full GRC has been issued, a copy of the GRC must be sent to the appropriate Registrar General.
He or she must make an entry in the Gender Recognition Register (which is not open to public inspection) which makes traceable the connection between that entry and the entry in the birth register.
The entry is used to create a new birth certificate which records the acquired name and gender.
Anyone who may have a copy of the UK birth register entry of a person who has a full GRC may have a copy of the new birth certificate.
This must not disclose the fact that the entry is contained in the Gender Recognition Register: see Schedule 3, paragraphs 5 and 6.
Section 22, as we have seen, protects from disclosure by officials information concerning a persons gender before it became the acquired gender.
It contains several exceptions, including one for disclosure for the purpose of the social security system or a pension scheme.
Obviously, therefore, section 9 contemplates that the previous history may be kept on record, for otherwise there would be no need for the protection given by section 22.
I conclude, therefore, that the Retention and SRC policies are not inconsistent with, or prohibited by, any provision of the Gender Recognition Act 2004.
But that, of course, is not the end of the story.
The Human Rights Act 1998
The appellant rightly emphasises that the 2004 Act was brought about by developments in the jurisprudence of the European Court of Human Rights.
In Goodwin v United Kingdom (2002) 35 EHRR 447, the court held (i) that the failure of UK law to grant legal recognition, including a new birth certificate, to a post operative transsexual was a breach of her right to respect for her private life under article 8; and (ii) that the failure of UK law to permit her to marry in her acquired gender was a breach of her right to marry under article 12.
I would emphasise two passages from the Courts judgment in relation to article 8: 77.
The stress and alienation arising from a discordance between the position in society assumed by a post operative transsexual and the status imposed by law which refuses to recognise the change of gender cannot, in the Courts view, be regarded as a minor inconvenience arising from a formality.
A conflict between social reality and law arises which places the transsexual in an anomalous position, in which he or she may experience feelings of vulnerability, humiliation and anxiety.
The Court was, of course, speaking of the position before the Gender Recognition Act which sought, so far as possible, to align the legal position with social and psychological reality.
But it makes the important point that this is no small matter.
It is not a minor inconvenience.
It goes to the heart of the persons sense of self.
This is reinforced by a later passage at para 90: the very essence of the Convention is respect for human dignity and human freedom.
Under article 8 of the Convention in particular, where the notion of personal autonomy is an important principle underlying the interpretation of its guarantees, protection is given to the personal sphere of each individual, including the right to establish details of their identity as individual human beings.
In the 21st century, the right of transsexuals to personal development and to physical and moral security in the full sense enjoyed by others in society cannot be regarded as a matter of controversy In short, the unsatisfactory situation in which post operative transsexuals live in an intermediate zone [in] not quite one gender or the other is no longer sustainable.
This puts it beyond doubt that the way in which the law and officialdom treat people who have undergone gender reassignment is no trivial matter.
It has a serious impact upon their need, and their right, to live, not as a member of a third sex, but as the person they have become, as fully a man or fully a woman as the case may be.
In the courts below, the appellant relied only on the right to respect for private life, protected by article 8, and the right to enjoy the Convention rights without discrimination, protected by article 14.
In this court, the statement of facts and issues raises for the first time the question of a possible violation of article 3, the right not to be subjected to inhuman or degrading treatment.
In her submissions, however, article 3 was deployed to make the point that there are positive obligations to protect individuals against such treatment, as indeed there are under article 8.
In Identoba v Georgia (2015) 39 BHRC 510, for example, the Strasbourg court found a breach of article 3 where the authorities had failed to protect LGBTI demonstrators from attack by homophobic counter demonstrators.
One aim of the SCR policy is to protect transsexuals against the risk of physical and verbal abuse.
The complaint, as I understand it, is that it may not go far enough in doing so, whether under article 3 or article 8.
In my view, the article 3 cases serve mainly to underline the importance of the interests at stake here, whether under article 3 or article 8.
The real focus of the argument has been on article 8.
