Workplace Investigations

The Employment Ordinance (EO), which is the primary legislation governing employment relationships in Hong Kong, does not provide for a statutory workplace investigation procedure.

The Labour Department of Hong Kong has, however, published a Guide to Good People Management Practices[1] which recommends that employers lay down rules of conduct, grievance and disciplinary procedures. Such rules should be simple and clear, logical and fair, and in line with the provisions in the EO.

As part of risk management and internal controls, Hong Kong-listed companies are expected by The Stock Exchange of Hong Kong Limited (SEHK) to establish whistleblowing policies and systems for employees to raise concerns about possible improprieties with independent board members. Listed companies are also expected to establish policies for the promotion and support of anti-corruption laws and regulations. Such policies and systems may include workplace investigation procedures.[2] If a listed company chooses to not establish such policies and systems, it is required to explain how it could achieve appropriate and effective risk management and internal controls.

From an Italian employment law perspective, there is no specific body of legislation that governs investigations. However, several legal and case-law principles may be relevant concerning various specific aspects of investigations, and to which reference will be made below (eg, provisions under Law No. 300 of 1970, the so-called Workers’ Statute regarding “controls on employees”, both physical and “remote”, or regarding “disciplinary proceedings”).

In addition, and outside of the specific scope of employment law, other law provisions may have an impact on investigations, including those regarding privacy law (eg, Italian Legislative Decree No. 196 of 2003 and the Regulation (EU) No. 679 of 2016 (GDPR), regarding data protection and the related policies), whistleblowing (Law No. 179 of 2017 and Directive (EU) No. 1937 of 2019, regarding whistleblower protection) and criminal law (eg, Italian Criminal Procedure Code, providing rules for criminal investigation and Italian Legislative Decree No. 231 of 2001, regarding the corporate (criminal) liability of legal entities).

There is no specific legal regulation for internal investigations in Switzerland. The legal framework is derived from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights. Depending on the context of the investigation, additional legal provisions may apply; for instance, additional provisions of the Swiss Federal Act on Data Protection or the Swiss Criminal Code.

Hong Kong does not have a comprehensive legislative framework relating to whistleblowing. Therefore, in general, employers are free to establish whistleblowing policies and procedures and confer such protections on whistleblowers as they see fit. That said, companies listed on the Main Board of the SEHK are expected to establish a whistleblowing policy and system for employees to voice concerns anonymously about possible improprieties in the companies’ affairs. If a listed issuer deviates from this practice, it must explain the deviation.[1]

When an investigation involves whistleblowing, the employer needs to comply with the relevant policy and system and provide the whistleblower with such protections as stated in the policy. The employer should not ignore a complaint simply because it was made anonymously, and should ascertain the substance of the complaint to decide whether a full-blown investigation is warranted.

In addition, the employer should seek to establish a secure communication channel with the whistleblower to gather more information about the complaint or misconduct while maintaining the confidentiality of his or her identity. If the complaint is serious, the employer may consider referring the complaint to a law enforcement agency or regulator as they would be better placed in protecting the anonymity of the whistleblower while proceeding with the investigation. That said, employers generally have no obligation to report internal wrongdoing to any external body (please see question 25 for exceptions). The employer may assess whether it is appropriate to do so on a case-by-case basis.

The regulations on whistleblowing in the private sector were originally outlined in article 6 of Italian Legislative Decree No. 231 of 2001 (as amended by Law No. 179 of 2017), which state that the models of organisation must provide for one or more channels that allow persons in positions of representation, administration and management of the entity (and persons subject to their direction or supervision) to report unlawful conduct according to Italian Legislative Decree No. 231 of 2001 and violations of the entity’s organisational and management rules.

Currently, Italy has implemented Directive (EU) No. 1937 of 2019, which provides for the adoption of new standards of protection for whistleblowers, through the Italian Legislative Decree No. 24 of 2023 (WB Decree)[1].

In line with the Directive, the WB Decree states, inter alia, that[2]:

• an internal whistleblowing reporting channel must be put in place by all private legal entities (and legal entities in the public sector) that have employed, during the previous year, an average of 50 employees or, even below this threshold, operate in certain industries[3] or have adopted an organizational model in accordance with Legislative Decree no. 231 of 2001;
• the WB Decree prescriptions apply to reports concerning breaches of certain national/EU[4] legal provisions (varying depending on features such as the private or public nature of the employer and its dimensions), and not to claims or requests linked to interests of a personal nature of the reporting individuals (pertaining to their individual employment contracts or to relations with their superiors)[5];
• whistleblowers’ reporting may take place through:
  • the company’s internal reporting channels and internal reporting procedures (with the possibility – for entities employing up to 249 employees, even if not part of the same group – to share whistleblowing reporting channels); or
  • external reporting channels and external reporting procedures established by the member states’ competent authorities (in Italy, ANAC, i.e. the National Anticorruption Authority); or
  • in certain circumstances, public disclosure;
• whistleblowing systems must provide:
  • a duty of confidentiality regarding the whistleblowers’ identity (which generally may not be disclosed to persons other than those competent to receive or investigate on the reports, except in specific case and with the whistleblower’s consent; see also answer to question 12 below); and
  • ways of protecting collected data according to the GDPR, as well as tight deadlines for communication with whistleblowers[6]; and
  • an integrated system of protection of whistleblowers against any retaliatory action directly or indirectly linked to their reports or declarations, with a reversal of the burden of proof (meaning the employer must give proof of the non-retaliatory nature of measures adopted vis-à-vis whistleblowers); and
  • the procedures to be taken in case of anonymous whistleblowing report.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.