• back to contents

Effectively preventing and responding to sexual harassment: A Code of
Practice for Employers

Chapter 9: Record-keeping

Contents

Key points
9.1 Why is keeping records important?
9.2 What are the obligations of organisations and agencies under the Privacy Act 1988 (Cth)?
9.3 Records of informal complaints
9.4 Records of formal complaints
9.5 Security of records

Download

• Complete report PDF (1.4 MB)
• Complete report Word (500 kb)

9.1 Why
is keeping records important?

Employers should develop, and make known to employees, clear guidelines on
how to document and record complaints and reports of sexual harassment. This has
a number of benefits.

• The incidence of sexual harassment is able to be monitored and particular
  problem areas identified and targeted for further awareness-raising strategies.
  Statistical records will assist the organisation to determine whether an
  incident is isolated or forms part of a pattern.
• It allows informed and fair decisions to be made on the basis of accurate
  reports.
• Evidence on how the organisation dealt with the case can be submitted in any
  subsequent legal proceedings. For example, if a complaint is lodged with the
  Commission or state or territory anti-discrimination agency or there is
  subsequent litigation, records of internal action will be useful in establishing
  whether reasonable steps were taken to deal with the harassment and may assist
  in discharging the organisation’s liability.
• Ensuring employees are aware of how personal information will be handled
  when an allegation or complaint is made in the workplace. This will help to
  reduce the likelihood of complaints by parties regarding a breach of privacy,
  avoid discouraging workplace participants from seeking assistance and advice,
  and assist in assuring workplace participants accused of harassment that they
  will be treated fairly. Employees should be aware of what information will be
  collected, why, how it will be used and to whom it may be given.

The nature of the documentation to be collected and retained will
depend on the level of formality of the complaint.

9.2 What are the
obligations of organisations and agencies under the Privacy Act 1988
(Cth)?

Organisations with an annual turnover above $3 million, as well as some small
businesses, are covered by the National Privacy Principles (NPPs) in the Privacy Act 1988 (Cth) (‘the Privacy Act’). More information
about which private sector organisations are covered by the NPPs, and how the
NPPs operate, is available from the Office of the Federal Privacy
Commissioner.^[36]

However, there is an exemption in the Privacy Act in relation to workplace
privacy in the private sector. This ‘employee records’ exemption
operates so that an organisation is not bound by the NPPs if it is a current or
past employer of the individual, and the data handling activity it is carrying
out is directly related to the current or past employment relationship with the
individual and to a record about that
individual.^[37] As the operation of
the exemption will need to be determined in the particular circumstances of a
case, the advice below assumes that an organisation is subject to the Privacy
Act.

Commonwealth and ACT public sector agencies are covered by the Information
Privacy Principles (IPPs) in the Privacy
Act.^[38] The handling of personal
information about Commonwealth and ACT public sector employees by agencies is
subject to the IPPs.

Organisations will also be covered by relevant state and territory privacy
legislation. For more information about state laws, contact the Office of the
Federal Privacy
Commissioner.^[39]

9.3 Records of
informal complaints

If informal measures have been used to resolve a situation, only limited
records are usually collected. For example, in a case where an individual has
dealt with the problem themselves after receiving information and advice from a
sexual harassment contact officer, manager or other designated officer there are
several competing considerations around which records should be kept.

Some record of the contact is required for statistical purposes so that the
organisation can monitor the number of reports of sexual harassment and target
particular problem areas. A record of the contact also allows the contact
officer to follow-up the case to ensure that the situation has been effectively
resolved through informal action and that there are no potential repercussions
for either party or the organisation. At a practical level, keeping records also
ensures that the contact officer can account for the amount of work time spent
on sexual harassment matters.

However, information provided to an officer will be highly sensitive and will
necessarily involve allegations against a particular individual. As no
investigation occurs in an informal process, the allegations are likely to
remain untested. It is therefore inappropriate to keep potentially damaging
records containing unsubstantiated claims against an alleged harasser,
particularly if they have no knowledge that the record exists and have not been
given the opportunity to refute the allegation.

A possible way of balancing these considerations is to develop a standard
form which can be used for recording essential information without compromising
an alleged harasser’s rights. The name of the alleged harasser should not
be recorded on the form, but the particular department or section where the
incident occurred should be noted for monitoring purposes.

