Workplace Investigations

Austrian law does not impose an obligation on employers to conduct internal investigations and they do not have to follow a specific legal pattern when doing so. However, an obligation to conduct internal investigations may arise out of certain provisions of criminal, company or even labour law – in particular, an indirect obligation arising from an employer's duty of care, which requires them to act against employee mistreatment, such as bullying.

If such internal investigations are initiated, compliance with labour law and data protection regulations is mandatory. According to section 16 of the Austrian Civil Code (ABGB), the employer must also protect the personal rights of the individual. It is important to emphasise that a company's internal investigation is a private measure and differs from official investigations.

There is no specific law governing workplace investigations in Brazil, but Law 14.457/2022 states that companies must have rules that relate to sexual and other forms of harassment in their internal policies, address the rules for receiving and processing accusations, assess the facts, and discipline any individuals directly and indirectly involved in acts of sexual harassment or violence.

If the investigation has any connection with anticorruption matters, the investigation procedure must comply with Law 12846/2013 (Brazilian Anticorruption Act) and Decree 8420/2015.

As a result, Brazilian employers usually follow the rules determined by internal corporate policies, which often result from international regulations and principles that differ from the Brazilian ones, which inadvertently expose the Brazilian subsidiary to liability. The answers below will highlight common examples of this, when appropriate.

Mainly, the Occupational Safety and Health Act (738/2002). In addition, the following also have relevance in connection to a workplace investigation: the Employment Contracts Act (55/2001), the Criminal Code (39/1889), the Act on Occupational Safety and Health Enforcement and Cooperation on Occupational Safety and Health at Workplaces (44/2006), the Act on Equality between Women and Men (609/1986) and the Non-discrimination Act (1325/2014). In addition, the employer's own policies must be taken into consideration while conducting a workplace investigation.

In general, an internal investigation is only initiated if there is suspicion of a violation. The decision to commence an internal investigation is up to the company, and it has to weigh the pros and cons. For limited liability companies, which are subject to the Association Responsibility Act, an internal investigation may exempt them from criminal liability. Disadvantages may include investigation costs, disruption of operations, discovery of information requiring later disclosure, possible negative media coverage and increased risk of exposure to external parties.

Investigations can relate to specific individuals, departments, or the entire company. An investigation may include various measures, such as obtaining and analysing files and documents, conducting questionnaires and employee interviews, monitoring internet use, video or telephone surveillance of employees and setting up whistleblowing hotlines. Not all measures are acceptable without restrictions. The provisions of labour law and data protection law must always be complied with.

To avoid wasting resources, the objectives of the investigation should be defined in advance. In addition, the selection and sequence of instruments to be used should be determined. A legal assessment of the chosen measures is essential to avoid legal complications.

Workplace investigations usually commence on the receipt of an allegation, which can be presented orally or in writing to an assigned member of the company (usually, within the HR, Compliance or Legal Departments, or to a direct supervisor) or via an external channel, as determined by the company’s policy.

When the employer becomes aware of possible misconduct, the employer must commence an investigation immediately, in practice within about two weeks. The information may come to the employer's knowledge via, for example, the employer's own observations, from the complainant or their colleagues or an employee representative.

Yes. An employer may always, and without legal restrictions, temporarily suspend an employee during an internal investigation, provided he or she continues to be paid.

However, suspending the employee does not release the employer from an obligation to terminate employment without notice. It must be clear to the employee that the suspension is a temporary measure in preparation for dismissal. A suspension does not entitle the employer to postpone the reasons for dismissal for any length of time. The longer the suspension lasts, the more likely it is that the employer intends to keep the employee.

Yes, an employee can be suspended during or before a workplace investigation. However, suspending an employee is not a legal requirement in Brazil. It is also not standard business practice and entails legal risk, as detailed below.

While internal policies in line with a company’s global investigation approach may determine whether investigated employees are suspended during an investigation, the suspension of an accused employee is not recommended. The only exception is when the accused employee, upon becoming aware of the existence of the investigation, poses a clear and imminent risk of physical danger to other employees or interfering with the investigation.

The suspension of an employee during an investigation makes it difficult for the company to keep the investigation confidential, because the absence of the investigated employee will have to be explained to his or her colleagues and business contacts. As a result, the investigated employee may be exposed to the stigma of being associated with potential misconduct.

