Skip to main content

Universities UK Changing the Culture: Sharing personal data in harassment cases, strategic guide

Universities UK has published guidance looking at steps institutions should take with regards to sharing information on outcomes in harassment cases, with the aims of improving the understanding around when data can be shared, and supporting effective complaints handling and redress for victims/survivors. The guidance, Changing the Culture: Sharing personal data in harassment cases, strategic guide, was written by Elizabeth Dunford, principal solicitor (technology/data protection) at Coventry University. It encourages institutions to move away from blanket refusals on sharing personal data, towards taking more case appropriate decisions. To accompany the document there is also a practical guide, and a tool to support universities when deciding whether to share personal data and if so, what data to share.

The UUK documents follow guidance from the Committee of University Chairs (CUC) published in May, Tackling Harassment and Sexual Misconduct, which draws on a range of published guidance and interviews at several universities exploring current practice in this area. The main body of the document highlights areas of focus and recommends direct actions that governing bodies should take. The Appendices provides more detailed advice, and practice in other universities.


  • 2020 Office for National Statistics (ONS) publication on victim characteristics reveals that full-time students were more likely to have experienced sexual assault in the last year than people in any other occupation type (CUC p4)
  • Aside from the moral imperative and reputational risk, universities are subject to several legal duties to protect their staff and students from harassment and are expected to have regard to regulatory requirements, political priorities, and good practice as laid out in sector codes and other publications (CUC p4)
  • Governors should seek assurances of the deployment of an appropriate culture, strategy and policies that are owned and understood by the whole institution. This includes the behaviours expected from all members of the university community, the consequences of these being breached, and how the University will respond to reports and complaints (CUC p5, p19)
  • Governors also need to have oversight that there are delivery mechanisms in place which include clear responsibilities, accountabilities, performance targets, and monitoring of the issue and that an appropriate level of resource is in place. A clear approach to communications should also be established, as should engagement and support from staff and students and a system of monitoring and review (CUC p5)
  • The governing body should request regular reports on the University’s commitments to tackling this agenda, such as data on trends and outcomes, including action taken in response to formal reports and complaints, the effectiveness of prevention and response activities, the impact on students and the allocation of resources to prevent and address staff and student sexual misconduct. Governing bodies should promote openness and transparency even in circumstances that do not portray the University in a positive light, including considering with the executive, whether the reports should be published (CUC p5)
  • Appropriate training of staff, governing body members, and students, was common in all institutions interviewed as part of the guidance. Governing bodies should be assured that training is in place and is repeated at regular intervals (CUC p18)
  • The governing body should consider identifying a board champion against harassment and sexual violence. It should engage regularly with staff and students to ensure that the information received at Board triangulates with reports from staff working in this area and students. Space on the agenda for the issues to be discussed should be made available at regular points (CUC p6)
  • Governors should receive assurance that there is appropriate student engagement in campaigns to prevent and address harassment and, if not, the reasons why (CUC p20)
  • A ‘risk-averse approach’ to data sharing on outcomes and sanctions hinders an institution’s ability to deliver effective redress to those making a complaint. It could act as a barrier to encouraging students and staff to report and also represents a missed opportunity to promote the consequences of unacceptable behaviour more widely  (p5 UUK)
  • Universities should maintain communication with all parties throughout the handling of harassment cases, sharing information where appropriate and lawful in accordance with data protection legislation, and managing the expectations of all parties as to what information is likely or unlikely to be, shared with them or about them, and why (p8 UUK)
  • Good practice states that information about outcomes should be shared with reporting parties, wherever possible and lawful to do so (p11 UUK)
  • Greater care must be taken when deciding whether to share information about a sanction. On a case-by-case basis and where appropriate, subject to the requirements of data protection legislation, a university should consider informing the reporting party of any sanctions imposed. It may be appropriate for the reporting party to be told only that sanctions had been applied or that a penalty had been imposed. In some cases, for instance, if the sanction is a no-contact order, the reporting party would need to be aware of it in order to alert the institution to any breaches of that order  (p12 UUK)
  • Many universities feel constrained to share information due to data protection legislation, however, there are a few universities that do provide information on outcomes and sanctions of disciplinary processes to reporting parties on a case-by-case basis, and this is clearly set out in their institutional policies (p13 UUK)
  • The UUK guidance outlines a Data Sharing Impact and Risk Assessment - a tool which walks universities through several factors to consider and balance when deciding whether to share details of an outcome or a sanction in harassment cases (p17 UUK)
  • Universities should create and maintain an anonymous record of reports made to provide intelligence to inform their understanding of the type and scale of harassment, which will help to facilitate targeted preventive and response measures (p24 UUK)

Implications for governance:

With the #metoo movement in the US and the Everyone’s Invited campaign, which warned of a “rape culture” across UK universities, the issue of sexual harassment is a live topic with risks around institutional reputation and relationships with students and local communities.