Recording the name of the individual who has been harassed should be
optional. In some cases, an individual will want their name recorded so that if
formal action is required at a later stage, they can show that informal attempts
were made to resolve the situation. Alternatively, an individual may be
reluctant for any record to be retained which identifies them personally.
Recording an individual’s name on the form should only ever be done with
their explicit consent to avoid discouraging any workplace participant from
seeking advice and assistance. A brief summary of the alleged incident along
with an agreed course of action should also be recorded. Again, this allows the
contact officer to follow up the case to ensure that informal measures have
effectively resolved the situation.

If a manager has taken informal action on an individual’s behalf, a
brief diary entry noting the incident and the action taken would suffice. If the
complaint is subsequently formalised (either internally or externally), this can
be used to demonstrate that steps were taken to deal with the matter when it was
first raised.

If an organisation collects personal information identifying any individual
in a record, including in the course of handling an informal complaint,
reasonable steps need to be taken by the organisation to notify the respective
individuals about why it has collected their personal information, what it will
do with that information, and to whom (if anyone) it may disclose that
information. The individuals also need to be told that they have a general right
of access to the information about them that is held in the organisations
records. These obligations are set out in NPPs 1.3 and 1.5.

9.4 Records of formal
complaints

If a formal complaint is lodged, the documentation collected is likely to be
substantial and will include statements provided by the parties, records of
interview with the investigation officer, personal notes and reports. All this
information will be highly sensitive and strict guidelines are required to
ensure that it is kept confidential and is not used for improper purposes.

The investigation officer will need to document all interviews with the
complainant, alleged harasser and any witnesses. Records of interview should
contain as much relevant, factual information as possible - times, dates,
details of specific incidents and frequency of occurrences. It is desirable that
the interviewee’s own words are used as far as possible.

The parties to a complaint and any witnesses should be given the opportunity
to peruse, correct and endorse their record of interview. The interviewee should
be provided with a copy of their own record of interview if requested. To avoid
any possibility of collusion, they should not be provided with anyone
else’s statement or record of interview. A complainant’s support
person should not also be a witness as this may compromise their evidence.

If a formal complaint against an employee is found to be substantiated, a
summary of the complaint, the finding and the action taken should be recorded in
their personnel file. This can be removed after a reasonable period of time
determined by the employer if there has been no repetition of the behaviour. All
other documentation relating to the investigation should be kept in a sealed
confidential file which can be accessed only with the authority of a specified
senior management representative. However, the ‘primary purpose’ for
which the information was collected, in this case to deal with a complaint, will
continue to limit the use of that
information.^[40]

Once a case is finalised, records will still need to be retained for a
reasonable amount of time. If a complaint is subsequently lodged with the
Commission it may request records as part of its investigation into the
allegations. Records relating to the complaint will demonstrate that steps were
taken to deal with the matter. Evidence of any internal action that was taken
may assist in reducing liability. Freedom of information legislation may also
require records to be retained for a certain period.

9.5 Security of
records

Records of sexual harassment complaints will invariably contain highly
sensitive and potentially damaging personal information. It is therefore
imperative that they are protected by reasonable security safeguards. Also,
organisations and agencies have legal obligations to protect this data under NPP
4 or IPP 4. For example, any files or reports associated with an investigation
should be kept in locked storage. Access should be restricted to authorised
personnel only. Records should not be placed on general or open access files.

Care should also be taken to ensure the security of transmission of
information by e-mail or facsimile and storage of electronic information.

References

^[36] See www.privacy.gov.au.
^[37]Privacy Act 1988 (Cth).
^[38] More information
about how the IPPs operate can also be found at the website www.privacy.gov.au.
^[39] Links to information on
state and territory privacy laws is available at www.privacy.gov.au.
^[40] Subsequent use and disclosure of the information under NPP 2 or IPP 10 and 11 is
determined with reference to this primary purpose, so that it can also be
used:

• for a related purpose, if the individual (to whom the information
  relates) would reasonably expect it;
• for other secondary purposes if the individual gives consent; or
• for other purposes as specified in the exceptions to NPP
  2.