Effectively preventing and responding to sexual harassment: A Code of Practice for Employers
Chapter 9: Record-keeping
Contents
Key points
9.1 Why is keeping records important?
9.2 What are the obligations of organisations and agencies under the Privacy Act 1988 (Cth)?
9.3 Records of informal complaints
9.4 Records of formal complaints
9.5 Security of records
Download
- Complete report PDF
(1.4 MB) - Complete report Word
(500 kb)
|
9.1 Why is keeping records important?
Employers should develop, and make known to employees, clear guidelines on how to document and record complaints and reports of sexual harassment. This has a number of benefits.
- The incidence of sexual harassment is able to be monitored and particular problem areas identified and targeted for further awareness-raising strategies. Statistical records will assist the organisation to determine whether an incident is isolated or forms part of a pattern.
- It allows informed and fair decisions to be made on the basis of accurate reports.
- Evidence on how the organisation dealt with the case can be submitted in any subsequent legal proceedings. For example, if a complaint is lodged with the Commission or state or territory anti-discrimination agency or there is subsequent litigation, records of internal action will be useful in establishing whether reasonable steps were taken to deal with the harassment and may assist in discharging the organisation’s liability.
- Ensuring employees are aware of how personal information will be handled when an allegation or complaint is made in the workplace. This will help to reduce the likelihood of complaints by parties regarding a breach of privacy, avoid discouraging workplace participants from seeking assistance and advice, and assist in assuring workplace participants accused of harassment that they will be treated fairly. Employees should be aware of what information will be collected, why, how it will be used and to whom it may be given.
The nature of the documentation to be collected and retained will depend on the level of formality of the complaint.
9.2 What are the obligations of organisations and agencies under the Privacy Act 1988 (Cth)?
Organisations with an annual turnover above $3 million, as well as some small businesses, are covered by the National Privacy Principles (NPPs) in the Privacy Act 1988 (Cth) (‘the Privacy Act’). More information about which private sector organisations are covered by the NPPs, and how the NPPs operate, is available from the Office of the Federal Privacy Commissioner.[36]
However, there is an exemption in the Privacy Act in relation to workplace privacy in the private sector. This ‘employee records’ exemption operates so that an organisation is not bound by the NPPs if it is a current or past employer of the individual, and the data handling activity it is carrying out is directly related to the current or past employment relationship with the individual and to a record about that individual.[37] As the operation of the exemption will need to be determined in the particular circumstances of a case, the advice below assumes that an organisation is subject to the Privacy Act.
Commonwealth and ACT public sector agencies are covered by the Information Privacy Principles (IPPs) in the Privacy Act.[38] The handling of personal information about Commonwealth and ACT public sector employees by agencies is subject to the IPPs.
Organisations will also be covered by relevant state and territory privacy legislation. For more information about state laws, contact the Office of the Federal Privacy Commissioner.[39]
9.3 Records of informal complaints
If informal measures have been used to resolve a situation, only limited records are usually collected. For example, in a case where an individual has dealt with the problem themselves after receiving information and advice from a sexual harassment contact officer, manager or other designated officer there are several competing considerations around which records should be kept.
Some record of the contact is required for statistical purposes so that the organisation can monitor the number of reports of sexual harassment and target particular problem areas. A record of the contact also allows the contact officer to follow-up the case to ensure that the situation has been effectively resolved through informal action and that there are no potential repercussions for either party or the organisation. At a practical level, keeping records also ensures that the contact officer can account for the amount of work time spent on sexual harassment matters.
However, information provided to an officer will be highly sensitive and will necessarily involve allegations against a particular individual. As no investigation occurs in an informal process, the allegations are likely to remain untested. It is therefore inappropriate to keep potentially damaging records containing unsubstantiated claims against an alleged harasser, particularly if they have no knowledge that the record exists and have not been given the opportunity to refute the allegation.
A possible way of balancing these considerations is to develop a standard form which can be used for recording essential information without compromising an alleged harasser’s rights. The name of the alleged harasser should not be recorded on the form, but the particular department or section where the incident occurred should be noted for monitoring purposes.
