Workplace Investigations

The first consideration here is what constitutes "employees' possessions". More often than not, employees will be using employer property and there should be clear policies in place that specify company property.

The difficulty arises if an employee is using personal equipment such as a mobile phone for work purposes. While there may be specific applications dealing with work-related matters that are accessible by the employer remotely, some applications may be device-specific and that is where issues may arise. In such instances, it is not unreasonable to ask the employee to provide such information or consent to a search of their personal property. However, this is the exception rather than the rule and all other legitimate avenues of obtaining such information should be explored first. Further, such requests for information should not be a fishing expedition as an employee has a reasonable expectation of privacy at work, which must be balanced against the rights of the employer to run their business and protect the interests of their organisation.

A search of physical items such as a desk or drawers should only be conducted in exceptional circumstances, even where there is a clear, legitimate justification to search and the employee should be present at the search.

Please see question 7.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

Depending on the nature of the subject matter of the investigation, it may be appropriate to notify the Garda Siochana or a specific government body such as Revenue. Also, if the employee occupies a regulated position, it may be necessary to inform the relevant regulator. Again, compliance with GDPR obligations should be borne in mind.

Companies may only disclose the outcome of an investigation to employees or officers of the company who are empowered to adopt the measures that are necessary because of the investigation’s results (see question 4).

This disclosure obligation does not extend to authorities: while there is a general obligation to report criminal or administrative offences to the competent authorities, this obligation must be read in line with the companies’ right not to self-report themselves. What a company must not do is cover up, aid or otherwise become an accessory to the offence.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]