Even if the accusation is confirmed and the individual is terminated with cause, the employer cannot disclose the reason for the termination or that the contract was terminated for a cause or violation in the employee’s employment records. Also, if the employer shares such information with prospective employers they may be liable for damages.

Termination for cause on the grounds of dishonest conduct, if not upheld by the labour court, usually leads to liability for damages to the former employee due to the accusation and the stigma associated with it. 

Therefore, if the company decides to suspend the employee during the investigation and terminate his or her employment at the end of the investigation, the suspension will be associated with wrongdoing, and the individual will have grounds to claim damages for the association between the termination, the investigation and wrongdoing, which will likely be presumed by a labour court (damage in re ipsa).

On the other hand, if the accusation is deemed groundless, the connection between the employee and potential wrongdoing resulting from his or her suspension can be used as grounds for damages because of the resulting environment at the workplace or the development of mental health conditions such as depression or anxiety by the investigated employee due to the investigation and uncertainty about the negative effect of it on his or her reputation. 

Because suspension during an investigation is not a disciplinary measure, if the company decides to suspend, the employee’s salary cannot be affected. Also, the suspension period must be as short as possible, and can in no circumstance be longer than 30 days. If it exceeds 30 days, it would trigger termination for cause by the company, which increases the amount of statutory severance due to the employee.

There is no legislation on temporary suspension in the event of a workplace investigation or similar. In some situations, the employer may relieve the employee from their working obligation with pay for a short period.

There are no prescribed minimum standards for this procedure. The responsibility for conducting these investigations lies with the employers. Internal compliance or legal teams are often entrusted with this task, as they are familiar with internal protocols. In practice, these investigations are often overseen by an internal team, occasionally with the assistance of law firms or auditing firms. Those involved in the investigation must remain impartial. Potentially biased persons, such as those under investigation and their close associates, should be excluded from participation.

There is no statutory rule, and therefore the investigator can be chosen by the company.

In sensitive matters, it is recommended that attorneys undertake the investigation due to legal privilege. Engaging external lawyers increases the confidence of witnesses and parties in the independence and lack of bias of the investigation process, especially when the allegations involve senior employees.

Additionally, attorneys are trained to collect information based on legal thresholds that apply to the allegations, allowing the decision-makers to understand the events as they would be posed before a labour judge or a prosecutor, and enabling them to clearly assess the legal risk involved in the situation.

The employer must conduct the investigation, but the actual work can be done either by the employer's personnel or by an external investigator, for example, a law firm. Either way, there are no formal criteria for the persons executing the investigation; however, impartiality is required from the person conducting the investigation

If the investigated employee believes that individual measures violate his rights, he or she can defend him or herself against them, but he or she cannot stop the entire investigation.

In principle, the employee has various rights such as access, rectification, erasure and the right to contest the processing of his or her data (articles 12-17 and 21 GDPR). Should these principles be violated, the employee has the right to lodge a complaint with the data protection authority.

Employees are not legally prohibited from bringing legal action, but because investigations are within an employer’s powers, a legal action to broadly stop an investigation (as opposed to an injunction to prevent a limited measure within an investigation, such as the review of private messages) would likely be deemed groundless.

The employee does not have a legal right to stop the investigation. The employer must fulfil its obligation to investigate the alleged misconduct.

An essential part of an internal investigation is the questioning of employees. Their statements contribute significantly to clarifying possible violations. In particular, the legal principles that apply to criminal proceedings, including the right to refuse to testify, do not apply directly to internal investigations.

Employees do not legally have to participate in such interviews. Their duty to cooperate arises indirectly from other legal provisions, in particular from employees’ duties of loyalty and service under labour law.

Austrian law suggests there is a general principle of loyalty, which triggers a “duty to inform” under some circumstances; in principle, the employee and any witnesses are expected to provide information in the context of internal investigations. While the employee is not compelled to incriminate him or herself, he or she also may not withhold work-related information that the employer legitimately wishes to protect, for the sole reason that it might incriminate him or her. The decision as to whether the employee must disclose information depends on a balancing of interests in the specific case.

Investigators and employers must strictly adhere to the permissible limits. This requires compliance with labour law, criminal law and data protection law.

Employees cannot be compelled to act as witnesses. Employers may have trouble enforcing internal policies stating that employees who refuse to participate in investigations will be disciplined (warned, suspended or have their contract terminated for cause), but can terminate their contract without cause.

There are no explicit legal protections for employees acting as witnesses, but it is common best practice to have witnesses’ identities protected to the extent necessary for the investigation, and to protect them from retaliation.

There is no legislation on a witness's role in investigations. However, the legislation on occupational safety requires that employees must report any irregularities they observe. Depending on the situation, participating in the investigation may also be part of the person's work duties, role or position, in which case the employer may require the employee to contribute to clarifying the situation. However, there is no formal obligation to act as a witness, and there is no legislation regarding the protection of witnesses. If a witness wishes, they may have, for example, an employee representative as a support person during the hearing. 

All data processing must comply with the principles of article 5 GDPR (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and integrity). Personal data may only be collected and processed for specific, lawful purposes.

The admissibility of data processing depends on whether the suspicion relates to a criminal offence or another violation of the law. If the data processing is relevant to criminal law, article 10 GDPR or section 4(3) of the Austrian Data Protection Act (DSG) applies. If the investigations are exclusively to clarify violations under civil or labour law, such as an assertion of claims for damages or if they are general investigations to establish a criminal offence, the permissibility of data processing is based on article 6 or, for data covered by article 9 GDPR, on this provision.

The Brazilian General Data Protection Law (LGPD) does not have specific rules or principles that apply to internal investigations conducted within private organisations. Despite that, the general principles and obligations set forth by the LGPD apply to any processing of personal data carried out within the context of such investigations. As a result, the company must ensure the transparency of such processing activities through a privacy notice addressed to the data subjects; only process the personal data that is necessary for the investigation; define the lawful basis that applies to such processing activities (especially for sensitive data); and apply any other obligations established by the LGPD.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

In general, it is advisable to back up data, documents, emails and other records promptly to prevent their deletion. Admissibility depends on whether the data originates from personal or professional records and whether they are legally relevant. If internal investigations are carried out based on a specific suspicion of a criminal offence, it is the processing of legally relevant data. In general, the processing of professional emails or documents is permissible. If there is no professional connection, access to private files and documents is only permitted in exceptional cases.

If, for example, using a business email account for private purposes is not allowed, the employer can usually assume that the data processed is only "general" data within the meaning of article 6 GDPR and that such data processing is justified by a balancing of interests. However, if private use is allowed, the data may still be part of a special category within the meaning of article 9 GDPR. In such cases, the justification for its use must be based on one of the grounds explicitly mentioned in article 9(2) GDPR.

The employer must protect the employee's rights under section 16 of the ABGB and must consider the proportionality of the interference. Only the least restrictive means – the method that least interferes with the employee's rights – may be used to obtain the necessary information. The employer's interest in obtaining the information must outweigh the employee's interest in protecting his or her rights. The implementation or initiation of controls by the employer does not automatically constitute an interference with personal rights, as being subject to the employer's rights of control is part of the position as an employee.

No; employers are only generally allowed to search the work tools they provide to employees, such as company mobile phones, electronic files, and company email and other electronic communications. However, they may also request that employees turn over any company documents in their possession.

Searches of employees’ private possessions or files during an investigation can only occur with the verifiable consent of the employee.   

Only the police can search employees' possessions (assuming that the prerequisites outlined in the legislation are met).

The provisions of the Whistleblowing Directive must be respected. In Austria, these have been implemented through the Whistleblower Protection Act (HSchG). If the whistleblower or the persons concerned fall within the scope of the Directive, their identity must be protected. Only authorised persons may access the report. Retaliatory measures are invalid or must be reversed. Within a maximum of seven days, the whistleblower must receive a confirmation of his or her complaint. Feedback to the whistleblower must then be provided within a maximum of three months.

If the investigation involves matters within the scope of a specific whistleblowing policy, the policy rules should prevail against the general investigation rules if there is a conflict.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

If the report and the whistleblower fall within the scope of the Whistleblowing Directive, his or her identity must be protected. From a data protection perspective, the principles of the DSG must be observed to protect the legitimate confidentiality of the individuals concerned.

Furthermore, the employer should ensure that information is only disclosed to trustworthy persons to avoid pre-judgements.

Law 14.457/2022 states that companies must guarantee the anonymity of accusers. As a result, it is best practice that companies allow for anonymous submissions, or allow accusers to voluntarily disclose their identity while acknowledging that they agree that it will be kept confidential to the extent required by the investigation.

Also, companies should have internal rules stating that all parties involved in an investigation (accusing party, accused party, witnesses, investigators, and any other person that has any contact with the investigation) must keep the existence of the investigation and of the events related to the investigation confidential to the extent required by the investigation, and discipline any individuals that violate this.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

The purpose of internal investigations would be jeopardised by fully informing a suspected employee beforehand, as it would allow him or her to hide or destroy possible evidence, plan his testimony or coordinate with other employees.

There is no legal requirement to inform the employee of the allegations or suspicions.

There is no obligation to inform an employee under investigation that this is the case, and it should not happen automatically.

While some policies require that the investigated employee be informed about the allegations against them at the beginning of the investigation, from a local perspective it is recommended that the accused employee be notified about the existence of the allegations if, after a reasonable review, there are elements that suggest that the accusation may be material.

In this context, the employee should be informed about the accusation and be allowed to confirm, deny, provide further context or justify each reported or identified event; offer evidence; and indicate persons or sources of information that could corroborate his or her defence. Information about the accusation must be focused on facts rather than on how the company obtained the information.

If the accusation is found to be groundless after initial review, involving the accused employee at the beginning of the process may have triggered unjust and unnecessary stress and a disruption in the employment relationship that may not be satisfactorily repaired by a determination that the accusation was void. This may result in a legal liability for the company or HR issues that could otherwise have been avoided.

The process must be transparent and impartial, and therefore all the information that may influence the conclusions made during the investigation should be shared with the employee.

When dealing with reports and persons covered by the HSchG, the provisions on identity protection must be followed. In all internal investigations, only authorised persons should receive information.

Yes, the identity of the complainant, witnesses and sources of information for the investigation should be kept confidential.

See question 11, there is no protection of anonymity as the process must be transparent to the parties involved.

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

If a lawyer is involved in the investigation, communication between the lawyer and client is subject to legal professional privilege. These communications must not be disclosed. Any documents collected by an internal audit can be seized and used. However, a document created by a lawyer can only be seized. The same applies to other professional representatives of parties, such as notaries and auditors, as potential holders of professional secrecy.

Privilege attaches to investigation materials when attorneys conduct interviews and take notes, and when they write reports and recommendations.

However, if other persons participate in an interview or write a report, and they are not attorneys, they can be required to testify about what they witnessed while participating in the interview or to discuss or disclose their investigation report.

For this reason, when starting an investigation, and depending on the matters to be investigated, it is important to determine whether it is convenient to allocate lawyers to certain roles to increase the company’s control of corporate confidentiality resulting from third-party involvement in the investigation.

Attorneys should also clearly state to participants of the investigation that they are attorneys representing the company and that their work papers fall under attorney-client privilege and will not be shared with them.

The privilege of investigation materials concerns a rather limited amount of cases. In practice, materials may be considered privileged in connection with the litigation process under the Procedural Code (4/1734). For example, communications between a client and an attorney may attract protection against forcible public disclosure.

In general, an employee is not entitled to have a representative present during investigations. However, he is free to reach out to the works council or independently contact a lawyer for advice. The employer must hear the works council upon his or her request on all matters concerning the interests of employees at the company. Once disciplinary proceedings begin, the employee has the right to be represented by a lawyer.

Legally, a minor or someone with limited mental capacity must be represented by his or her parents or legal guardian in a meeting at work. Besides that, employers are not legally required to allow any external person to accompany employees during investigations, since these are internal proceedings and, generally, employee participation should be voluntary and not subject to retaliation, including if the employee refuses to participate.

The employee under investigation has a right to have a support person present (eg, a lawyer or an employee representative) during the hearings and a right to assistance in preparing written statements.

The Austrian Labour Constitution Act (ArbVG) does not contain any provisions regarding workplace investigations. The employee has the right to address the works council but is not entitled to have the works council comply with his or her request.

The works council's opportunities for participation are conclusively regulated. Certain investigative or control measures may require the consent or co-determination of the works council.

Under section 96(1)3 ArbVG, the consent of the works council is required if the employer wishes to introduce and maintain control measures or technical systems for monitoring employees that affect human dignity, such as video surveillance or specific staff questionnaires. If there is no works council, the consent of each individual employee is required.

No, there is no such right.

A works council or a trade union does not have a role in the investigation.

There is no additional support for the employees concerned. However, the employer may offer support measures to the employees to ensure better cooperation. The choice of support measures is at the employer's discretion. For example, the employer could offer to bear lawyer’s fees, if the employee is cooperative. Such decisions must always be made on a case-by-case basis.

It is highly recommended that investigation interviews are conducted in the interviewed person’s native language, even if the individual speaks the language used for business within the company, to ensure that there is no miscommunication or loss of accuracy in the determination of the facts. Also, speaking their native tongue reduces the discomfort of participating in the interview and potential extra work due to post-interview correction or confirmation. Depending on the scope of the investigation, the company can have attorneys who speak both the individual’s language and the company’s business language conducting interviews.

They can request assistance, for example, from an occupational health and safety representative, a shop steward or the occupational healthcare provider.

The employer must decide how to deal with this information. Possible options are to initiate separate and unrelated investigations or to extend the ongoing investigations.

If unrelated matters are revealed as a result of the investigation, the company must be notified and must start a new investigation regarding them per the appropriate rules, without affecting the original investigation.

If they are related to the work or workplace, the employer will handle the emerging matters separately. In internal investigations, the employer is allowed to use any material legally available.

Provided the employer complies with labour law and data protection regulations, internal investigations are lawful and are not regarded as administrative or judicial proceedings. If legal consequences for not cooperating, such as dismissal, are threatened by the employer or his investigators, the offence of coercion under section 105 of the Austrian Criminal Code could be fulfilled.

If the object of the grievance is connected to the ongoing investigation, the investigator may pursue that grievance within the same procedure or open a separate matter, under the company’s rules governing such a situation.

If the object of the grievance is not connected to the investigation, the employee must report the matter, or the investigator can do it, if the company’s policies allow it.

If the nature of the grievance relates to the employer's obligations to handle such matters in general, the grievance will be investigated either separately or as a part of the ongoing investigation.

The involved employee's sick leave does not affect the internal investigation. Most investigative measures can be carried out without the employee's presence.

Sick leave suspends the employment agreement, and as a rule the employee should not be contacted during such a suspension. The investigation may continue without the participation of the investigated employee while that employee is absent, have its conclusion suspended while he or she is on leave, and resume once the employee returns to work.

As a general rule, sick leave does not prevent an investigation from progressing. Depending on the nature of the sickness, the employee can attend hearings and take part in the procedure. If the sickness prevents the employee from participating, the employer can put the process on hold temporarily.

Private investigations differ from criminal or regulatory investigations. Nevertheless, even for internal investigations, it is advisable to collect evidence in a way that can be admitted in court, as it may have to be presented to the authorities during the investigation process. Generally, any evidence obtained in the course of an internal investigation may be admitted in subsequent administrative or judicial proceedings.

If the evidence is not voluntarily surrendered, seizure or confiscation is possible. Since official proceedings are often lengthy, suspension is not always recommended.

The company may be required to share information or documents with authorities such as a judge, the police, or the Public Attorney's office, or be subject to a government authority’s dawn raid. Workplace investigations can and in most cases should continue, and in such circumstances client-work privilege will be essential to enable the employer to control information being shared with third parties.

Regardless of a possible criminal investigation, the employer must run its internal workplace investigation without unnecessary delay. A workplace investigation and a criminal investigation are two separate processes and can be ongoing simultaneously, so the criminal process does not require the workplace investigation to be stayed. Thus, parallel investigations are to be considered as two separate matters. The police may only obtain evidence or material from the company or employer if strict requirements for equipment searches are met after a request for investigation has been submitted to the police.

The employee has no general right to be informed of the results of an investigation. However, if the employer is considering consequences under labour law based on the result of the investigation, such as termination or dismissal, the employee must be informed accordingly.

There is no legal obligation to inform them of the outcome. Any obligation would come from the company's policies.

The employer's conclusions from the investigation.

The employer should determine the intended recipients and format of the report in advance. In many cases, it may be advisable to publish only the results of the investigation to protect the privacy and reputation of the individuals concerned, as this may help to minimise any potential negative impact on them.

However, under certain circumstances or due to legal requirements, full disclosure of the investigation report may be required, especially if transparency and disclosure are necessary to maintain public or investor confidence.

There is no legal requirement or recommendation for the company to share the full or partial report or findings. It is also not a recommended measure. Therefore, unless the internal rules determine that the company must do it, any answer to queries should be limited to the fact that the investigation was concluded, and the company took the appropriate action.

The employee under investigation may only be informed of the conclusions.

The employer may impose consequences under labour law. Consequences may include verbal or written warnings, transfers or other disciplinary measures. The employer may also implement training or educational measures if the issue is due to the employee's lack of knowledge. In serious cases, besides dismissal without notice – for example. if the employer seeks damages –legal action (civil or criminal) may be taken against the employee.

If investigators conclude that a breach has occurred, the company may determine the appropriate response, which may include verbal or written warnings; the suspension of employment without payment (for up to 29 days) or termination of employment without or with cause; a review of policies or operational protocols; and new training modules or the updating of training modules.

If the investigators conclude that a breach has not occurred but determine that the report was made in good faith, the case must be set aside. If the investigators determine that the report was made in bad faith, the employer must determine how to respond to the bad-faith reporter.

The employer decides whether misconduct has taken place or not. Depending on the case, the employer may recommend a workplace conciliation in which the parties try to find a solution that can be accepted by both sides. The employer may choose to give an oral reprimand or a written warning. If the legal conditions are met, the employer may also terminate the employment agreement.

It is up to management to decide which results should be disclosed and to whom. It is important to know who the persons concerned are and who has an interest in disclosure.

From a legal perspective, disclosure must follow the GDPR. Internal policies can specify how the results are to be handled. Works Council Agreements (WCAs) may also contain regulations on how to deal with internal investigations and the disclosure of results.

There is no requirement to publish the results of the investigation, but it may be advisable to cooperate with the authorities. This is particularly the case if the employer has suffered damage or is himself threatened with prosecution. The release of investigation results can be compelled through the courts.

There are no legal requirements for the company to share the investigation findings with any party, including the reporter and the investigated party, so the employer must carefully consider the pros and cons of doing so on a case-by-case basis. Interview records can generally be kept private if interviews were conducted by an attorney.

In general, investigation materials, including findings, that includes personal data should only be processed by the personnel of the organisation who are responsible for internal investigations. However, it may in some situations be required by applicable legislation that findings are disclosed to competent authorities for the performance of their duties, such as conducting investigations in connection with malpractice and violations of the law.

Data protection law requires that personal data should not be kept longer than necessary for the purpose it was collected. Once the purpose of the internal investigation is fulfilled and the data is no longer needed, it should be deleted or anonymised. Regulations regarding this matter may also be subject to WCAs or internal policies. In any case, it is advisable to keep the results for as long as they may be needed in possible subsequent administrative or judicial proceedings.

The existence of the investigation should be kept on file for at least five years from the date of its conclusion. All information related to the investigation should be kept on file for the same period, but not on the employee’s record, to avoid the risk of accidental access by unauthorised individuals.

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

This relates to the severity of the error. Data protection violations can lead to fines by the data protection authority or claims for damages. If consequences under labour law, such as dismissal, have taken place due to erroneous investigations or incorrect results, the employee concerned can assert claims under labour law or seek damages.

Furthermore, there may be consequences under criminal law. This is particularly the case if documents have been falsified in the course of the investigation. It is, therefore, crucial that employers exercise diligence and due process in internal investigations. Investigations must be conducted transparently and lawfully.

The employer’s legal exposure resulting from errors during the investigation depends on the error and the victim or victims affected. It may range from paying damages to a witness who was harassed because the company did not prevent retaliation from occurring; to the reversal of a termination for cause if a court determines that the evidence collected during the investigation did not meet the legal threshold to uphold it; to indemnification for a violation of privacy; or criminal prosecution because of unauthorised access to private communications.

There are no regulations regarding the actual investigation process. Therefore, the employer cannot be accused of procedural errors as such. However, once the matter has been adequately investigated, the employer must decide whether or not misconduct has taken place. If the employer considers that misconduct has taken place, the employer must take adequate measures for remedying the situation. Failure to adequately conduct the investigation could result in criminal sanctions being imposed on the employer as an organisation or the employer’s representative, or damages.