14

Student needed as witness, has left

I am supporting a bullying and Harassment panel where an ex student accused a lecturer of Harassment. 

The ex student has named as a witness. Who is another student who has also left the university.

With GDPR in mind, can I access student files to track down and invite the witness to investigation? 

Do I ask the complainant to provide the contact detail of his own witness? 

Am I obliged to follow up either contact route? Are there any data concerns I should be aware of?

Thank you

8507 views
  • I would suggest that in an education setting, you may have your own guidance on this; it's not so relevant to CIPD members/HR professionals in that we are normally dealing with employees.

    I would be interested to see what colleagues say regarding contacting the ex-student, I suppose in an education setting you may have a legal obligation to fully investigate because the lecturer is in a position of trust to the student? Just thinking out loud.
  • In reply to Sam:

    Thank you, our only guidance relates to ongoing contact relevant to courses of education and as alumni
  • I'd maybe check with the complainant that the witness is happy to be their witness and if so for the complainant to provide you with the contact details. I think otherwise you may be breaking your own policy as you've mentioned in your second post.
  • It is hard to understand an argument that you wouldn't have a legitimate interest to contact an ex student as part of an investigation. My view is that you would be entirely correct to make contact with the ex-student, using the contact information provided to the institution for their studies, to ask for a meeting with them in relation to something they may have been a witness to during their course.

    Do you have a student complaints officer who can help with this?
  • In reply to Nina Waters:

    Thanks Nina, this was my initial thinking - a legitimate interest - but the responses from others have made me cautious. I think that the legal obligation to properly investigate may over-ride potentially upsetting an ex-student by contacting them about something that they have not given express consent to be contacted about ...
  • In reply to Christine:

    If I were that (ex-)student, I would certainly not object to someone contacting me respectfully and asking for my involvement - and it seems impossible to me that anyone would mind (no accounting for people, granted). They would still be able to refuse, particularly if it were something they felt they didn't want involvement with.
  • In reply to Nina Waters:

    Thanks Nina
  • In reply to Nina Waters:

    Hi Nina, I think your phrase "provided to the institution for their studies" is key here.
    The student or their parents did not provide the data so that the subject could participate in a staff investigation. I would think, then, that you could not access the student record for these purposes.
    From what I understand though, the student accusing the staff member of harassment wants to rely on the witness statement of this second student and it will be up to them to make the initial contact and ask the student to get in touch with you.
    If there is a safeguarding aspect to this where a criminal offence may have been committed and the police involved, that may provide a different context and be covered by a different section of the privacy notice.
  • In reply to Fiona Maclachlan-Morris:

    Afraid I fail to understand why Nina's views above shouldn't apply - of course IMHO it's a matter most legitimately indeed connected with their (recent past) studies: or are all the alumni invitations to donate etc etc I get all in breach of latest Data Protection law?
    Apart from express statutory provision, it's all a balance between individual right to privacy and justification for intruding, but in this case the institution simply accessing an alumus's address is I'm sure entirely justified
  • In reply to Fiona Maclachlan-Morris:

    Thanks Fiona, your understanding of the situation is correct. Thankfully, there is no safeguarding issue.
  • In reply to David:

    Thanks, as always, for your response David.
  • In reply to David:

    Hi David
    I have made an assumption that the student referred to has left school rather than university. Although the legitimate interest basis can be used the ICO does suggest caution in applying this basis "You must take extra care to ensure you protect the interests of any children".
    As far as I am aware, it will essentially depend on the privacy notice provided to the student or their parents, where applicable, at the time the initial information was obtained or at the change in the law in 2018, whichever is later.
    While the purpose of processing may be changed this is more difficult and in terms of most of the school processing notices I have seen the legal bases are generally Consent and PublicTask.
  • In reply to Fiona Maclachlan-Morris:

    Thanks for clarifying, Fiona
  • Under GDPR you can/must provide information if it is required for a lawful purpose, and I'd suggest investigating harassment is a lawful purpose - otherwise every person subject to an investigation would hide behind GDPR =- and they can't.