In my view, both the Retention and the SCR policies are an interference with the right of the appellant, and all people who have undergone gender reassignment, to respect for their private lives.
The SCR policy may be designed to protect the privacy of their deeply private information but it has the consequence of drawing the attention of front line staff, and maybe others in the office, to it.
Opting out means that front line staff who need it will have unimpeded access to the CIS, in which the gender history is recorded.
So the customer has the choice between unimpeded access on those occasions when front line staff need to consult the CIS and impeded access which in itself draws attention to the possibility, even the probability, that the claimant has undergone gender reassignment.
This is not a minor interference.
On the contrary, it is a very serious matter.
It goes to the heart of how the appellant, and others in her situation, relate to the world and the world relates to them.
So the real question is whether this interference can be justified by the operational needs of the benefits system.
Two legitimate aims are put forward by the DWP for the Retention policy.
The first is the need to retain the information for the purpose of calculating entitlement to state retirement pension.
A transgender person has pension rights in his or her acquired gender from the date of the GRC: Gender Recognition Act 2004, Schedule 5, paragraphs 7 and 8.
This means that the date of the GRC will be material to the calculation of the entitlement of certain customers (those born before 6 December 1953; female to male transsexuals whose change of gender occurs after they have reached statutory retirement age for women and before equalisation on 6 March 2019; and male to female transsexuals whose change of gender occurs before 6 March 2010 and before they have reached state pension age for a man but after they have reached it for a woman).
The DWP will need to know the date for the purpose of checking entitlement at the time and also for checking and maintaining claims during the customers life expectancy thereafter.
With the equalisation of the pension age, there will eventually come a time when this is no longer necessary, but that is some considerable time in the future.
It is accepted that this does not apply to this particular appellant, but it does apply to approximately one third of transgender customers, whose state pension calculation will be directly affected by their birth gender.
The second legitimate aim put forward is to identify and detect fraud.
There is a particular risk of identity theft in the case of transgender customers.
A fraudster may obtain a birth certificate in the customers original name and use this, along with other evidence, to obtain a national insurance number allocated to that name (two linked examples of this were detected in 2012).
The DWP also argue that front line staff are at the forefront of detecting frauds they can sense when something is not right and need to have access to the information to investigate and detect this.
The appellant accepted that these were legitimate aims in the courts below and the evidence in support of them was not challenged.
In her written case before this court she argues that these objectives are not sufficiently important to justify the limitation of a protected right and that those limitations are not rationally connected to the objectives.
She argues that, now that the fact and date of the GRC is masked on the CIS, it cannot be necessary to retain the visible gender (name and title) history in order to calculate state pension entitlement.
As for fraud detention and prevention, there are other ways of verifying the claimants identity.
Under the new system for Universal Credit, front line staff will no longer have access to this information.
The DWP understandably objects to the introduction of new arguments on matters which were conceded in the courts below, and on which it has not been able to file evidence in rebuttal; but they can be addressed briefly.
In my view, for as long as gender is in any way relevant to the entitlement to and calculation of state retirement pension, it is necessary for the data to be retained on the CIS system and the rational connection between the two is obvious.
The question of whether it should remain visible to some front line staff or whether it is feasible to mask it in some way which nevertheless enables those who need to see it to be able to do so are questions which go to the overall balance between the aims pursued and the means used to pursue them, in other words to the proportionality calculation.
As for fraud detection and prevention, the problem lies, not so much with verifying the identity of the genuine transgender claimant but with verifying the identity of the fraudulent claimant who has stolen that persons previous identity.
The legitimacy of the objectives for which the current computer systems are designed cannot be affected by the development of wholly new computer systems to support a wholly new benefits system.
Once again, the real issue is not the aim, but the overall balance between ends and means which is of the essence of the proportionality calculation.
In addressing that balance, several points must be made: (1) While I would certainly not minimise the depth of the intrusion where it takes place, for the most part there is no need for front line JCP staff to consult the CIS.
Whether or not the SCR policy applies, it is only rarely that they will need to access the CIS and thereby discover the historic information recorded there. (2) The DWP has been engaging with the appellant and those advising her over many years in an attempt to understand and cater for her concerns.
Following the High Court decision, the GRC data were masked on the CIS.
If nothing else, this litigation has taught the DWP the importance of doing what can be done within the existing systems to cater for those concerns. (3) We are here dealing with large computer systems, designed to cater for vast numbers of customers, which interact with one another in complex ways.
It is no simple matter to modify existing systems in a way which will not compromise their efficiency and effectiveness.
It is one thing to devise a completely new computer system, such as that now being developed for Universal Credit, and quite another to modify an old one which has been in operation for many years. (4) The DWPs evidence is that it is not possible to make further adjustments to the CIS system except at inordinate expense.
This court is in no position to question that. (5) Most importantly, it is not for this or any other court to administer the benefits system.
That is the business of the DWP.
The courts can correct individual decisions or actions which violate an individuals human rights: if a DWP official gained unnecessary or unauthorised access to a customers records, or made improper use of the information obtained through authorised access, the customer would have a claim under section 6(1) of the Human Rights Act 1998 against a public authority which had acted incompatibly with her privacy rights.
The courts can also correct legal provisions which violate human rights (unless contained in an Act of the United Kingdom Parliament).
But the courts can only rarely correct the systems set up by the responsible government departments or public authorities to administer the law unless perhaps they systemically and inevitably result in violations of individuals rights.
That is not this case. (6) The courts must inevitably place great weight on the judgment of those whose business it is to design and administer those systems.
They are the experts in administration and we are not.
In my judgment, therefore, the courts below were entitled to reach the conclusion that the CIS Retention policy was a proportionate means of achieving its legitimate aims and I share their view.
In reaching this conclusion, I in no way seek to minimise the importance to the appellant and others in her situation of the intrusion into her privacy which is entailed by the policy.
For her, and for others, it must be good news that the Department has taken their concerns seriously, and that they will be differently catered for when Universal Credit is rolled out throughout the country.
The SCR policy and the Retention policy cannot be considered in isolation from one another.
The SCR policy is designed to restrict access to the CIS to those who are authorised because they have a real need for that access.
This of course has the legitimate aim of protecting the privacy of those SCR customers who need and want it.
This brings with it the problems of delay, with its attendant inconvenience or even hardship, and it may well draw attention to the very matter which it is designed to protect.
But such problems are inevitable if access to the CIS is to be restricted.
They can be avoided if the customer does not want the policy to apply, but at the cost of less restricted access to the CIS.
The real question, therefore, is whether the CIS Retention policy is justified and in my judgment, for the reasons given above, it is.
Discrimination
The appellant relies both on discrimination in the enjoyment of Convention rights, in violation of article 14 of the Convention, and on direct and indirect discrimination in breach of sections 13 or 19 of the Equality Act 2010 respectively.
Gender reassignment is a protected characteristic by virtue of sections 4 and 7 of the Equality Act and is undoubtedly a status for the purpose of article 14.
Her submission on direct discrimination, under both article 14 and section 13, is that the policies treat transgender customers in the same way as other customers when in fact their situations are different and they should be treated differently.
As the Strasbourg court held in Thlimmenos v Greece (2000) 31 EHRR 411, just as like cases must be treated alike, unlike cases must be treated differently.
The problem with this submission is that the DWP policies do treat transgender customers differently from others.
For those who want it, the SCR policy applies.
In this respect, transgender customers are in no different position from any of the other vulnerable groups to whom the policy is applied if wanted and needed.
The admitted problems associated with the SCR policy are the inevitable concomitant of offering them this extra protection for their privacy.
Once again, the real complaint is that, once accessed by those with a reason to do so, the CIS reveals the customers previous name and title, from which an inference of gender reassignment may, but need not, be drawn.
However, it is not clear in what way transgender customers are treated less favourably than others on the CIS because of their transgender status.
The current names and titles, and any previous names and titles, of all customers are recorded.
