Blanket policies on harassment case data sharing likely unlawful

According to the guidance issued by Universities UK, the question of whether personal data from harassment cases should be shared should be considered on a case-by-case basis with reference to “their specific facts and risks to the individuals involved”.

Employment law expert Rebecca Stephen of Pinsent Masons said that the new guidance is likely to represent a “step change” for many universities, while Harriet Dwyer, also of Pinsent Masons, said the guidance is relevant to organisations operating in sectors beyond higher education.

Universities and other higher education institutions have long grappled with the issue of disclosure of personal data when managing harassment complaints, particularly around outcomes and sanctions. Institutions have been seeking to balance the interests and rights of both the reporting party and the subject of the complaint. However, they are failing to learn from the outcomes of a report or complaint around harassment. This is serving as a barrier to the reporting of such incidents by staff and students alike.

The UUK guidance has encouraged universities to have the confidence to share more information on outcomes and sanctions with reporting parties where appropriate and reasonable. It has highlighted that data protection law should not be seen as a barrier to sharing information where lawful to do so and where it is done in line with data protection. However, it said that information about specific sanctions levelled on the subject of a complaint, such as the level of disciplinary warning, should ordinarily not be shared.

The new UUK guidance is in two parts. There is an overarching strategic guide (38-page / 2.05MB PDF) aimed at senior leadership teams and those leading on strategies to tackle harassment, and there is an accompanying practical guide (61-page / 1.02MB PDF) for those working on harassment cases and tasked with making decisions on whether to share personal data. The practical guide contains data sharing impact and risk assessment tools to guide universities through the decision-making process. The UK’s data protection authority, the Information Commissioner’s Office, was consulted on the guidance.

Rebecca Stephen said: “Whilst the guidance encourages the need to undertake an assessment and share outcome information where ‘proportionate and justifiable’, it does put the onus on individual institutions to carry out that assessment and balancing exercise on a case-by-case basis and ensure there is an audit trail of decision making.”

Stephanie Badrock, also of Pinsent Masons, said: “The latest guidance does not give institutions the answers as to whether personal data can be shared with reporting parties or not, as these decisions should not be based on blanket policies and each case should be determined appropriately on its specific facts. However, what it does provide is very clear and useful tools to assist universities in making these difficult decisions on whether or not data can be shared.”

“Hopefully the guidance will also enable universities to have the confidence to share more information on disciplinary outcomes and sanctions with reporting parties, where it is appropriate and reasonable to do so,” she said.

In November 2020, UUK published a set of recommendations designed to decisively tackle racial harassment as part of efforts to address racial inequality in UK higher education. The recommendations came 18 months after the Equality and Human Rights Commission uncovered widespread evidence of racial harassment on university campuses.

Some examples of misconduct or harassment could constitute a criminal offence. Guidance developed by Pinsent Masons in conjunction with the UUK that was published in 2016 offers help to institutions on how to handle these difficult issues and provides some specific recommendations in relation to sexual misconduct.