Office for Students expectations say that governing bodies should ensure that the provider’s approach to harassment and sexual misconduct is adequate and effective and that risks relating to these issues are identified and effectively mitigated

Strong leadership by governing bodies can help drive a culture shift which supports and challenges the executive leadership team to address the issues. The governing body and the executive need to be “brave and bold” in their actions in addressing harassment and “not be afraid of the headlines”, the guidance advises. For example, they can play a role in ensuring that Nondisclosure Agreements (NDAs) are not used in cases relating to harassment and sign up to the universities minister’s pledge to do away with NDAs.

The CUC guidance points out that low incidents of cases are not necessarily a good sign and may reflect under-reporting. In the same vein, an increase in the number of incidents reported may be a positive outcome and be indicative of emerging culture change.  Staff at institutions told CUC researchers that: “The most important thing the board can do is recognise the issues are not going away.”

Making staff and governors aware of their responsibilities is important and can be achieved through training and briefing. The provision of training for staff, governing body members and students was common in all institutions interviewed for the guidance. It aided effective and sensitive responses to disclosures and helped students feel confident to report and disclose incidents. Governing bodies should be assured that such training is repeated at regular intervals.

Governors may want to consider if resources are sufficient in this area. Having dedicated staff teams to prevent and provide support to anyone from the university community who experiences harassment or sexual misconduct was regarded as invaluable by interviewees, as were online systems where disclosures could be made.

To ensure that tackling harassment is a strategic priority for their university, governors should receive regular reports that chart the progress against actions and commitments and review resources accordingly.

Using the expertise of external organisations to offer a more specialist response to victims/survivors of harassment and sexual misconduct is also something to be considered and was recommended by the case study institutions.

University campaigns on harassment and sexual misconduct can be effective. All universities interviewed reported that their most successful campaigns had engaged students and the Students Union in raising awareness and support available from the University and other local partners. Governors should receive assurance that there is appropriate student engagement in campaigns to prevent and address harassment.

Another important aspect is clear lines of accountability. At one institution,  sexual harassment and misconduct comes under the remit of the Social Inclusion Committee. At another, a Safeguarding Group, which includes members of the governance team, takes the lead.

The UUK guidance deals specifically with the issue of data sharing in cases of sexual harassment. It offers a framework to take staff at universities through the process of sharing more information with reporting parties in harassment cases. The justification for taking this step is that a policy of not sharing can lead to mental health and wellbeing issues for complainants, underreporting of incidents of harassment and unsatisfactory outcomes for reporting parties.

It suggests governing bodies, when endorsing policies, may want to enquire whether reporting parties are being provided with information on outcomes and sanctions relating to investigations, complaints, and disciplinaries.

Universities should where necessary, update their privacy notices and policies accordingly to inform both reporting parties and responding parties that information about outcomes and sanctions may be shared depending on the circumstances. Privacy notices should also be updated to reflect that reports of harassment may be anonymised and kept for reporting and statistical purposes.

Once again, training was highlighted as a route to ensuring that staff who make decisions about sharing personal data in harassment cases feel empowered to make informed, pragmatic and considered decisions and are able to explain to the individuals involved how their personal data might be shared and what information might be shared with them, to manage expectations.

Governors on committees with specific responsibilities in this area may want to cast their eye over the UUK’s practical guide to sharing personal data in harassment cases, published alongside the strategic guide.

Keep up to date – sign up to Advance HE communications

Our monthly newsletter contains the latest news from Advance HE, updates from around the sector, links to articles sharing knowledge and best practice and information on our services and upcoming events. Don't miss out, sign up to our newsletter now.

Sign up to our communications
Resource type: