In the US it is illegal for a company to use recorded data or CVRs for disciplinary action.
I like your thinking but that data has been available and used at most recent incident hearings in my experience.
Once the company or feds are aware of a reportable incident, recorded data is fair game in the U.S. as far as I know. There are limits on dissemination but it can and has been used to nail a crew that had a bad day from what I've seen. Remember the 'good old days' when we erased the CVR after something unusual? That action will now get you another month off if they catch you. Or so I'm told.
Fishing expeditions though the data for other than 'safety' purposes are not (yet) allowed but I see them coming.
QAR data used in ASAP programs is deidentified but there is a big gotcha in the feds' ASAP handbook:
2) Violations that are not inadvertent or that involve an intentional disregard for safety are specifically excluded from the program and any enforcement-related incentive will not apply to these violations.
We have been put on informal notice by the feds that unstabilized approaches may be considered 'an intentional disregard for safety' and filing an ASAP report may not give you the get out of jail card.