Even more reasonable
“Employers have just a matter of weeks to establish mechanisms to prevent sexual harassment at work, and to update their data protection compliance measures accordingly. Labour’s Employment Rights Bill would expand the scope of those obligations to include risks posed by third parties, such as customers and suppliers, so employers shouldn’t rest on their laurels and should consider how their proposed programmes could be expanded and whether they would wish to take voluntary steps now. ”
On 26 October 2024, the Worker Protection (Amendment of Equality Act 2010) Act 2023 comes into force, imposing a duty on employers to take reasonable steps to prevent sexual harassment (that is to say unwanted conduct of a sexual nature which has the purpose or effect of violating the employee’s dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment for the employee), of its employees in the course of their employment. Failure to comply with that duty does not give a standalone right to being a civil claim but is enforceable by the Equalities and Human Rights Commission, or the Employment Tribunal with the latter having the power to grant a compensation uplift to an affected employee.
A BBC Radio 5 Live survey in 2017 found that of 2,031 British adults surveyed, 37% of all those asked - 53% of women and 20% of men - said they had experienced sexual harassment either at work or at a place of study, with one in 10 women reporting being sexually assaulted. The survey also found that more women than men were targeted by a boss or senior manager - 30% compared with 12%. The Government Equalities Office’s ‘2020 Sexual Harassment Survey’ revealed that “Overall, 29% of those in employment experienced some form of sexual harassment in their workplace or work-related environment in the last 12 months”. A 2023 poll for the TUC revealed that three in five (58%) women – and almost two-thirds (62%) of women aged between 25 and 34 – say they have experienced sexual harassment, bullying or verbal abuse at work, with two in five (43%) women having experienced at least three incidents of sexual harassment, but less than one in three (30%) of women who say they experienced sexual harassment at work told their employer about what was happening.
Now, before those provisions have even come into force, the new Labour government has proposed to use its Employment Rights Bill (Bill 011 2024-25) to enhance the duty on employers to take reasonable steps to prevent the sexual harassment of employees by (i) requiring employers to take all reasonable steps to prevent the sexual harassment of employees (clause 15, Employment Rights Bill) and, (ii) making provision for regulations to be introduced specifying what constitutes a reasonable step (clause 17, Employment Rights Bill).
In addition, the Employment Rights Bill would amend s.40 Equality Act 2010 so that employers would not only be obliged not to harass their employees and job applicants, but would also be under a duty not to permit third parties to harass their employees by failing to take all reasonable steps to prevent third parties from harassing employees in the course of their employment (clause 16, Employment Rights Bill). This serves to partially reverse the decision of the Court of Appeal in Unite the Union v Nailard [2018] EWCA Civ 1203, where it was held that employers were not liable for failing to protect employees from third party harassment unless the inaction itself resulted from discrimination on the basis of protected characteristics.
A disclosure that sexual harassment has occurred, is occurring or is likely to occur would also be categorised as a protected disclosure under Part 4A Employment Rights Act 1996, amending s.43B(1) of that Act, thereby entitling the employee not to be subjected to a detriment on account of the disclosure in accordance with s.47B Employment Rights Act 1996 (clause 18, Employment Rights Bill).
What should employers be doing now to comply with the duty to take reasonable steps to prevent sexual harassment?
The EHRC recently updated its technical guidance on ‘Sexual harassment and harassment at work’. This makes clear that unwanted conduct of a sexual nature could include: sexual comments or jokes; displaying sexually graphic pictures, posters or photographs; suggestive looks, staring or leering; propositions and sexual advances, making promises in return for sexual favours; sexual gestures; intrusive questions about a person’s private or sex life or a person discussing their own sex life; sexual posts or contact on social media; spreading sexual rumours about a person; sending sexually explicit emails or text messages; and/or, unwelcome touching, hugging, massaging or kissing.
The guidance explains that the new duty “is an anticipatory duty… designed to transform workplace cultures by requiring employers to take positive and proactive reasonable steps to prevent sexual harassment of their workers” by anticipating scenarios when sexual harassment might take place and taking action to prevent it.
The guidance is accompanied by an 8 step guide to ‘Preventing sexual harassment at work’.