Customers change their names and titles for a wide variety of reasons, not least because of marriage or divorce.
All are treated in the same way.
Of course, a change of sex may often be readily deduced from a change of name and title, whereas other changes may be more speculative.
But all relate to the customers private (and sometimes family) life.
There is no difference in treatment from others who change their name or title because of the customers transgender status.
For these reasons, in my view, Simon J was right to reject the claim of direct discrimination under both article 14 and section 13 and it is not surprising that the direct discrimination claim under section 13 was not pursued, by counsel then appearing for the appellant, before the Court of Appeal.
The indirect discrimination claim under both article 14 and section 19 of the Equality Act relies upon the particular disadvantage that transsexual customers suffer as a result of the Retention and SCR policies, either together or separately, when compared with other customers, whether in general or those to whom the SCR policy is also applied.
I would be prepared to accept, for the reasons given earlier, that many, if not all, customers who have undergone gender assignment feel a greater need to protect that information from others than do customers who have changed their names or titles for other reasons.
Gender reassignment changes ones identity at a much deeper level than does getting married, getting divorced, being bereaved, adopting a new name, or any of the other reasons why a change of name or title may be recorded.
It may also be the case that justification for an interference with the article 8 right is not invariably justification for discrimination under article 14 or indirect justification under section 19.
However, in this case, the provision, criterion or practice in question, the SCR policy, is a proportionate means of achieving a legitimate aim for the purpose of section 19(2)(d) and, for the same reasons, any discrimination involved in the policies is justified for the purpose of article 14.
For the first time in this court, and somewhat faintly, the appellant argues that the DWPs policies, and specifically the implicit outing involved in the SCR, create a harassing environment contrary to section 26 of the Equality Act 2010.
This allegation was not pleaded in the claim form or argued in the courts below and is not clearly spelled out in the appellants case.
Under section 29(3) of the Equality Act, a service provider must not harass a person requiring the service or a person to whom the provider is providing the service.
Under section 26(1), A person (A) harasses another (B) if (a) A engages in unwanted conduct related to a relevant protected characteristic, and (b) the conduct has the purpose or effect of (i) violating Bs dignity, or (ii) creating an intimidating, hostile, degrading, humiliating or offensive environment for B. This is not an allegation which can sensibly be made in a claim for judicial review of the DWPs policies in relation to transgender people.
It might be made in a substantive claim under the Equality Act in relation to the sorts of incidents of which the appellant has complained (and on occasions received some compensation).
Then there would have to be specific evidence directed towards such a claim and the DWP would have the opportunity of investigating the complaint and putting in evidence in rebuttal.
None of that has happened in this case.
But in any event it is quite clear from the DWPs efforts to understand and to meet the appellants concerns within the bounds of practicality that its policies aim to have the reverse effect: to respect the dignity of transgender customers and to avoid creating an intimidating, hostile, degrading, humiliating or offensive environment for them.
There are disciplinary measures in place for staff who are guilty of such behaviour.
In other words, if such behaviour takes place, it is not the system which is to blame.
Conclusion
In my view, the concerns which the appellant has raised before and during these proceedings are very real and important to her, and no doubt to other transgender customers of the DWP.
The proceedings have already brought about some change in DWP policy and no doubt the DWP will continue to consider how the service it offers to transgender customers could be improved.
The introduction of Universal Credit is an opportunity to do this.
But for all the reasons given earlier the Retention and SCR policies are not unlawful under either the Human Rights Act 1998 or the Equality Act 2010 and this appeal must be dismissed.

The issue in this appeal is whether certain policies adopted by the Department of Work and Pensions (DWP) in the administration of the welfare benefits system are, when applied to people with a reassigned gender, in breach of the Gender Recognition Act 2004 (the GRA), the Human Rights Act 1998 (the HRA) or the Equality Act 2010 (the EA).
The appellant C has undergone gender reassignment from male to female.
She was issued with a gender recognition certificate (GRC) in 2006.
