Workplace Investigations

In general, from an employment law perspective, there is no specific legal rule governing the minimum qualifications of who should conduct a workplace investigation. Generally speaking, a workplace investigation is carried out by the internal audit function, when there is one (generally in large companies), or by the HR or legal departments.

Outside the workplace, the employer may carry out investigations on the employee – normally without the latter knowing – through a private investigator. This investigation should be carried out to verify that the employee does not engage in conduct contrary to the company’s interests (eg, unlawful competition, disclosure of confidential information, criminal breaches). In such cases, the private investigator must comply with specific rules, mainly found in Italian Royal Decree No. 773 of 1931, according to which the investigator must, among other things: hold a licence issued by the competent authority; and keep a register of the activities conducted daily.

In addition, if there is a suspicion that a crime has been committed, the company may appoint a criminal law lawyer to conduct their own defensive criminal law investigation, as provided by article 391bis and the Italian Criminal Procedure Code.

The examinations can be carried out internally by designated internal employees, by external specialists, or by a combination thereof. The addition of external advisors is particularly recommended if the allegations are against an employee of a high hierarchical level[1], if the allegations concerned are quite substantive and, in any case, where an increased degree of independence is sought.

While every internal investigation should be carried out promptly, thoroughly and in a well-documented manner, employers should appoint one individual or team of individuals to oversee all complaints regardless of how they are received. Doing so helps to ensure that all allegations are documented, reviewed and assigned for investigation as consistently as practicable.

Once a complaint is received and recorded, the company should undertake an initial triage process to determine:

• the risk of the alleged misconduct from a reputational, operational and legal perspective;
• who is best suited to conduct an investigation based on the nature of the alleged misconduct and the perceived risk level (potential candidates may include members of human resources, legal or compliance departments, or outside counsel); and
• a plan for investigating the factual allegations raised in the complaint.

The appropriate investigator should be able to investigate objectively without bias (ie, the investigator cannot have a stake in the outcome, a personal relationship with the involved parties and the outcome of the investigation should not directly affect the investigator’s position within the organisation); has skills that include prior investigative knowledge and a working knowledge of employment laws; has strong interpersonal skills to build a rapport with the parties involved and to be perceived as neutral and fair; is detail-oriented; has the right temperament to conduct interviews; can be trusted to maintain confidentiality; is respected within the organisation; and can act as a credible witness.

At this triage stage, an employer may also wish to use the information collected from the complaint to proactively identify potential patterns or systemic issues at an individual, divisional or corporate level and react accordingly. For example, if a company receives a complaint against a supervisor for harassing conduct and that same individual has already been the subject of previous complaints, the company should consider whether it may be appropriate to engage outside counsel to carry out a new investigation to bring objectivity and lend credibility to the review – even if the prior complaints were not ultimately substantiated following thorough internal investigations. Similarly, the engagement of outside counsel is often appropriate where a complaint involves alleged misconduct on the part of a company’s senior management or board members.

The employer would normally keep the outcomes of the investigation for the entire duration of the employment relationship with the involved employee.

After the termination of the employment relationship, it appears reasonable to conclude that the employer would be entitled to retain this information for the time necessary to exercise its defence rights in litigation (taking into account that 10 years is the statute of limitations for contractual liability). Further requirements or restrictions under general privacy laws (and particularly the GDPR) should also be checked.

According to Art. 14 WB Decree, internal and external whistleblowing reports (including related documents) must be kept for as long as necessary for report processing, but no more than five years from the date of transmission of the procedure's final outcome.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

There is no requirement for the results of a workplace investigation to remain on an employee’s record for any specific period. It is often helpful, however, for information relating to the outcome of such an investigation (regardless of whether the allegations are substantiated) to be accessible to the human resources or legal functions such that during the initial complaint intake process described above, any prior complaints and investigations relating to the same individual or group of individuals can be taken into account to identify any recurring issues or systemic violations.