Secondary victimisation through data protection: Balancing victim privacy and support in the EU legal framework.

The article examines the interaction between the European Union's General Data Protection Regulation (GDPR) and the Victims' Rights Directive (VRD) in the context of victim support services, focusing on how data protection rules affect referral mechanisms for victims. It highlights that strict reliance on consent as the primary legal basis for processing victim data under the GDPR can create procedural barriers, leading to secondary victimisation by delaying or obstructing timely access to support. The study compares referral practices across EU Member States, identifies gaps caused by fragmented legal interpretations, and proposes trauma-informed, flexible approaches that balance consent with alternative legal bases such as public interest and vital interests. It recommends revising the VRD to serve as the lex specialis governing victim data processing, establishing harmonised referral protocols, and promoting secure, victim-centred data sharing to ensure effective, timely support while safeguarding privacy and dignity.