Assessing an employer’s compliance with the duty will be undertaken holistically, having regard to factors relating to the employer, the nature of the workforce, the nature of employment, employee interactions, the risks posed to employees, any previous concerns, the available mitigations and the cost, practicality and impact of implementing them, and the efficacy of the steps taken.
Employers could also consider issues that have arisen previously, employee sentiment as measured in staff surveys or engagement with relevant staff networks, and their own organisational cultures.
The Worker Protection (Amendment of Equality Act 2010) Act 2023 doesn’t specify what reasonable measures are. The proposed Employment Rights Bill would introduce scope for regulations to be made addressing what constitutes a reasonable measure to enable the assessment of whether an employer has taken all reasonable steps to prevent sexual harassment and it is suggested that these might include “carrying out assessments of a specified description”, “publishing plans or policies of a specified description”, “steps relating to the reporting of sexual harassment” and/or “steps relating to the handling of complaints” (clause 17(2), Employment Rights Bill).
Steps likely to be considered the minimum necessary to be taken by substantial employers include:
Undertake a sexual harassment risk assessment to identify the risks to employees, taking into account the categories of individual who may pose a threat, the locations and circumstances in which threats may arise;
Identify potential mitigations to counter the risks and determine which it will reasonably adopt;
Update policies and keep them under periodic review;
Communicate policies to staff;
Establish reporting mechanisms for sexual harassment, as well as a record of concerns which do not amount to formal reports/complaints;
Maintain records of reports of sexual harassment;
Train managers and staff, and refresh training periodically;
Establish a process for acting upon reports of sexual harassment;
Conduct periodic monitoring of reports of sexual harassment to identify wider trends; and,
Assess on an ongoing basis the effectiveness of the measures in place to prevent sexual harassment and address any identified deficiencies.
Other actions that could be considered include:
Appointing a trained designated point of contact for reporting concerns, during both the working day and at events outside of working hours where a risk of sexual harassment is identified;
Establishing anonymous reporting routes;
Notifying clients and suppliers of the employer’s policy and the implications of breaching it;
Establishing protocols for raising concerns or reporting sexual harassment by employees of clients, suppliers and other third parties, including to applicable regulators;
Establish protocols to receive reports about sexual harassment by the employer’s employees from third parties;
Making support available to individuals who report having been subjected to sexual harassment; and/or,
Providing staff with guidance on how to respond in the event that they suffer sexual harassment.
Care will need to be taken to ensure that records that are maintained and retained securely, with restricted access and subject to an appropriate retention period, and where the records make clear whether or not reports were formal or informal and whether they were substantiated, in order to comply with the data protection principles under Article 5 UK GDPR of lawfulness, accuracy, data minimisation, storage limitation, and integrity and confidentiality.
Personal data relating to reports of sexual harassment is capable of falling within the definition of special category personal data under Article 9 UK GDPR, and processing for the purposes of compliance with the Worker Protection (Amendment of Equality Act 2010) Act 2023 will be rendered lawful in reliance on Article 9(2)(b) UK GDPR (“processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”) and Schedule 1, Part 1, paragraph 1 Data Protection Act 2018 (“the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection”). However, employers are required to have an appropriate policy document in place in order to rely on this condition, and will therefore need to create one or to update an existing one.
A report is also capable of falling within the scope of the prohibition on processing criminal conviction or offence data under Article 10 UK GDPR, but the provision at and Schedule 1, Part 1, paragraph 1 Data Protection Act 2018 would similarly justify the relevant processing.
Employers should also ensure that any new processing activities are reflected in the privacy notice(s) made available to affected staff and third parties, to comply with the transparency principle.
And what more could employers be expected to do if the duty to take all reasonable steps to prevent sexual harassment in the Employment Rights Bill was to be enacted?
An obligation to take “all reasonable measures” implies that employers would be expected to do more than the bare minimum to prevent sexual harassment, taking multiple steps in conjunction with each other to achieve an effective sexual harassment prevention programme. The proposal in the Employment Rights Bill that regulations could be made also suggests that employers can expect the required elements of that programme to be prescribed, reducing flexibility.
Should you require support understanding how new legislation and regulation will affect you or your organisation, in conducting a sexual harassment risk assessment, reviewing and revising policies, or drafting or adapting an appropriate policy document, please contact us.
Find out more about our data protection and data privacy services.
Find out more about our Environmental, Social & Corporate Governance (ESG) and Human Rights services.