Complainants must be informed of the results of investigations into sexual misconduct

When a student is accused of gender-based violence or harassment, it is common practice to keep the investigation confidential.

However, with the increasing number of investigations and disciplinary proceedings for sexual misconduct being conducted in UK universities, the data protection rights of victims are not always given the same level of care and attention.

In England, the Office for Students has asked universities to implement a “demonstrably fair” investigation and decision-making process. What does this look like in terms of data sharing and confidentiality?

As we report in a new article in legal studiesNot only is it necessary to balance the potentially conflicting privacy rights of the alleged perpetrator and the victims (or responding and reporting parties in industry parlance), universities must also keep in mind the parties’ rights to equal access to education, protection from degrading treatment, and due process. They must also respect their own institutional obligations to their wider campus communities.

Two guidelines published in 2022 – by Universities UK (UUK) and law firm Eversheds Sutherland (on behalf of UUK) – suggest ways forward. But what they show perhaps most clearly is that data sharing in harassment cases is a complex and still evolving area of ​​practice. Various points of contention remain, which we believe could create serious injustices for both victims and the campus community more broadly.

One question is how institutions should respond when they receive multiple reports about the same person from different victims, none of whom wish to make a formal complaint. Serial offenders are a common factor in sexual violence, so this is a very timely issue. Should universities respond to such complaints?

The Information Commissioners’ Office has drawn up a list of exemptions under the GDPR for “public protection functions”, which could include informal disclosures naming a suspected offender. Existing guidelines make it clear that this data can therefore be stored and processed. Nevertheless, the UUK guidelines call for this mechanism to only be used in cases of “serious” harm, while saying little about how the severity should be determined.

We propose instead that all details about the same person should be recorded and linked where possible. However, this requires the existence of an appropriate system for storing this information, a robust mechanism for identifying common patterns and a careful and trauma-informed approach to engaging victims. Currently, UK higher education institutions have a long way to go in this regard.

Further complex issues arise in relation to the sharing of data during the investigation process. Universities can collect a large amount of evidence in the form of personal and private information about the parties involved. However, the relevance and probative value of such information often needs to be thoroughly assessed to avoid violations of the data protection principle of data minimization.

Institutions also run the risk of sharing this information too readily with the students against whom the complaint has been made, often under the false belief that this is required to protect their natural legal rights. Victims and survivors may write lengthy statements – 10,000 words is not uncommon – to support their experiences, including details of impact and sensitive personal information about mental or physical health. In one example from our research, a victim and survivor’s statement was shared in full with the student who had allegedly perpetrated sexual violence and coercive behavior against her. This horrified her because she felt reading her statement would give him an insight into her suffering (including the associated feelings of shame and humiliation) which in effect perpetuated the abuse.

But this over-disclosure does not seem to apply the other way round. Our research has found that some UK universities continue to interpret data protection laws in a way that means the victim/survivor has no right to see the perpetrator’s statements.

Furthermore, at the end of a complaint or disciplinary process, universities often refuse to provide victims/survivors with details of the outcome of the process, including any sanctions resulting from it. This is contrary to the 2020 recommendation of the Equality and Human Rights Commission that complainants should be informed “where appropriate and possible” of “the steps taken to (…) address the specific complaint and of the steps taken to prevent a similar occurrence in the future”. However, this is in line with UUK guidance, which overemphasises the risks to the alleged offender of disclosing the sanctions (for example, to their professional reputation).

Little attention is paid to the risks to the victim/survivor that result from the secrecy of the results. For example, the victim may be left unable to defend themselves against claims that they made a false accusation. The lack of an effective resolution at the end of a difficult process can also undermine their sense of physical and psychological safety and impact their ability to continue their education in a variety of ways. They may feel that reporting was a waste of time and lose trust in their university. Or they may feel unsafe on campus and unable to defend themselves against retaliation from the perpetrator and/or their allies.

The same applies to the wider student community. Universities have a duty of care and responsibility to ensure equal and safe access to education.

While universities have the freedom to interpret data protection laws in different ways, there needs to be strong guidance from regulators – such as the Office for Students in England – on how to protect the privacy of all those involved in such investigations. Given the lack of clear guidelines and the fear of the potential consequences of a data breach, it is understandable that universities’ instinct is to be opaque. But at the very least, universities should show the same level of care towards victims.

Higher education controllers must ensure that they understand the specific context of gender-based violence sufficiently to properly assess the risks in the different scenarios they face, where ill-informed disclosure or non-disclosure can have life-changing consequences.

Clarissa DiSantis is Sexual Misconduct Prevention and Response Manager at Durham University. Kelly Prince is an Education Development Advisor at the University of York. Vanessa Munro is Professor at the Faculty of Law, University of Warwick; Sharon Cowan is Professor of Feminist and Queer Legal Studies at the University of Edinburgh. Anna Bull is a lecturer in education and social justice at the University of York. Her article, “Data, disclosure and obligations: balancing privacy and protection in relation to complaints of sexual misconduct by UK university students” is published in legal studies.