What you should know about anti-harassment procedures
Harassment - both psychological and sexual - in the workplace is an offence and harassers can be subject to disciplinary and/or criminal proceedings. Most EU institutions have informal anti-harassment procedures in place and appointed counsellors to help mediate conflicts confidentially. The purpose of these procedures is to determine if formal investigation and disciplinary proceedings are necessary or if the issues can be resolved in another manner. Since victims are in a vulnerable position, their need for confidentiality must be carefully balanced against the rights of the alleged harasser to be informed and to have access to her personal data (also referred to as personal information).
What are the main data protection issues?
Data quality - It is important to make a distinction between hard data (who claims to be harassed by whom, what steps have been taken?) and soft data (the content of the allegations). While institutions have to make sure that the data they process are accurate and true, for soft data this means whether the statement that was made by the person concerned and has been accurately recorded. [...] The alleged harasser may claim that the allegations are unfounded, but this is separate to the issue of data quality.
Right of information - Victims need to be able to rely on the confidentiality of their interactions with the counsellor. Therefore, the right of the alleged harasser to be informed may need to be restricted. In practice, at the informal stage of the anti-harassment procedure, alleged harassers will only be informed about the procedure with the consent of the victim.
Right of access - Ordinarily, people have a right to access the personal information being processed about them. However, the alleged harasser's right of access to the allegations (which constitute personal data about her) may be restricted in order to protect the victim.
Right of rectification - Inaccurate hard data should be rectified. For soft data, such as a statement made by the alleged victim, which by its very nature is subjective, the right of rectification on the grounds of inaccuracy only applies to the fact that specific statements have been made by the person concerned and that they have been correctly recorded (see above data quality). Another person involved, for example the alleged harasser, who does not agree on the statement, cannot get it changed in the file but may ask to add their point of view to the file.
Retention periods - In principle, the notes made in confidence by the counsellor should not be kept after the anti-harassment procedure has concluded. Only that information which can help identify repeat offenders (hard data) can be kept for a certain period of time. If information is required for statistical purposes, it should be anonymised.
Transfers - To respect the confidential nature of the counselling procedure, only hard data may be transferred by the counsellor to the HR service of the organisation in order to identify repeat offenders. Counsellors should not disclose soft data.
More information
The following non-exhaustive list is a selection of documents for further reading on anti-harassment:
EDPS Guidelines:
EDPS Guidelines on anti-harassment procedures
EDPS Guidelines on the Rights of Individuals with regard to the Processing of Personal Data, especially p. 33
EDPS Guidelines on administrative inquiries and disciplinary procedures
EDPS prior-check Opinion:
Joint Prior Check Opinion on anti-harassment procedures in a number of agencies (2011-0483)