Workplace Investigations

Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law, has been implemented in Spain through Law 2/2023 (Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción). This law limits the capacity of companies to retaliate or to take any action against employees who report workplace violations or breaches of the law. Any action taken against an employee in such a position would be considered null and void if challenged in court.

Spanish law allows anonymous reports to protect whistleblowers from retaliation.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

The employer should first identify which individuals may have protection as whistleblowers. This could be a current or former employee who raises the initial complaint, a co-worker who gives evidence as part of the investigation, or the accused employee.

In each case, consider whether a “protected disclosure” has been made (under Part IVA ERA 1996). This requires analysis of the subject matter of the disclosure, how it is made, and a reasonable belief that it is made in the public interest.

Employers must then ensure there is no detrimental treatment or dismissal of any worker on the grounds of their protected disclosure. Although the causation test for these purposes is not straightforward, as a general rule if the protected disclosure has a “material influence” on the decision to discipline or dismiss, there may be liability. Individual managers may be personally liable alongside the employer. Compensation for whistleblowing cases is uncapped, meaning businesses and individuals can face significant financial and reputational exposure.

What this means in practical terms is that the employer should promote a “speak-up” culture and, where protected disclosures are made, ensure they are handled by a team who are properly trained in how to do so.

The outcome of the investigation will contain personal data of the affected employee. For this reason, this information should only be kept for as long as a legal obligation or liability in connection with the information could arise for the company. Since the general statute of limitations for employment liability is one year, this is a good guideline.

In addition to the above, two specific rules apply:

• once the information becomes irrelevant for the purpose for which it was obtained and processed, the information should no longer be stored on the employee’s record or elsewhere; and
• the employees’ information (including those of the reporter and the affected employees) should only be stored in whistleblower systems during the time that is necessary to decide on whether the facts need to be investigated or not and, in any case, for a maximum period of three months.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

The investigation outcome may not need to be noted on the accused employee’s record at all. Usually only the outcome of any subsequent disciplinary or grievance process would be noted, rather than the prior investigation.

The employer should keep the investigation report for as long as it remains relevant. This would usually be no longer than six years, unless regulatory obligations dictate otherwise. The report along with all documentation and witness statements gathered during the investigation should be retained securely and confidentially but for no longer than is absolutely necessary under the requirements of the DPA 2018 and the employer's data protection policies and procedures. There may be additional retention requirements in a regulated context; the position for each particular business and employee should be checked.