Workplace Investigations

From an Italian employment law perspective, there is no specific body of legislation that governs investigations. However, several legal and case-law principles may be relevant concerning various specific aspects of investigations, and to which reference will be made below (eg, provisions under Law No. 300 of 1970, the so-called Workers’ Statute regarding “controls on employees”, both physical and “remote”, or regarding “disciplinary proceedings”).

In addition, and outside of the specific scope of employment law, other law provisions may have an impact on investigations, including those regarding privacy law (eg, Italian Legislative Decree No. 196 of 2003 and the Regulation (EU) No. 679 of 2016 (GDPR), regarding data protection and the related policies), whistleblowing (Law No. 179 of 2017 and Directive (EU) No. 1937 of 2019, regarding whistleblower protection) and criminal law (eg, Italian Criminal Procedure Code, providing rules for criminal investigation and Italian Legislative Decree No. 231 of 2001, regarding the corporate (criminal) liability of legal entities).

There is no specific legal regulation for internal investigations in Switzerland. The legal framework is derived from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights. Depending on the context of the investigation, additional legal provisions may apply; for instance, additional provisions of the Swiss Federal Act on Data Protection or the Swiss Criminal Code.

In the UK, the primary employment legislation of relevance to a workplace investigation includes the Employment Rights Act 1996 (ERA 1996), the Equality Act 2010 (EA 2010), and the Employment Relations Act 1999 (ERA 1999).

Other legislation includes the retained EU law version of the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the Investigatory Powers Act 2016 (IPA 2016) and the Investigatory Powers (Interception by Businesses etc for Monitoring and Record-keeping Purposes) Regulations 2018 (IP Regs 2018), and the Humans Rights Act 1998 (HRA 1998).

In terms of guidance, the Advisory, Conciliation and Arbitration Service (ACAS) have produced a Code of Practice on Disciplinary and Grievance Procedures (the ACAS Code) as well as a Guide to conducting workplace investigations. The Information Commissioner’s Office (ICO) have their Employment Practices Code,  and other pieces of guidance on the data protection aspects of investigations (see question 7).

Most employers will have internal policies governing how workplace investigations should be conducted. The level of detail may vary considerably; public sector and regulated employers may be more prescriptive in their policies, which may even have contractual force. There may also be provisions of the employment contract that are relevant (particularly as regards suspension – see question 3).

Generally speaking, even if the investigation leads to evidence of a criminal offence, the employer does not have to inform public authorities (citizens and private entities do not have an obligation to report crimes they discover). The existence of any obligations to report to regulatory authorities (eg, banking and insurance regulatory authorities) should be investigated on a case-by-case basis.

The internal procedures of the company – as adopted by the company in the framework of legislation on the administrative or quasi-criminal vicarious liability of legal entities – may require the findings to be disclosed to certain internal bodies or committees.

As said above, the police or public prosecutors (and possibly other public authorities) may have, within their investigatory powers, and in certain circumstances, the power to access internal investigation outcomes (but a case-by-case analysis would be necessary).

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]

Primarily, the investigation findings are disclosed to the employer and the employee under investigation. In scenarios involving allegations of a breach of regulatory duty or criminal law, the authorities may have the power to compel disclosure of any non-privileged materials generated in the investigation. Powers of compulsion do not apply to privileged materials.