Recording the name of the individual who has been harassed should be optional. In some cases, an individual will want their name recorded so that if formal action is required at a later stage, they can show that informal attempts were made to resolve the situation. Alternatively, an individual may be reluctant for any record to be retained which identifies them personally. Recording an individual’s name on the form should only ever be done with their explicit consent to avoid discouraging any workplace participant from seeking advice and assistance. A brief summary of the alleged incident along with an agreed course of action should also be recorded. Again, this allows the contact officer to follow up the case to ensure that informal measures have effectively resolved the situation.
If a manager has taken informal action on an individual’s behalf, a brief diary entry noting the incident and the action taken would suffice. If the complaint is subsequently formalised (either internally or externally), this can be used to demonstrate that steps were taken to deal with the matter when it was first raised.
If an organisation collects personal information identifying any individual in a record, including in the course of handling an informal complaint, reasonable steps need to be taken by the organisation to notify the respective individuals about why it has collected their personal information, what it will do with that information, and to whom (if anyone) it may disclose that information. The individuals also need to be told that they have a general right of access to the information about them that is held in the organisations records. These obligations are set out in NPPs 1.3 and 1.5.
9.4 Records of formal complaints
If a formal complaint is lodged, the documentation collected is likely to be substantial and will include statements provided by the parties, records of interview with the investigation officer, personal notes and reports. All this information will be highly sensitive and strict guidelines are required to ensure that it is kept confidential and is not used for improper purposes.
The investigation officer will need to document all interviews with the complainant, alleged harasser and any witnesses. Records of interview should contain as much relevant, factual information as possible - times, dates, details of specific incidents and frequency of occurrences. It is desirable that the interviewee’s own words are used as far as possible.
The parties to a complaint and any witnesses should be given the opportunity to peruse, correct and endorse their record of interview. The interviewee should be provided with a copy of their own record of interview if requested. To avoid any possibility of collusion, they should not be provided with anyone else’s statement or record of interview. A complainant’s support person should not also be a witness as this may compromise their evidence.
If a formal complaint against an employee is found to be substantiated, a summary of the complaint, the finding and the action taken should be recorded in their personnel file. This can be removed after a reasonable period of time determined by the employer if there has been no repetition of the behaviour. All other documentation relating to the investigation should be kept in a sealed confidential file which can be accessed only with the authority of a specified senior management representative. However, the ‘primary purpose’ for which the information was collected, in this case to deal with a complaint, will continue to limit the use of that information.[40]
Once a case is finalised, records will still need to be retained for a reasonable amount of time. If a complaint is subsequently lodged with the Commission it may request records as part of its investigation into the allegations. Records relating to the complaint will demonstrate that steps were taken to deal with the matter. Evidence of any internal action that was taken may assist in reducing liability. Freedom of information legislation may also require records to be retained for a certain period.
9.5 Security of records
Records of sexual harassment complaints will invariably contain highly sensitive and potentially damaging personal information. It is therefore imperative that they are protected by reasonable security safeguards. Also, organisations and agencies have legal obligations to protect this data under NPP 4 or IPP 4. For example, any files or reports associated with an investigation should be kept in locked storage. Access should be restricted to authorised personnel only. Records should not be placed on general or open access files.
Care should also be taken to ensure the security of transmission of information by e-mail or facsimile and storage of electronic information.
References
[36] See www.privacy.gov.au.
[37] Privacy Act 1988 (Cth).
[38] More information
about how the IPPs operate can also be found at the website www.privacy.gov.au.
[39] Links to information on
state and territory privacy laws is available at www.privacy.gov.au.
[40] Subsequent use and disclosure of the information under NPP 2 or IPP 10 and 11 is
determined with reference to this primary purpose, so that it can also be
used:
- for a related purpose, if the individual (to whom the information relates) would reasonably expect it;
- for other secondary purposes if the individual gives consent; or
- for other purposes as specified in the exceptions to NPP 2.