Since June 2010 she has been unemployed, apart from a period in 2015 16.
In order to receive Jobseekers Allowance (JSA) she has to attend a Jobcentre Plus (JCP) office in person every two weeks.
The DWP uses a centralised database, the Customer Information System (CIS), to record information about each of its customers, including his or her current sex, the fact that he or she was previously recorded as having a different sex (if applicable), his or her current name and title, and his or her former names and titles (if applicable), the fact that a person has a GRC and its date, and the reason for a change of recorded sex being gender reassignment (if this is the case).
These data are held for the life of the individual concerned and for 50 years and a day thereafter (the Retention policy).
This is because gender at birth at present remains relevant to the calculation of state pension entitlement, and in order to detect fraud.
The fact of a GRC and the reason for a change of recorded sex being gender reassignment is no longer visible to front line staff, but any previous name, title or gender is visible.
Access to an individuals CIS record is not required for the routine issue of benefit payments, but it will be required, for example, to make routine changes, such as a change of address.
However, the DWP also has a Special Customer Records policy (the SCR policy) which applies to certain categories of customer who require extra protection for their privacy and is routinely applied to transgender customers unless they ask otherwise.
This requires specific authorisation for access.
This has the effect that there are delays in accessing the account to authorise payment and it alerts the front line staff to the probable reason for the restricted access.
C has suffered distressing incidents at JCP offices when her transgender status has been openly referred to.
After exploring possible alterations with the DWP, C issued proceedings in 2012.
The High Court made a declaration that the Retention Policy was in breach of the right to respect for private life protected by article 8 of the European Convention on Human Rights (ECHR) as it was not sufficiently
clear and accessible to be in accordance with the law.
It has now been clarified.
Her appeal to the Court of Appeal against the dismissal of her other claims was dismissed.
The Supreme Court unanimously dismisses the appeal.
The Retention and SCR policies are not unlawful under the GRA, the HRA or the EA.
Lady Hale gives the only substantive judgment.
Lawfulness under the GRA S 9 GRA provides that where a GRC is issued a persons gender becomes for all purposes the acquired gender.
It does not rewrite history or require the previous state of affairs to be expunged from official records, but other sections offer additional protection against inappropriate official disclosure of that prior history [23 25].
The Retention and SCR policies are not therefore inconsistent with or prohibited by any provision of the GRA [26].
Lawfulness under the HRA The Retention and SCR policies do constitute a very serious interference with the rights of transgender people to respect for their private life protected by article 8 ECHR [31].
The justifications relied on by the DWP the need to retain information for the time being for the purposes of calculating state pension rights, and to identify and detect fraud are legitimate [34] and rationally connected with the policies [35].
The question is whether the policies are proportionate.
In carrying out the balancing exercise it is relevant that front line staff will only rarely have to access the CIS, that the DWP has been engaging with C over many years to try to understand and cater for her concerns, that it is no simple matter to modify existing computer systems designed to cater for vast numbers of customers, which interact with one another in complex ways, and that it is not possible to make further adjustments to the CIS without inordinate expense.
It is not for the courts to administer the benefits system [36].
The Retention policy is therefore a proportionate means of achieving its legitimate aims [37].
The SCR policy cannot be considered in isolation from it.
It has the legitimate aim of protecting the privacy of those customers who need and want it.
The problems associated with it are inevitable if access to the CIS is to be restricted.
It too is justified [38].
Lawfulness under the EA There is no direct discrimination on the ground of gender reassignment [43].
The details of all customers who change their names and titles are recorded on the CIS [42].
Transgender customers who need and want it are treated differently under the SCR policy [41].
They are not treated less favourably as a result of their transgender status.
The claim of indirect discrimination also fails.
The court accepts that gender reassignment changes ones identity at a much deeper level than name changes for other reasons.
However the SCR policy is a proportionate means of achieving a legitimate aim for the purposes of s 19(2)(d) EA and for the same reasons any discrimination is justified for the purposes of article 14 of the ECHR [44].
