Changing the culture: sharing personal data in harassment cases

Our strategic guide and practical guide aim to help universities understand when best to share data, and practical ways of sharing data when it is appropriate to do so. 

Sharing data in harassment cases was identified as a key challenge for universities by the Equality and Human Rights Commission (EHRC) in their inquiry into racial harassment in higher education in 2019.

Responding to this, we were tasked by the EHRC with working with the sector, the Information Commissioner’s Office (ICO) and data protection officers (DPOs) to develop sector guidance to increase understanding around when it is appropriate to share personal data when managing harassment complaints.

Strategic guide

The purpose of the strategic guide is to:

• enable universities to have the confidence to share more information on outcomes and sanctions with reporting parties where it is appropriate and reasonable to do so 
• move away from blanket policies to either always refuse or always allow the sharing of personal data in harassment complaints, investigations and disciplinary proceedings, so that each case can be handled appropriately on its specific facts
• raise awareness of the benefits of sharing more information with reporting parties to inform and support conversations between frontline practitioners supporting students, staff working on complaints and DPOs

Practical guide

The purpose of the practical guide is to:

• offer practical recommendations for approaching decisions to share, or not share, personal data in relation to harassment cases. It particularly focuses on the sharing of information relating to outcomes and sanctions.
• provide a framework to support universities in their decision-making process taking account of legal, regulatory, policy and wellbeing reasons for sharing data
• identify specific situations where it may be appropriate to share information on outcomes and sanctions in complaints, investigations and disciplinary proceedings, where it is reasonable to do so.

How universities should use this guidance

• The strategic guide outlines the underlying principles and themes of the guidance. This will be most useful for those leading on strategies to tackle harassment, such as senior leadership teams.
• The practical guide sets out the technical elements of this guidance, including the Data Sharing Risk and Impact Assessment. This will be most useful for those working on harassment cases on a day-to-day basis, who will be regularly making decisions as to whether to share personal data.