Workplace Harassment and Data Protection

Workplace harassment and data protection

Workplace Harassment is very topical, due to related news and the obligation of employers to develop protocols to prevent or how to act in cases of workplace harassment.

There are different types of harassment, although in general terms, mobbing is understood as any verbal, physical or psychological action carried out in the workplace. The victim shall not be considered to be the victim of an act of harassment, humiliation, offence or intimidation at work by one or more persons to another worker. Such acts shall be carried out repeatedly, persistently or systematically.

Although it is a current issue, workplace harassment and sexual harassment has been considered a crime since 1995, under Article 173.1 and 184 of the Penal Code.

Implications for companies

Equality Plan

Articles 46.2 and 48 of Organic Law 3/2007 for the effective equality of women and men establish the obligation to include a protocol for the prevention of sexual and gender-based harassment in equality plans.

While it is true that equality plans are mandatory for companies with more than 50 employees, labor equality between men and women is a right for any worker and an obligation for any employer.

Occupational Risk Prevention

Article 14 of Law 31/1995 on Occupational Risk Prevention and Article 2.1 of Law 54/2003 on the reform of the regulatory framework for occupational risk prevention, require companies to adopt any measures necessary to protect the safety and health of workers, which would include a prevention protocol for occupational and sexual harassment in the workplace.

Data protection and harassment at work and sexual harassment in the company

Article 9 of the General Data Protection Regulation(GDPR 679/2016), regulates the processing of special category data, identifying among others data relating to sex life or data relating to health.

Therefore, we could determine that any case of workplace harassment or sexual harassment, could be included in special category data and in this case the processing of these data would be legitimized by companies, abiding by Article 9.2 b) of the GDPR, whereby“…the processing is necessary for the performance of obligations and the exercise of specific rights of the controller or of the data subject in the field of employment law and social security and protection (…)“

Regardless of whether or not the GDPR regulates it as special category data, we would all agree that any case of harassment should be treated with the utmost confidentiality and diligence.

Therefore, it is recommended to apply security measures to the information originated in case of labor or sexual harassment, as well as to the identity of the complainant and the accused.

One of the security measures mentioned above could be the application of pseudonymization techniques, such as giving the case an identifying numerical code that alone cannot identify or make identifiable the persons involved. This implies that the personal data will be stored separately from the numerical code of the case, in order to unlink it and make it inaccessible to unauthorized persons.

Another security measure that would be recommended in these cases would be the application of restricted access measures that guarantee access only to authorized personnel, such as keeping documents under lock and key or, in the case of digital documents, applying access privileges by means of cryptographic keys.

The creation of a Complaints Channel, managed by external parties that provide an objective character to the case and that complies with the European Directive 2019/1937, is highly recommended for channeling complaints.

Given all of the above and the risks that a loss of confidentiality would entail, it would be necessary to prepare a Data Protection Impact Assessment(DPA), which would result in additional security measures.

Business Adapter at your service

If you are a customer and need help, do not hesitate to contact your consultant or send us an email to info@businessadapter.es or leave your message in this form and we will contact you:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be happy to help you.[/su_button]

If you are not yet a customer and need advice, we are at your disposal: